From owner-Big-Internet@munnari.OZ.AU Wed Jan 17 00:20:11 1996 From: Sean Doran Subject: another flow snapshot Message-Id: <96Jan15.222447-0000_est.20608+224@chops.icp.net> Date: Mon, 15 Jan 1996 22:24:46 -0000 This is from a fairly small-traffic router (sl-kc-2.sprintlink.net), but it is running some newer code that keeps statistics somewhat more accurately and less CPU-intensively. We are working on some various other ways of eking very general information out of flows passing through our 7513s. At the same time we are looking at a newer switching method, and trying to do our regular jobs, so doing more than just occasional snapshots on various routers is not going to happen in the very short run. Sean. - -- IP Flow Switching Cache, 29999 active, 2769 inactive, 58411388 added 1418487 lru, 22352334 timeout, 20923593 tcp fin, 2633568 invalidates 5253815 dns, 5799592 resent syn, 0 counter wrap statistics cleared 141949 seconds ago Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow TCP-Telnet 267034 1.8 233 75 439.3 182.6 36.5 TCP-FTP 1030837 7.2 10 78 76.6 22.6 43.7 TCP-FTPD 554967 3.9 164 345 641.3 52.7 15.7 TCP-WWW 32107858 226.2 15 247 3610.6 13.5 28.1 TCP-SMTP 3526231 24.8 13 159 323.1 10.2 23.6 TCP-X 9600 0.0 121 129 8.2 148.2 55.1 TCP-BGP 111096 0.7 14 77 11.5 229.2 61.1 TCP-other 5729172 40.3 70 220 2858.1 71.0 41.3 UDP-TFTP 2398 0.0 3 62 0.0 13.4 69.5 UDP-DNS 12875077 90.7 2 110 195.4 5.4 43.6 UDP-other 1489072 10.4 30 293 321.8 28.5 68.7 ICMP 665771 4.6 13 259 62.8 75.5 66.8 IGMP 5144 0.0 18 278 0.6 82.4 64.3 IPINIP 4450 0.0 933 377 29.2 166.7 61.0 IP-other 2693 0.0 11 136 0.2 80.8 65.7 Total: 58381400 411.3 20 227 8579.4 0.0 0.0 From owner-Big-Internet@munnari.OZ.AU Wed Jan 17 00:20:11 1996 Date: Mon, 15 Jan 1996 22:51:06 -0800 (PST) From: Simon Spero Subject: Re: another flow snapshot Message-Id: The bytes per packet in this count looks a bit low (I used FTP-data as a reference, as that should have full packets for all but the last). Does this average include the ack packets and IP and IP/TCP headers? (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n)))) From owner-Big-Internet@munnari.OZ.AU Wed Jan 17 00:20:11 1996 Date: Tue, 16 Jan 1996 10:04:21 +0100 Message-Id: From: huitema@pax.inria.fr (Christian Huitema) Subject: Re: another flow snapshot Sean, Thank you very much for publishing these snapshots, a very useful piece of information. One question, though. Several loony academics (i.e. me and others) may want to quote them in research papers, e.g. for calibrating their studies. What would be the proper attribution ? If I described them as "data measured by Sean Doran in January 1996 on a typical router of Sprint's Internet," would you object ? Christian Huitema From owner-Big-Internet@munnari.OZ.AU Wed Jan 17 00:20:11 1996 Date: Tue, 16 Jan 1996 01:49:53 -0800 From: Tony Li Message-Id: <199601160949.BAA13661@greatdane.cisco.com> Subject: Re: another flow snapshot Thank you very much for publishing these snapshots, a very useful piece of information. One question, though. Several loony academics (i.e. me and others) may want to quote them in research papers, e.g. for calibrating their studies. What would be the proper attribution ? If I described them as "data measured by Sean Doran in January 1996 on a typical router of Sprint's Internet," would you object ? While many people are quite certain that Sean and Sprint would like total control of the Internet, I'm not quite willing to concede that fact. Yet. ;-) ;-) ;-) Tony From owner-Big-Internet@munnari.OZ.AU Thu Jan 18 00:20:11 1996 From: Sean Doran Subject: Re: another flow snapshot Message-Id: <96Jan16.120424-0000_est.20608+2@chops.icp.net> Date: Tue, 16 Jan 1996 12:04:14 -0000 >>>>> "Simon" == Simon Spero writes: Simon> The bytes per packet in this count looks a bit Simon> low (I used FTP-data as a reference, as that Simon> should have full packets for all but the Simon> last). Does this average include the ack Simon> packets and IP and IP/TCP headers? I shall have to make enquiries. The averaging scheme is somewhat unusual... :) The other thing is that the stats were only over a little more than a day, and were accumulated on a very lightly loaded router (in comparison to our other boxes), and so apparent oddities are mostly unsurprising. Sean. From owner-Big-Internet@munnari.OZ.AU Thu Jan 18 00:20:11 1996 From: Sean Doran Subject: Re: another flow snapshot Message-Id: <96Jan16.121225-0000_est.20608+3@chops.icp.net> Date: Tue, 16 Jan 1996 12:12:19 -0000 >>>>> "Christian" == Christian Huitema writes: Christian> What would be the proper attribution ? If Christian> I described them as "data measured by Sean Christian> Doran in January 1996 on a typical router Christian> of Sprint's Internet," would you object ? I'm glad learn that the occasional toying around with statistics I've been trying to do in my spare moments could be useful for things other than satisfying my curiosity. :) Anyway, yes, this is OK, although sl-kc-2 is an atypically underloaded backbone router. All our typical backbone routers are extraordinarily busy 7000s with SSPs, and unfortunately cannot accumulate these kinds of statistics. It will be interesting to see how things go as the 7513s like sl-kc-2 become more heavily loaded, and it will also be interesting to see how long we keep flow switching rather than progressing on to Dr Li's longer-term switching scheme(s). Sean. From owner-Big-Internet@munnari.OZ.AU Thu Jan 18 00:20:11 1996 Date: Tue, 16 Jan 1996 18:44:35 -0500 From: Vadim Antonov Message-Id: <199601162344.SAA24715@titan.sprintlink.net> Subject: Re: another flow snapshot Christian, SL-KC-2 is not a "typical router". It was recently installed and its load is, er, close to none. The load on real busy routers (SL-DC-8?) is far far more than that, but those are 7000s, not 7500s, so flows cannot be realistically measured. --vadim >From owner-Big-Internet@munnari.OZ.AU Tue Jan 16 04:34:44 1996 Received: from tiny.sprintlink.net (tiny.sprintlink.net [199.0.55.90]) by titan.sprintlink.net (8.6.9/8.6.9) with ESMTP id EAA24104 for ; Tue, 16 Jan 1996 04:34:43 -0500 Received: from murtoa.cs.mu.OZ.AU (murtoa.cs.mu.OZ.AU [128.250.22.5]) by tiny.sprintlink.net (8.6.9/8.6.9) with ESMTP id EAA23866; Tue, 16 Jan 1996 04:34:37 -0500 Received: from mailing-list by murtoa.cs.mu.OZ.AU (8.6.9/1.0) id UAA19322; Tue, 16 Jan 1996 20:16:12 +1100 Received: from munnari.oz.au by murtoa.cs.mu.OZ.AU (8.6.9/1.0) with SMTP id UAA19301; Tue, 16 Jan 1996 20:07:13 +1100 Received: from pax.inria.fr by munnari.oz.au with SMTP (5.83--+1.3.1+0.55) id JA22234; Tue, 16 Jan 1996 20:07:08 +1100 (from huitema@pax.inria.fr) Received: from [138.96.24.178] by pax.inria.fr (8.6.12/8.6.12) with SMTP id KAA27831; Tue, 16 Jan 1996 10:04:21 +0100 Date: Tue, 16 Jan 1996 10:04:21 +0100 Date: Tue, 16 Jan 1996 10:04:21 +0100 Message-Id: Message-Id: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" To: Sean Doran From: huitema@pax.inria.fr (Christian Huitema) From: huitema@pax.inria.fr (Christian Huitema) Subject: Re: another flow snapshot Subject: Re: another flow snapshot Cc: big-internet@munnari.OZ.AU Precedence: bulk Status: R Sean, Thank you very much for publishing these snapshots, a very useful piece of information. One question, though. Several loony academics (i.e. me and others) may want to quote them in research papers, e.g. for calibrating their studies. What would be the proper attribution ? If I described them as "data measured by Sean Doran in January 1996 on a typical router of Sprint's Internet," would you object ? Christian Huitema From owner-Big-Internet@munnari.OZ.AU Thu Jan 18 