20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

1

IP Flow Information Accounting and Export Benchmarking Methodology

http://tools.ietf.org/id/draft-novak-bmwg-ipflow-meth-03.txt

Jan NovakCisco Systems

Presenting to BMWG @ IETF75

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

2

Document Goal

• Defines metrics to characterise Flow Monitoring performance based on:

- Architecture Model for IP Flow Information Export: RFC5740

• Defines conditions to perform Network Devices benchmarking in the presence of Flow Monitoring– IPv4 Benchmarking Methodology: RFC2544 – IPv6 Benchmarking Methodology: RFC5180

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

320/04/23 draft-novak-bmwg-ipflow-meth-03.txt

3

Feedback from IETF74

What is the Benchmark and how to measure it?

The Concept – DUT

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

4

Forwarding Plane

Flow Monitoring Plane

Flow Records

Flow Export

packets packet rate

Flow Record rate

Netflow IPFIX Others

20/04/23 draft-novak-bmwg-ipflow-meth-02.txt

5

Test Topology

+-----------+ | | | Collector | | | +-----------+ | | +----------+ +-------------+ +----------+ | | | | | | | sender |------->| |-------->| receiver | | | | DUT | | | | | | | | | | receiver |<-------| |<--------| sender | | | | | | | +----------+ +-------------+ +----------+

20/04/23 5draft-novak-bmwg-ipflow-meth-03.txt

What is the Benchmark

Flow Monitoring Plane:

How many Flow Records the DUT can handle per second without dropping any Flow information – Flow Monitoring Throughput

Data Forwarding Plane:

RFC2544 Throughput measured in the presence of Flow Monitoring

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

6

What is the Benchmark

Why two parameters ?

• Allows to express Flow Monitoring configuration and activity using one value while measuring RFC2544 metrics.

• Allows to measure maximum values but also to say: I expect such and such Flow Monitoring load, what is my RFC2544 metrics value ?

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

7

How to Measure

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

8

1. Configure DUT and traffic generator.2. Send test traffic.3. Capture Flow Export data and analyse for the

counts of Flow Records.4. Measure RFC2544 Throughput.

Setup – Cache Overflow

• Cache Size: 500 000 entries

Inactive and Active Timeout: 500 second• Packet size: 100 bytes

Increment destination IP address within 16.0.0.0/8• Flow Keys: Source and Dest IP, IP proto,

Source and Dest port• Packets sent 1 000 000• Flow Records created 1 000 000

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

9

Results – Cache Overflow

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

10

PPS Send Time Time to Fill Flow Loss Flow Exp Cache flows Rate

70 000 14 sec 7 sec 23000 7000066 000 15 sec 7.5 sec 1500 6600065 000 17 sec 8.5 sec 0 6500065 500 17 sec 8.5 sec 600 65500Measured Flow Monitoring Throughput 65000 Flow Records per second

Result – Cache Overflow• Flow Keys: IP source and destination address,

IP protocol, IP source and destination port

• Benchmark: Flow Monitoring Throughput

65 000 Flows per second

• Benchmark: RFC2544 Throughput:

65 000 pps (52 Mbit/s 100 byte packets)

20/04/23draft-novak-bmwg-ipflow-meth-

03.txt11

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

12

Result – Cache Overflow• Flow Keys: IP source and destination address, IP

protocol, IP source and destination port• Packet size 100 bytes• FR – Flow Record

Packets Flow Expiration RFC2544

per flow Rate Throughput

1 65 000 FR/s 65 000 pps

2 43 500 FR/s 87 000 pps

3 33 600 FR/s 101 000 pps

Result – Cache Overflow

• Flow Keys: destination IP address

• Benchmark: Flow Monitoring Throughput:

141 000 Flow Records per second

• Benchmark: RFC2544 Throughput:

113 Mbit/s (141 000 pps 100 bytes packets)

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

13

Results

• Flow Keys: Source IP address• Benchmark: Flow Monitoring Throughput

Not applicable (Flow Expiration Rate 0)

• Benchmark: RFC2544 Throughput:

144 Mbit/s (180 000 pps 100 bytes packets)

(toll to enable Flow Monitoring without any Flow activity)

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

14

Results

• No Flow Monitoring applied

• Benchmark: RFC2544 Throughput:

536 Mbit/s (670 000 pps 100 bytes packets)

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

15

Conclusion

• The effect of Flow Monitoring on RFC2544 metrics the DUT can achieve is a complex function of:

1. Traffic parameters.

2. The Flow Monitoring Cache configuration.

3. The Flow Keys configuration.

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

16

Conclusion• The unifying parameter which allows to abstract

from most of the contributors is the rate at which Flow Records expire from the Cache:

• Flow Monitoring Throughput

(Flow Records per Second)

• With remaining dependency on ONLY Flow Keys (RFC2544 Throughput needs rate + packet size)

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

17

???

20/04/23 draft-novak-bmwg-ipflow-meth-03.txt

18