TAAD - A Tool for Traffic Analysis and Automatic Diagnosis Kathy L. Benninger NLANR/Pittsburgh Supercomputing Center

NLANR/PSC D 2 Outline Context for development of TAAD Characteristics of the tool Performance model Output description and interpretation OCXmon Practical considerations

NLANR/PSC D 3 Context TAAD is being developed by the NLANR network research group based at the Pittsburgh Supercomputing Center NCNE Pittsburgh GigaPoP based at PSC Coexistence of NLANR group and the NCNE Pittsburgh GigaPoP provides ample opportunity for development and test.

NLANR/PSC D 4 Context (cont’d) Need for tool to support NLANR/PSC’s TCP Trace-based Performance Diagnosis Flowchart –Analysis of heavily aggregated traffic –Automatic problem detection and partial diagnosis Availability of OCXmon data collection

NLANR/PSC D 5 Tool Characteristics Searches aggregate traffic for miss-tuned microflows Tool for GigaPoP operators Examines traffic from GigaPoP viewpoint, but detects end-system problems

NLANR/PSC D 6 Tool Characteristics (cont’d) Uses model developed in “The Macroscopic Behavior of the TCP Congestion Avoidance Algorithm” [Mathis, Semke, Mahdavi, Ott, CCR July 1996] Compares actual TCP performance to performance predicted by the Model

NLANR/PSC D 7 Tool Characteristics (cont’d) Diagnosis of bulk flows Does not pinpoint why performance is poor Evolving...

NLANR/PSC D 8 Macroscopic Performance Model Rate = Estimated data rate (bytes/second) MSS = Maximum Segment Size (bytes) RTT = Round Trip Time (seconds) p = Segment loss rate (probability) C = Proportionality constant (typically 0.7)

NLANR/PSC D 9 TAAD Calculation

NLANR/PSC D 10 Model used by TAAD GainRatio = Indicates potential performance improvement p = Analogous to loss rate, but derived from number of packets successfully delivered between recovery events MeasuredRate = Data rate (bytes/second) RTT = Round Trip Time (seconds) MSS = Maximum Segment Size (bytes)

NLANR/PSC D 11 TAAD Output Fields Source addresses and ports Destination addresses and ports Start time and duration of flow Counts of packets and bytes GainRatio and OpportunitySize

NLANR/PSC D 12 TAAD Output Interpretation If GainRatio –is ~ 1, flow performance is close to Model –is > 1, indicates a non-IP bottleneck –is >> 1, invites tuning to improve performance –is < 1 means cheating!

NLANR/PSC D 13 TAAD Output Interpretation (cont’d) OpportunitySize is GainRatio scaled by number of packets –Indicates how much data could have been transmitted in the same amount of time on a properly tuned connection –Output flows are sorted by OpportunitySize –Flows with largest OpportunitySize offer largest payoff with tuning

NLANR/PSC D 14 Sample Output

NLANR/PSC D 15 OC3mon Available though development efforts of –NLANR/MOAT project at SDSC –MCI’s OCXmon activity –CAIDA’s CoralReef software suite Passive network monitoring tool

NLANR/PSC D 16 OC3mon (cont’d) Data format –Trace files collected in Coral.crl format –Analysis output of TAAD is ASCII Collects packet headers Does not collect payload

NLANR/PSC D 17 Operation Five minute trace on one or two interfaces New trace capture begins while previous five minutes of data is analyzed Data volume (per interface, mid-day) –Capture.crl file ~ 40MB/minute –Analysis output filesize ~ 25K/minute

NLANR/PSC D 18 Operational Issues Data Policy –Amount of data –Security and privacy –Legal liability Run time –ATM card(s) devoted to continuous capture –Recommend dedicated machine

NLANR/PSC D 19 Resource requirement Currently running on one Intel 450MHz CPU –CPU ~2% load during trace capture –CPU ~75-80% load during analysis (and continued trace) –wall-clock time for analysis is < 1 minute for a 5 minute trace capture (~200MB trace file) 6GB disk sufficient for summary data

NLANR/PSC D 20 Future Verification and release Adaptation for use with other trace tools Additional tools to create a TAAD toolset

NLANR/PSC D 21 Conclusion TAAD is intended to help meet the need for a tool to automate the analysis and diagnosis of aggregated bulk flows. The analysis and diagnosis is based on comparing modeled and actual performance Output is intended to be a pointer for where to direct tuning efforts for maximum benefit

NLANR/PSC D 22 References Macroscopic paper – TCP Tuning – TAAD – CoralReef –