TAAD - A Tool for Traffic Analysis and Automatic Diagnosis

1
TAAD - A Tool for Traffic Analysis and Automatic
Diagnosis

• Kathy L. Benninger
• benninger_at_psc.edu
• NLANR/Pittsburgh Supercomputing Center

2
Outline

• Context for development of TAAD
• Characteristics of the tool
• Performance model
• Output description and interpretation
• OCXmon
• Practical considerations

3
Context

• TAAD is being developed by the NLANR network
  research group based at the Pittsburgh
  Supercomputing Center
• NCNE Pittsburgh GigaPoP based at PSC
• Coexistence of NLANR group and the NCNE
  Pittsburgh GigaPoP provides ample opportunity for
  development and test.

4
Context (contd)

• Need for tool to support NLANR/PSCs TCP
  Trace-based Performance Diagnosis Flowchart
• Analysis of heavily aggregated traffic
• Automatic problem detection and partial diagnosis
• Availability of OCXmon data collection

5
Tool Characteristics

• Searches aggregate traffic for miss-tuned
  microflows
• Tool for GigaPoP operators
• Examines traffic from GigaPoP viewpoint, but
  detects end-system problems

6
Tool Characteristics (contd)

• Uses model developed in The Macroscopic Behavior
  of the TCP Congestion Avoidance Algorithm
  Mathis, Semke, Mahdavi, Ott, CCR July 1996
• Compares actual TCP performance to performance
  predicted by the Model

7
Tool Characteristics (contd)

• Diagnosis of bulk flows
• Does not pinpoint why performance is poor
• Evolving...

8
Macroscopic Performance Model

• Rate Estimated data rate (bytes/second)
• MSS Maximum Segment Size (bytes)
• RTT Round Trip Time (seconds)
• p Segment loss rate (probability)
• C Proportionality constant (typically 0.7)

9
TAAD Calculation

10
Model used by TAAD

• GainRatio Indicates potential performance
  improvement
• p Analogous to loss rate, but derived from
  number of packets successfully delivered between
  recovery events
• MeasuredRate Data rate (bytes/second)
• RTT Round Trip Time (seconds)
• MSS Maximum Segment Size (bytes)

11
TAAD Output Fields

• Source addresses and ports
• Destination addresses and ports
• Start time and duration of flow
• Counts of packets and bytes
• GainRatio and OpportunitySize

12
TAAD Output Interpretation

• If GainRatio
• is 1, flow performance is close to Model
• is gt 1, indicates a non-IP bottleneck
• is gtgt 1, invites tuning to improve performance
• is lt 1 means cheating!

13
TAAD Output Interpretation (contd)

• OpportunitySize is GainRatio scaled by number of
  packets
• Indicates how much data could have been
  transmitted in the same amount of time on a
  properly tuned connection
• Output flows are sorted by OpportunitySize
• Flows with largest OpportunitySize offer largest
  payoff with tuning

14
Sample Output
15
OC3mon

• Available though development efforts of
• NLANR/MOAT project at SDSC
• MCIs OCXmon activity
• CAIDAs CoralReef software suite
• Passive network monitoring tool

16
OC3mon (contd)

• Data format
• Trace files collected in Coral .crl format
• Analysis output of TAAD is ASCII
• Collects packet headers
• Does not collect payload

17
Operation

• Five minute trace on one or two interfaces
• New trace capture begins while previous five
  minutes of data is analyzed
• Data volume (per interface, mid-day)
• Capture .crl file 40MB/minute
• Analysis output filesize 25K/minute

18
Operational Issues

• Data Policy
• Amount of data
• Security and privacy
• Legal liability
• Run time
• ATM card(s) devoted to continuous capture
• Recommend dedicated machine

19
Resource requirement

• Currently running on one Intel 450MHz CPU
• CPU 2 load during trace capture
• CPU 75-80 load during analysis (and continued
  trace)
• wall-clock time for analysis is lt 1 minute for a
  5 minute trace capture (200MB trace file)
• 6GB disk sufficient for summary data

20
Future

• Verification and release
• Adaptation for use with other trace tools
• Additional tools to create a TAAD toolset

21
Conclusion

• TAAD is intended to help meet the need for a tool
  to automate the analysis and diagnosis of
  aggregated bulk flows.
• The analysis and diagnosis is based on comparing
  modeled and actual performance
• Output is intended to be a pointer for where to
  direct tuning efforts for maximum benefit

22
References

• Macroscopic paper
• http//www.psc.edu/networking/papers/model_ccr97.p
  s
• TCP Tuning
• http//www.ncne.nlanr.net/TCP/
• TAAD
• http//www.ncne.nlanr.net/TCP/TAAD
• CoralReef
• http//www.caida.org/Tools/CoralReef/