1. TAAD - A Tool for Traffic Analysis and Automatic Diagnosis Kathy L. Benninger benninger@psc.edu NLANR/Pittsburgh Supercomputing Center

2. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 2 Outline Context for development of TAAD Characteristics of the tool Performance model Output description and interpretation OCXmon Practical considerations

3. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 3 Context TAAD is being developed by the NLANR network research group based at the Pittsburgh Supercomputing Center NCNE Pittsburgh GigaPoP based at PSC Coexistence of NLANR group and the NCNE Pittsburgh GigaPoP provides ample opportunity for development and test.

4. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 4 Context (cont’d) Need for tool to support NLANR/PSC’s TCP Trace-based Performance Diagnosis Flowchart –Analysis of heavily aggregated traffic –Automatic problem detection and partial diagnosis Availability of OCXmon data collection

5. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 5 Tool Characteristics Searches aggregate traffic for miss-tuned microflows Tool for GigaPoP operators Examines traffic from GigaPoP viewpoint, but detects end-system problems

6. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 6 Tool Characteristics (cont’d) Uses model developed in “The Macroscopic Behavior of the TCP Congestion Avoidance Algorithm” [Mathis, Semke, Mahdavi, Ott, CCR July 1996] Compares actual TCP performance to performance predicted by the Model

7. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 7 Tool Characteristics (cont’d) Diagnosis of bulk flows Does not pinpoint why performance is poor Evolving...

8. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 8 Macroscopic Performance Model Rate = Estimated data rate (bytes/second) MSS = Maximum Segment Size (bytes) RTT = Round Trip Time (seconds) p = Segment loss rate (probability) C = Proportionality constant (typically 0.7)

9. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 9 TAAD Calculation

10. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 10 Model used by TAAD GainRatio = Indicates potential performance improvement p = Analogous to loss rate, but derived from number of packets successfully delivered between recovery events MeasuredRate = Data rate (bytes/second) RTT = Round Trip Time (seconds) MSS = Maximum Segment Size (bytes)

11. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 11 TAAD Output Fields Source addresses and ports Destination addresses and ports Start time and duration of flow Counts of packets and bytes GainRatio and OpportunitySize

12. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 12 TAAD Output Interpretation If GainRatio –is ~ 1, flow performance is close to Model –is > 1, indicates a non-IP bottleneck –is >> 1, invites tuning to improve performance –is < 1 means cheating!

13. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 13 TAAD Output Interpretation (cont’d) OpportunitySize is GainRatio scaled by number of packets –Indicates how much data could have been transmitted in the same amount of time on a properly tuned connection –Output flows are sorted by OpportunitySize –Flows with largest OpportunitySize offer largest payoff with tuning

14. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 14 Sample Output

15. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 15 OC3mon Available though development efforts of –NLANR/MOAT project at SDSC –MCI’s OCXmon activity –CAIDA’s CoralReef software suite Passive network monitoring tool

16. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 16 OC3mon (cont’d) Data format –Trace files collected in Coral.crl format –Analysis output of TAAD is ASCII Collects packet headers Does not collect payload

17. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 17 Operation Five minute trace on one or two interfaces New trace capture begins while previous five minutes of data is analyzed Data volume (per interface, mid-day) –Capture.crl file ~ 40MB/minute –Analysis output filesize ~ 25K/minute

18. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 18 Operational Issues Data Policy –Amount of data –Security and privacy –Legal liability Run time –ATM card(s) devoted to continuous capture –Recommend dedicated machine

19. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 19 Resource requirement Currently running on one Intel 450MHz CPU –CPU ~2% load during trace capture –CPU ~75-80% load during analysis (and continued trace) –wall-clock time for analysis is < 1 minute for a 5 minute trace capture (~200MB trace file) 6GB disk sufficient for summary data

20. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 20 Future Verification and release Adaptation for use with other trace tools Additional tools to create a TAAD toolset

21. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 21 Conclusion TAAD is intended to help meet the need for a tool to automate the analysis and diagnosis of aggregated bulk flows. The analysis and diagnosis is based on comparing modeled and actual performance Output is intended to be a pointer for where to direct tuning efforts for maximum benefit

22. NLANR/PSC http://www.ncne.nlanr.net/TCP/TAA D 22 References Macroscopic paper –http://www.psc.edu/networking/papers/model_ccr97.ps TCP Tuning –http://www.ncne.nlanr.net/TCP/ TAAD –http://www.ncne.nlanr.net/TCP/TAAD CoralReef –http://www.caida.org/Tools/CoralReef/