24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 1 IP Flow Information Accounting and Export Benchmarking Methodology Jan Novak Cisco Systems Presenting to IETF75

24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 2 Document Goal Defines metrics to characterise Flow Monitoring performance based on: - Architecture Model for IP Flow Information Export: RFC5740 Defines conditions to perform Network Devices benchmarking in the presence of Flow Monitoring –IPv4 Benchmarking Methodology: RFC2544 –IPv6 Benchmarking Methodology: RFC5180

24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 324/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 3 Feedback from IETF74 What is the Benchmark and how to measure it?

The Concept – DUT 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 4 Forwarding PlaneFlow Monitoring Plane Flow Records Flow Export packetspacket rate Flow Record rate Netflow IPFIXOthers

24/10/2015draft-novak-bmwg-ipflow-meth- 02.txt 5 Test Topology | | | Collector | | | | | | | | | | | sender | >| | >| receiver | | | | DUT | | | | | | | | | | receiver |< | |< | sender | | | | | | | /10/20155draft-novak-bmwg-ipflow-meth- 03.txt

What is the Benchmark Flow Monitoring Plane: How many Flow Records the DUT can handle per second without dropping any Flow information – Flow Monitoring Throughput Data Forwarding Plane: RFC2544 Throughput measured in the presence of Flow Monitoring 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 6

What is the Benchmark Why two parameters ? Allows to express Flow Monitoring configuration and activity using one value while measuring RFC2544 metrics. Allows to measure maximum values but also to say: I expect such and such Flow Monitoring load, what is my RFC2544 metrics value ? 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 7

How to Measure 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 8 1.Configure DUT and traffic generator. 2.Send test traffic. 3.Capture Flow Export data and analyse for the counts of Flow Records. 4.Measure RFC2544 Throughput.

Setup – Cache Overflow Cache Size: entries Inactive and Active Timeout: 500 second Packet size: 100 bytes Increment destination IP address within /8 Flow Keys: Source and Dest IP, IP proto, Source and Dest port Packets sent Flow Records created /10/2015draft-novak-bmwg-ipflow-meth- 03.txt 9

Results – Cache Overflow 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 10 PPS Send Time Time to Fill Flow Loss Flow Exp Cache flows Rate sec 7 sec sec 7.5 sec sec 8.5 sec sec 8.5 sec Measured Flow Monitoring Throughput Flow Records per second

Result – Cache Overflow Flow Keys: IP source and destination address, IP protocol, IP source and destination port Benchmark: Flow Monitoring Throughput Flows per second Benchmark: RFC2544 Throughput: pps (52 Mbit/s 100 byte packets) 24/10/2015 draft-novak-bmwg-ipflow-meth- 03.txt 11

24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 12 Result – Cache Overflow Flow Keys: IP source and destination address, IP protocol, IP source and destination port Packet size 100 bytes FR – Flow Record Packets Flow Expiration RFC2544 per flow Rate Throughput FR/s pps FR/s pps FR/s pps

Result – Cache Overflow Flow Keys: destination IP address Benchmark: Flow Monitoring Throughput: Flow Records per second Benchmark: RFC2544 Throughput: 113 Mbit/s ( pps 100 bytes packets) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 13

Results Flow Keys: Source IP address Benchmark: Flow Monitoring Throughput Not applicable (Flow Expiration Rate 0) Benchmark: RFC2544 Throughput: 144 Mbit/s ( pps 100 bytes packets) (toll to enable Flow Monitoring without any Flow activity) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 14

Results No Flow Monitoring applied Benchmark: RFC2544 Throughput: 536 Mbit/s ( pps 100 bytes packets) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 15

Conclusion The effect of Flow Monitoring on RFC2544 metrics the DUT can achieve is a complex function of: 1.Traffic parameters. 2.The Flow Monitoring Cache configuration. 3.The Flow Keys configuration. 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 16

Conclusion The unifying parameter which allows to abstract from most of the contributors is the rate at which Flow Records expire from the Cache: Flow Monitoring Throughput (Flow Records per Second) With remaining dependency on ONLY Flow Keys (RFC2544 Throughput needs rate + packet size) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 17

??? 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 18