1. Interpreting Network Traffic Flows Bill Jensen, Paul Nazario and Perry Brunelli

2. Agenda 1. How did we get here 2. Network monitoring tools 3. Sample graphs

3. n Shawn Fanning n http://www.time.com/time/magazine/arti cles/0,3266,55730,00.html Napster

4. Taming Bandwidth Hogs... How can your campus do it? Ana Preston, University of Tennessee Linda Roos, University of Nebraska, Lincoln Tuesday, 11:45, Marquis 4

5. www.funnytimes.com

6. A simple question n CIO requested that we estimate Internet transit requirements for the next 18 months

7. Sources n www.research.att.com/~amo/doc/netwo rks.html n http://www.research.microsoft.com/~Gr ay/Moore_Law.html

9. What are current bandwidth requirements? What do we receive from our provider?

10. A few words about UW Internet access n WiscNet is a state education-based ISP - founded with help from UW-Madison n Charter membership included 14 UW- System universities and 8 privates colleges n WiscNet now serves over 500 educational institutions - predominantly K-12

11. The WiscNet backbone n Comprised of OC-3 links connecting UW- Madison, UW-Milwaukee, the Chicago NAP and the Ameritech Advanced Data Service Center (AADS), also in Chicago.

14. WiscNet Services n Internet transport and transit n Internet 2 transport n Peering transport at AADS

15. Current bandwidth requirements continued... n Inbound vs. outbound traffic n Usage caps n Prime time usage n Peering and I2 traffic n Effect of peer-to-peer networking and future policy on usage/fair utilization

16. www.wiscnet.net

17. What is a flow? n Host-to-host conversation between that includes the IP address and port # for each host. n Representation of a series of packets traveling between two end-points. n A unidirectional series of IP packets of a given protocol, traveling between a source and destination within a certain period of time.

18. Flow as represented by log n Easy to think of it as we would a sniffer trace - bits and bytes seen traversing the wire n In actuality, the flows are the accounting record or log of activity as reported by the router

19. Measurement Tools - Flowscan n Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows n Analyzes and reports on NetFlow data collected by CAIDA’s clfowd n Stored using RRDtool - time series data n Flowscan provides reporting capabilities and visualization of flow data

20. Example n cflowd receives flow data from the router and writes it to disk. n Flowscan parses/messages data from cflowd and stores the results in RRD format. n RRDtool graph produces graphs from RRD files.

21. More on FlowScan See http://net.doit.wisc.edu/~plonka/lisa/FlowScan/ plonka@doit.wisc.edu http://mil.doit.wisc.edu/~plonka/ Dave ->

22. General Flowscan Graphs

32. Network Events Captured by FlowScan

39. New Development wwwstats.net.wisc.edu/CampusIO/top/originAS.html wwwstats.net.wisc.edu/CampusIO/top/128.104.16.0_22_top.html

40. “It’s easier to ride a horse in the direction it’s going” Daniel Burrus www.burrus.com