Re: Any good method to check network overload?

[Sean Knox <sean.knox () sbcglobal net>]

> Maybe I'm missing something, but what's wrong with using MRTG?
>
> http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
>
> I mean, why reinvent the wheel?


The problem is that MRTG is too limited in its scope to be an effective 
measurement tool

Mark Reardon post summed up the problems of network load testing. I'd 
like to add a couple points.

1. What element of network traffic do you want to measure? In regards to 
TCP, jitter, rtt, and latency are just some of a dozen or so metrics to 
measure. Couple that with varying packet sizes, port numbers, etc., and 
you have a good deal of testing ahead of you. Just because you measure 
one element (ICMP ping for example) doesn't mean that is indicative of 
other types of traffic. As Mark mentioned, on a congested network, I 
might be able to download a linux distribution at a good rate, but 
interactive traffic via SSH or some other means will lag or time out.

2. ICMP Ping, and in turn MRTG, rrdtool, etc, is a poor assessment of 
network load. It's basically a 10,000-foot view of a problem. When 
you're pings start timing out and/or latency increases, you know there 
is a problem, but nothing beyond that. All you're actually measuring is 
your 64-byte ICMP pings-- not web traffic, smtp, or anything else. I 
suppose it's like driving a Volvo to see how fast your mustang runs. 
What is really needed is the ability to test specific aspects of the 
network- be it TCP, IP, UDP or otherwise. Some vendors do make such a 
product, hardware and software. Cisco and Brix are a couple I know of.

3. Additional monitoring software on a host adds further delay, as now 
the host has to process monitoring data as well as normal routed 
traffic. The best way around this problem I've seen is to establish a 
vector of some kind between two monitoring hosts on different ends of a 
link. i.e.

Monitor A -----> router ------> Monitor B

Specialized hardware is best suited for this task, although I haven't 
used any of the software packages, so I can't say. Also, as is obvious 
here, it's difficult to test the load on a server (as opposed to a 
router) because you run into problem #3.

Network metric testing is a complicated subject with no clear-cut 
solution yet.

-Sean