nanog mailing list archives

Re: IPv6 traffic percentages?


From: Job Snijders <job () instituut net>
Date: Thu, 21 Jan 2016 15:55:39 +0100

On Thu, Jan 21, 2016 at 11:44:34PM +0900, Randy Bush wrote:
You can configure pmacct to specify on which properties of the received
flow data it should aggregate its output data, one could configure
pmacct to store data using the following primitives:

    ($timeperiod, $entrypoint_router_id, $bgp_nexthop, $packet_count)

Where $timeperiod is something like 5 minute ranges, and the post
processing software calculates the distance between the entrypoint
router and where the flow would leave the network ($bgp_nexthop).

See 'aggregate' on http://wiki.pmacct.net/OfficialConfigKeys

In short: you configure pmacct to throw away everything you don't need
(maybe after some light pre-processing), and hope that what remains is
small enough to fit in your cluster and at the same time offers enough
insight to answer the question you set out to resolve.

but could you explain in detail how this tests the hypothesis?

even of all your traffic entered on a bgp hop and exited on a bgp hop,
and all bgp entries set next_hop (which i think you do), you would be
ignoring the 'distance' the packet traveled from source to get to your
entry and traveled from your exit to get to the final destination.

Yes, correct. This is why I mentioned before: "However, this would be
just one network's (biased) view on things."

With this I meant that I can measure something, but only within a subset
of the entire path a packet might traverse. (just that one routing
domain), so not end-to-end. And what might be true for us might not be
true for others.


Current thread: