<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
I remember pmacct! Thanks Scot.
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 9 Jun 2015, at 9:21 am, Scott O'Brien <<a href="mailto:scott@scottyob.com" class="">scott@scottyob.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">I believe some in the Juniper world are using SCU/DCU for billing purposes <a href="https://www.juniper.net/documentation/en_US/junos14.2/topics/usage-guidelines/interfaces-enabling-source-class-and-destination-class-usage.html" class="">https://www.juniper.net/documentation/en_US/junos14.2/topics/usage-guidelines/interfaces-enabling-source-class-and-destination-class-usage.html</a>.
Not sure what similar tech exists on other platforms though??</div>
<div class=""><br class="">
</div>
<div class="">I know I’ve mentioned this on the list before, but whenever collecting flow data (NetFlow, sFlow, IPFIX) I think it’s really worth checking out the pmacct project <a href="http://www.pmacct.net/" class="">http://www.pmacct.net</a>. This has a
BGP daemon built in so if you’re collecting flow data from a source that doesn’t have a BGP view of the world you’re after, or doesn’t support it, you can modify the data to include BGP from wherever. I’ve used Pmacct before for generating stats based on
BGP communities where netflow was collected from a router inside the campus (with only a default route) and BGP community stats were taken from a border router with more useful communities.</div>
<div class=""><br class="">
</div>
<div class="">Hope that’s another option!</div>
<div class="">~ Scott</div>
<div class=""><br class="">
</div>
<br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On 9 Jun 2015, at 10:36 am, David Lambert <<a href="mailto:sobmalss@gmail.com" class="">sobmalss@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">Just to add to this.. Not all Netflow/Jflow/IPFIX is 1:1, some routers only support sampled Netflow, this is performed on hardware forwarding platforms that never used flow based forwarding and thus do not keep flow tables. To get around
this they mirror traffic to the control plane for processing or if scale is required then its dedicated CPU to process mirrored traffic into Netflow data; this can get expensive.
<div class="">
<div class=""><br class="">
</div>
<div class="">Service providers have been using sampled netflow on hardware routers for many years for effective (well.. effective enough to do what they want with it) analysis of traffic.</div>
<div class=""><br class="">
</div>
<div class="">Using Netflow for billing can (and has been for some) become a scaling liability.</div>
<div class=""><br class="">
</div>
<div class="">Openflow based billing app anyone?</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">dave</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div class="gmail_extra">
<div class="gmail_quote">On Tue, Jun 9, 2015 at 9:50 AM, Russell Brenner <span dir="ltr" class="">
<<a href="mailto:rbrenner@brocade.com" target="_blank" class="">rbrenner@brocade.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word" class="">Hi Paul,
<div class=""><br class="">
</div>
<div class="">I don’t want to launch into a religious argument since I’m not a network operator myself, but most (all?) of our customers and my personal colleagues in the business are quite happy with sFlow billing and security (unless they’re harbouring resentment
and haven’t told me :)). </div>
<div class=""><br class="">
</div>
<div class="">
<div class="">Sflow is accurate for security purposes because it is simple enough to be performed in hardware. The sFlow is designed so that the accuracy of any measurement can be determined. Netflow tends to drop under heavy load, unless I’m mistaken.</div>
</div>
<div class=""><br class="">
</div>
<div class="">So, on to the billing bit. </div>
<div class=""><br class="">
</div>
<div class="">You don’t need to sample every single packet to get meaningful billing data, there’s not a great deal of benefit in doing so since the extra few percentage points don’t equate to serious gains, but quite large performance penalty (depending on
the platform and media speed).</div>
<div class=""><br class="">
</div>
<div class="">With sFlow you optimise the sample rate in order to meet the desired level of accuracy and this is done by varying the number of samples collected. </div>
<div class=""><br class="">
</div>
<div class="">The accuracy is a function of the number of samples collected and the duration of the monitoring period. </div>
<div class=""><br class="">
</div>
<div class="">Further improvements in accuracy can be made by calculating the “confidence level” which is the width of the error window. In order to ensure that customers are not overcharged then the data point at the lower end of the confidence level should
be used and this is a direct function of the number of samples collected and this can be calculated thus:<br class="">
<br class="">
Percentage Error ≤ 196 x √(1/c) where c is the number of samples.<br class="">
