Re: wiretapping continues....

["Matt Mathis" <mathis () pele psc edu>]

I am curious to know what you think is "correct" instrumentation.

Clearly in simple cases, capacity planing can be done with link statistics.

But it is not possible to compare the effective (useful?) capacities of two
different topologies without some form of traffic matrix.  I have observed
real situations where "better" topologies turned out to be worse, due to
unanticipated large traffic streams between sites.  Even a simple task, like
inserting a bridge to raise the performance of an overloaded ethernet quickly
degenerates into an exercises in combinatorics unless guided by a mac layer
traffic matrix.

I take it as a given that the Internet needs pro-active topology management
encompassing the upper level ISP's and interconnects.

Given that, what statistics and procedures would you suggest?

--MM--

P.S. I understand that there are business reasons for customers to want to
hide their traffic.  However, a full 20k route by 20k route traffic matrix is
about 2 GB per sample interval, which is pretty hard to inhale.  The best
possible data collection must be pretty sparse, due to CIDR or other
aggregation, coarse time scales and limited visibility.  This really seems
like the hard way to snoop somebody else's business.

Unless you are aware of examples.....
--MM--
- - - - - - - - - - - - - - - - -