Subject: RE: [ipfix-eval] Simon's and Ram's evaluations

From: "Reinaldo Penno" <[email-masked]>
Date: Tue, 22 Oct 2002 12:38:27 -0700

> -----Original Message-----
> From: Vamsidhar Valluri [mailto:[email-masked]]
> Sent: Tuesday, October 22, 2002 12:17 PM
> To: [email-masked]
> Cc: Juergen Quittek; [email-masked]
> Subject: Re: [ipfix-eval] Simon's and Ram's evaluations
> 
> 
> 
> 
> On Tue, 22 Oct 2002 [email-masked] wrote:
> 
> > Vamsidhar Valluri wrote:
> > >
> > > Jeurgen,
> > >   Please see inline
> > >
> > > On Tue, 22 Oct 2002, Juergen Quittek wrote:
> > >
> > > > Paul,
> > > >
> > > > -- [email-masked] wrote on 22 October 2002 
> 11:23 -0400:
> > > >
> > > > > Juergen Quittek wrote:
> > > > >>
> > > > >
> > > > > [snip]
> > > > >
> > > > >> Juergen's Conclusion
> > > > >>
> > > > >> My view is a bit bit biased, because it is the view 
> of one having to
> > > > >> implement the protocol on devices. Therefore, I give 
> more weight than
> > > > >> others might do to the cost of the implementation, 
> the consumption of
> > > > >> processing power and the memory consumption.
> > > > >>
> > > > >
> > > > >     Netflow V9 will need to me modified to allow 
> split reporting.
> > > > >     Many devices do not have the ability to store 
> attributes per flow
> > > > >     until expiration.
> > >
> > > At the high level, if the goal is to send periodic 
> updates of certain
> > > statistics related to flow then it can be done with 
> CURRENT Netflow by
> > > adjusting the "active timeout" value of flow entries. 
> Ofcourse we do send
> > > the key fields also with it unlike FUN/FAR messages. 
> Memory consumption on
> > > the device is specific to implemention ( i agree with 
> Carter) and if we
> > >  run out of memory for some reason there is always the 
> Overload Condition
> > > indication mentioned in the requirements.
> >
> > 	Call it implementation specific or whatever, but if I need
> > 	20 extra bytes per flow for a million flows, consuming
> > 	20mb of memory is going to be an issue. Not to mention the
> > 	memory and CPU time to maintain the list.
> 
> Paul, as pointed out by Juergen lifetime of many flows is small.

well, yes and no...If you look at new Internet traffic patterns (including a
recent paper by our Nevil - "Understanding Internet Traffic Streams:
Dragonflies and Tortoises"), long running flows are a big part of non-web
TCP flows. Although I consider University of Auckland an exception given
their pay per use model.

I did a recent study on a European ISP and the amount of P2P traffic (a.k.a
long running TCP flows) was just as much as normal web (in terms of flows
and much more in terms of bytes).

There are also some good stats from Dave Plonka in
http://wwwstats.net.wisc.edu/.

regards,

Reinaldo

> 
> -vamsi
> 
> >
> > 	Paul
> > >
> > > -vamsi
> > >
> >
> > [snip]
> >
> 
> 
> --
> Help        mailto:[email-masked] and say "help" 
> in message body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/
>

---

From: "Reinaldo Penno" <[email-masked]>
Date: Tue, 22 Oct 2002 12:51:45 -0700

-----Original Message-----
From: Penno, Reinaldo [BL60:0430:EXCH] 
Sent: Tuesday, October 22, 2002 12:38 PM
To: Vamsidhar Valluri; [email-masked]
Cc: Juergen Quittek; [email-masked]
Subject: RE: [ipfix-eval] Simon's and Ram's evaluations

> From: Vamsidhar Valluri [ mailto:[email-masked]
<mailto:[email-masked]> ] 

their pay per use model.  --->because they do not present this behavior as
much. 

There are also some good stats from Dave Plonka in
http://wwwstats.net.wisc.edu/ <http://wwwstats.net.wisc.edu/> . 

regards, 

Reinaldo 

> 
> -vamsi 
> 
> > 
> >     Paul 
> > > 
> > > -vamsi 
> > > 
> > 
> > [snip] 
> > 
> 
> 
> -- 
> Help        mailto:[email-masked]
<mailto:[email-masked]>  and say "help" 
> in message body 
> Unsubscribe mailto:[email-masked]
<mailto:[email-masked]>  and say 
> Archive     http://ipfix.doit.wisc.edu/archive/
<http://ipfix.doit.wisc.edu/archive/>