TUNDRA The Ultimate Netflow Data Realtime Analysis Jeffrey Papen Yahoo! Inc.

TUNDRA Features 1.Source and Destination AS bandwidth analysis 2.Transit AS bandwidth analysis 3.Custom AS macros: Bandwidth forecasting, peering merit analysis 4.Billing Formulas for cost/ benefit budget analysis 5.Analyze usage for local servers or services - Charge Back Billing 6.Symmetric Network Performance Analysis: latency and packet loss 7.AS path hop count stats 8.DOS attack detection 9.All in Real Time

Why should you care about TUNDRA? 1.Empirical Data Prove that network performance increases Prove that network reliability increases as AS hops decrease Cost/Savings analysis for new peer or transit 2.Know how much bandwidth a peer will use before (or after) you turn link up – determine private vs. public peering need 3.Focus and Order peer hit list – who should you go after? 4.Business case to document support for peers that say No.

Why Call It TUNDRA?

Router Collector/ Processor SNMP Poller Zebra Server MySQL Database Continuously exporting flows Polls Interfaces. Stores to local DB 49,000 subnets processed in 2 – 3 minutes Flow % * SNMP stored in central DB 500Mb/sec in + out in 15 minutes generates approx 5,244,216 flows (288 MB). Processed in ,724 flows/sec

Flow Data TUNDRA Displays InboundOutboundTransit AS BandwidthXXX PortXX ProtocolXX Server (IP)XX AS PathX

Port Out

Protocol Out

Bandwidth Out

Transit Data All outbound flows have destination IP Each Destination Subnet learns AS path from Zebra BGP table - AS padding removed Zebra BGP table is identical to actual routes used on local router(s) Local BGP data reflects immediate policy changes with no performance impact or security threat to production routers

Destination vs. Transit Traffic – UUNet

AS Hop Count Table AS Path Hop CountRouter #1Router #2 0 (Yahoo!)0% 1 (Peering ISP) % % % % % % % % % % % % % % % % % %

Performance Analysis ICMP Ping vs. TCP packet with bogus SYN/ACK Testing is done from your network’s perspective Route-Maps on collector interface Simultaneous testing of multiple paths to same target AS No continuous IBGP flapping from /32 updates No adding and removing /32 static routes No 3 rd party remote applications logging onto routers Looking Glass server (www) for troubleshooting

TUNDRA Next Steps 1.White Paper – No, I really mean it! 2.I’m looking for help – this is a hobby, not my job 3.Maintainers to finish baking code and configuration 4.Release to Internet community 5.Licensing is GPL + please peer with Yahoo!

Questions? Jeffrey Papen