Questions on the protocol-agnostic congestion management strategy

[David Farber <dave () farber net>]

Begin forwarded message:

From: "Livingood, Jason" <Jason_Livingood () cable comcast com>
Date: October 6, 2008 5:25:06 PM EDT
To: "Mike Kasick" <mkasick () andrew cmu edu>
Cc: <dave () farber net>
Subject: RE: Questions on the protocol-agnostic congestion management  
strategy

Hi Mike -

See my replies inline below.

Regards,
Jason

Jason Livingood
Executive Director
Internet Systems Engineering
National Engineering & Technical Operations
Comcast Cable Communications
215-286-7813
jason_livingood () cable comcast com

> -----Original Message-----
> From: Mike Kasick [mailto:mkasick () andrew cmu edu]
> Sent: Thursday, October 02, 2008 12:49 AM
> To: Livingood, Jason
> Cc: dave () farber net
> Subject: Questions on the protocol-agnostic congestion
> management strategy
>
> Hi Jason,
>
> I'm a student in Dave Farber's Internet/Wireless policy class
> at CMU.  I've recently reviewed each of the FCC filings and
> the IETF slides on the Network Management Policy page on
> Comcast's web site, and I have a few questions about the
> specifics of the implementation of the protocol-agnostic
> congestion management strategy as described in Attachment B
> that I'd appreciate clarification on--if you're willing to do so:
>
> 1. How often is CMTS utilization checked?
>
>   I know the Port Utilization Duration is currently ~15 min,
> but does that
>   mean CMTS utilization is checked only at ~15 min
> intervals?  Or is it
>   checked more frequently (every minute, every second, etc.)
> looking at
>   usage for the past 15 minutes at the time of check?

This is checked much more frequently, and generally no less frequently
than every 5 minutes.  Depending upon a number of factors, ranging from
the CMTS vendor to how busy the network monitority app is, it could be
more frequent that every 5 minutes.  So within 15 minutes, we would
generally expect to have at least 3 CMTS utilization checks performed
(and we may well have more).

> 2. How often is user consumption checked (during Near
> Congestion State)?
>
>   Again, the User Consumption Duration is ~15 min, but does
> that mean user
>   consumption is checked only at ~15 min intervals, or more
> frequently?

We do not sample the current duration at a few points over the most
recent 15 minute period.  We actually have all of the utilization over
that approximate period, which is averaged over that period.  This is
much more accurate that taking a few samples over the period.

>   I ask the question because the "THEN, AT NEXT ANALYIS
> POINT (~15 MINS)"
>   text in Diagram 2 suggests that user consumption is
> checked at 15 min
>   intervals, but I would've expected at least CMTS port
> utilization to be
>   checked more frequently than at fixed 15 minute intervals
> (although,
>   admittedly the rates at which these two figures are
> checked don't need
>   to be the same).
>
> 3. What's the minimum length of time that a CMTS port may be in Near
>   Congestion State?  Is it ~15 min, or potentially less?

It would be at least 15 minutes, as you point out.

> 4. What happens to the user traffic priority statuses
> (BPE/BE) when the
>   CMTS port leaves Near Congestion State?  Are the previous
> designations
>   dropped entirely and recomputed the next time the state is entered?
>   (This would seem most logical.  Also, I know the status
> have no real
>   effect since the port is not in a congested state.)

The previously-collected user data for those periods is no longer of
interest to the congestion management system at that point.  However,
utilization for any user in the BE state will continue to be monitored
so we can release them as 50% of their provisioned speed (given that
release occurs below the utilization %).  Also, usage is narrowly
calculated from the most recent ~15 min period, rather than by also
looking at previous periods.

> 5. May I clarify the interpretation of the algorithm for computing
>   utilization averages (Port Utilization Threshold/User Consumption
>   Threshold)?
>
>   For example, assuming a link with provisioned bandwidth 8
> Mbps, for a
>   duration of 15 minutes, the algorithm would:
>
>   1. Calculate the maximum amount of potential data transfer
>      (8 Mbps * 15 min * 60 sec) = 7200 Mb.
>
>   2. Lookup the actual amount of data transferred for that
> duration (say,
>      6120 Mb).
>
>   3. Divide to obtain average utilization for that duration
>      (6120/7200 = 85%).
>
>   Is that a correct interpretation?

Pretty close.

Port Utilization is simple.  The CMTS is queried via SNMP polls to
obtain Port Utilization, which is expressed as a % (0% - 100%).  We
simply average the %s collected over the period.

For the User Consumption:
-- User is provisioned 8Mbps downstream.
-- 8Mbps * 900 seconds = 900.0MB
-- 70% of 900.0MB = 630MB
-- Check avg downstream utilization over that 15 min period, does it
exceed 630MB (yes/no)?

> 6. Finally, with respect to the recently announced 250 GB
> monthly bandwidth
>   cap, what would be the likely course of action if an
> unfortunate user
>   were the victim of a DoS or other malicious attack whereby this
>   threshold was exceeded by unsolicited incoming packets?
>
>   I realize this particular scenario is unlikely, far-fetched, and
>   potentially infeasible--but I'd like to have a response
> for anyone who
>   suggests that such a cap could "unfairly hurt" an
> individual who had no
>   intention of abusing the service.

Actually, that does happen.  In that case it is not the fault of the
user and the data is ignored -- and we spend a lot of time with the
customer on the phone fixing the issue (installing security s/w from
McAfee that is free to our users, etc.).  We are also spending time
trying to determine the location of bots on the network, in order to
root out malicious traffic like that.

On a related note, I do not believe many outside of the ISP industry or
law enforcement have any idea how large the bot net problem is.  To get
a sense of how big it is, consider that outbound spam is a prime symptom
of this and take a look at reports like this:
http://www.senderbase.org/home/detail_get_domain?displayed=lastmonth&act
ion=&screen=&order=&report_type=domain

> Thanks for any clarification you can provide.  I hate to be
> such a stickler, but I'm likely to be grilled on some of
> these points next week during class, and I want to make sure
> I have my facts straight. =)

Let me know if you have other questions, and we can speak on the phone.

> Thanks!




-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com