00:20:11 1996 From: kc@upeksa.sdsc.edu (k claffy) Message-Id: <199601171013.CAA10361@upeksa.sdsc.edu> Subject: Re: another flow snapshot Date: Wed, 17 Jan 1996 02:13:11 -0800 (PST) Christian: you can also cite the FIX-west stats on http://www.nlanr.net/NA/FIX/Stats/West/index.html which reflects 5 minute snapshots taken at fix-west every hour (http://www.nlanr.net/NA/ points to background and has a link to the FIXwest stuff, and same for a supercomputer center site -- ) (collection uses an alpha; we'd like to try the 7513 there, but we don't seem to have a spare cisco...) don't think i know any other publically available data point for Internet statistics anymore. :( fwiw, k Sean, Thank you very much for publishing these snapshots, a very useful piece of information. One question, though. Several loony academics (i.e. me and others) may want to quote them in research papers, e.g. for calibrating their studies. What would be the proper attribution ? If I described them as "data measured by Sean Doran in January 1996 on a typical router of Sprint's Internet," would you object ? Christian Huitema From owner-Big-Internet@munnari.OZ.AU Fri Jan 19 00:20:08 1996 From: hwb@upeksa.sdsc.edu (Hans-Werner Braun) Message-Id: <199601171625.IAA13487@upeksa.sdsc.edu> Subject: Re: another flow snapshot (fwd) Date: Wed, 17 Jan 96 8:25:34 PST >Christian: > >you can also cite the FIX-west stats >on > http://www.nlanr.net/NA/FIX/Stats/West/index.html Or start with http://www.nlanr.net/NA. The work we have done there on the flows stuff for years (and published papers and kc's dissertation and so) had actually influenced Cisco in their development. The only thing new I have seen from Sean is that it is from Sprintlink routers. E.g., read IEEE JSAC Vol 13 #8 pp 1481. Or http://www.nlanr.net/Papers/ for versions of miscellaneous papers. >which reflects 5 minute snapshots >taken at fix-west every hour >(http://www.nlanr.net/NA/ points to background >and has a link to the FIXwest stuff, >and same for a supercomputer center site -- ) > >(collection uses an alpha; we'd like to try >the 7513 there, but we don't seem to have a >spare cisco...) > >don't think i know any other publically >available data point for Internet statistics >anymore. :( > >fwiw, >k > > > > Sean, > > Thank you very much for publishing these snapshots, a very useful piece of > information. One question, though. Several loony academics (i.e. me and > others) may want to quote them in research papers, e.g. for calibrating > their studies. What would be the proper attribution ? If I described them > as "data measured by Sean Doran in January 1996 on a typical router of > Sprint's Internet," would you object ? > > Christian Huitema From owner-Big-Internet@munnari.OZ.AU Fri Jan 19 00:20:08 1996 Date: Wed, 17 Jan 96 11:23:45 CST From: amolitor@anubis.network.com (Andrew Molitor) Message-Id: <9601171723.AA02087@anubis.network.com> Subject: Re: another flow snapshot (fwd) Would it be possible for someone to interpret these tables for the dummy (or, to be optimistic, dummies) among us? I get most of it, but there's some fuzzy bits too. The tables of routing cache activity posted a while back were a little mysterious too, but I was too chicken to ask. This is not to suggest that I don't appreciate such information, it's obviously a great kindness to take these snapshots and make them available. Andrew From owner-Big-Internet@munnari.OZ.AU Fri Jan 19 00:20:08 1996 From: bmanning@ISI.EDU (Bill Manning) Message-Id: <199601180316.AA17509@zephyr.isi.edu> Subject: Re: another flow snapshot Date: Wed, 17 Jan 1996 19:16:38 -0800 (PST) > > don't think i know any other publically > available data point for Internet statistics > anymore. :( > > fwiw, > k You might want to take apeek at http://info.ra.net/div7/ra/stats.html -- --bill