1. 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 1 IP Flow Information Accounting and Export Benchmarking Methodology http://tools.ietf.org/id/draft-novak-bmwg-ipflow-meth-03.txt Jan Novak Cisco Systems Presenting to BMWG @ IETF75 http://tools.ietf.org/id/draft-novak-bmwg-ipflow-meth-03.txt

2. 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 2 Document Goal Defines metrics to characterise Flow Monitoring performance based on: - Architecture Model for IP Flow Information Export: RFC5740 Defines conditions to perform Network Devices benchmarking in the presence of Flow Monitoring –IPv4 Benchmarking Methodology: RFC2544 –IPv6 Benchmarking Methodology: RFC5180

3. 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 324/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 3 Feedback from IETF74 What is the Benchmark and how to measure it?

4. The Concept – DUT 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 4 Forwarding PlaneFlow Monitoring Plane Flow Records Flow Export packetspacket rate Flow Record rate Netflow IPFIXOthers

5. 24/10/2015draft-novak-bmwg-ipflow-meth- 02.txt 5 Test Topology +-----------+ | | | Collector | | | +-----------+ | +----------+ +-------------+ +----------+ | | | | | | | sender |------->| |-------->| receiver | | | | DUT | | | | | | | | | | receiver |<-------| |<--------| sender | | | | | | | +----------+ +-------------+ +----------+ 24/10/20155draft-novak-bmwg-ipflow-meth- 03.txt

6. What is the Benchmark Flow Monitoring Plane: How many Flow Records the DUT can handle per second without dropping any Flow information – Flow Monitoring Throughput Data Forwarding Plane: RFC2544 Throughput measured in the presence of Flow Monitoring 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 6

7. What is the Benchmark Why two parameters ? Allows to express Flow Monitoring configuration and activity using one value while measuring RFC2544 metrics. Allows to measure maximum values but also to say: I expect such and such Flow Monitoring load, what is my RFC2544 metrics value ? 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 7

8. How to Measure 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 8 1.Configure DUT and traffic generator. 2.Send test traffic. 3.Capture Flow Export data and analyse for the counts of Flow Records. 4.Measure RFC2544 Throughput.

9. Setup – Cache Overflow Cache Size: 500 000 entries Inactive and Active Timeout: 500 second Packet size: 100 bytes Increment destination IP address within 16.0.0.0/8 Flow Keys: Source and Dest IP, IP proto, Source and Dest port Packets sent 1 000 000 Flow Records created 1 000 000 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 9

10. Results – Cache Overflow 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 10 PPS Send Time Time to Fill Flow Loss Flow Exp Cache flows Rate 70 000 14 sec 7 sec 23000 70000 66 000 15 sec 7.5 sec 1500 66000 65 000 17 sec 8.5 sec 0 65000 65 500 17 sec 8.5 sec 600 65500 Measured Flow Monitoring Throughput 65000 Flow Records per second

11. Result – Cache Overflow Flow Keys: IP source and destination address, IP protocol, IP source and destination port Benchmark: Flow Monitoring Throughput 65 000 Flows per second Benchmark: RFC2544 Throughput: 65 000 pps (52 Mbit/s 100 byte packets) 24/10/2015 draft-novak-bmwg-ipflow-meth- 03.txt 11

12. 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 12 Result – Cache Overflow Flow Keys: IP source and destination address, IP protocol, IP source and destination port Packet size 100 bytes FR – Flow Record Packets Flow Expiration RFC2544 per flow Rate Throughput 1 65 000 FR/s 65 000 pps 2 43 500 FR/s 87 000 pps 3 33 600 FR/s 101 000 pps

13. Result – Cache Overflow Flow Keys: destination IP address Benchmark: Flow Monitoring Throughput: 141 000 Flow Records per second Benchmark: RFC2544 Throughput: 113 Mbit/s (141 000 pps 100 bytes packets) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 13

14. Results Flow Keys: Source IP address Benchmark: Flow Monitoring Throughput Not applicable (Flow Expiration Rate 0) Benchmark: RFC2544 Throughput: 144 Mbit/s (180 000 pps 100 bytes packets) (toll to enable Flow Monitoring without any Flow activity) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 14

15. Results No Flow Monitoring applied Benchmark: RFC2544 Throughput: 536 Mbit/s (670 000 pps 100 bytes packets) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 15

16. Conclusion The effect of Flow Monitoring on RFC2544 metrics the DUT can achieve is a complex function of: 1.Traffic parameters. 2.The Flow Monitoring Cache configuration. 3.The Flow Keys configuration. 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 16

17. Conclusion The unifying parameter which allows to abstract from most of the contributors is the rate at which Flow Records expire from the Cache: Flow Monitoring Throughput (Flow Records per Second) With remaining dependency on ONLY Flow Keys (RFC2544 Throughput needs rate + packet size) 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 17

18. ??? 24/10/2015draft-novak-bmwg-ipflow-meth- 03.txt 18