<br class="">
For example, if the number of samples is 10,000 then the error will be approximately ±2% so the amount charged for should be 98% of the total number of packets counted.</div>
<div class=""><br class="">
</div>
<div class="">It is important to note that the accuracy of measurement does not depend on the total number of frames, but simply on the number of samples used to make the measurement. As the speed of the interface increases, the percentage of the total number
of frames sampled can be reduced. </div>
<div class=""><br class="">
</div>
<div class="">This is reflected in the default sampling rates we use on our devices (512/1024/2048 and 8192 for 100M/1G/10G/100G). Furthermore, accuracy can be improved by simply increasing the duration of the sample period until the required number of samples
has been collected.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">The sampling rate is the average ratio of the number of packets incoming on an sFlow-enabled port, to the number of flow samples taken from those packets. The sampling rate is a fraction in the form 1/N, meaning that, on average, one out of every
N packets will be sampled.</div>
<br class="">
Because the accuracy of the sFlow measurement is dependent only on the number of samples then increasing the accuracy is fairly simple simple, and any errors will be negligible.</div>
<div class=""><br class="">
<div class="">
<div class=""><font face="Helvetica" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">Russell
Brenner</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">Systems
Engineer</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">Brocade</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">Suite
524, 1 Queens Road, </span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">Melbourne</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">M. </span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class=""><a href="tel:%2B61.412.869.959" value="+61412869959" target="_blank" class="">+61.412.869.959</a></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class=""><a href="http://www.brocade.com/" target="_blank" class="">www.brocade.com</a></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class=""><span class=""><span class=""><span class=""><span class=""><span class=""></span></span></span></span></span></span></font></div>
<font face="Helvetica" class=""></font><br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On 9 Jun 2015, at 9:21 am, Paul Koch <<a href="mailto:paul.koch137@gmail.com" target="_blank" class="">paul.koch137@gmail.com</a>> wrote:</div>
<br class="">
<div class="">On Fri, 5 Jun 2015 12:07:42 +1000<br class="">
Ivan Jukic <<a href="mailto:ijukic13@gmail.com" target="_blank" class="">ijukic13@gmail.com</a>> wrote:<br class="">
<br class="">
<blockquote type="cite" class="">Netflow or the currant "standard" is now called IPFIX. This is certainly<br class="">
support by Cisco as well as many other vendor.<br class="">
<br class="">
In relation to sflow not being a useful technology. I disagree. They<br class="">
essential both do the same, analyse traffic flows. However, sflow does so<br class="">
by packet sampling, 1 packet out of X sent to the collector. Where as<br class="">
IPFIX/Netflow send every packet to the collector. They both very useful,<br class="">
however there is a lot of design considering when rolling them out.<br class="">
<br class="">
Cheers,<br class="">
Ivan<br class="">
</blockquote>
<br class="">
<br class="">
sFlow is not useful. It typically uses a 1 in N sample, where N is a<br class="">
"very big number". Once you go over N=5 or N=10, it becomes statistically<br class="">
useless... or actually misleading and deceptive. Ask any statistician<br class="">
and they laugh at the 1 in 1000 sample.<br class="">
<br class="">
I even watch a presentation from one of the <a href="http://sflow.org/" target="_blank" class="">
sFlow.org</a> guys who reckon<br class="">
that N 1,000,000 sample was even useful. Not sure what planet...<br class="">
<br class="">
For security guys, a N=1 is pretty much mandatory.<br class="">
<br class="">
sFlow should have been called something different as it just causes <br class="">
confusion. A lot of people seem to think it is 'switch flow' and are<br class="">
surprised when you explain that its just packet sampling at N=1k or N=16k<br class="">
packets. Switches will never do a N=1 sample because the cost of the<br class="">
hardware would be prohibitive.<br class="">
<br class="">
Plixer have some interesting blogs on Netflow vs sFlow.<br class="">
<br class="">
<span style="white-space:pre-wrap" class=""></span>Paul.<span class="HOEnZb"><font color="#888888" class=""><br class="">
-- <br class="">
Paul Koch | Founder, CEO<br class="">
AKIPS Network Monitor | <a href="http://akips.com/" target="_blank" class="">akips.com</a><br class="">
Brisbane, Australia<br class="">
Cell: <a href="tel:%2B61%20%280%29458%20803%20740" value="+61458803740" target="_blank" class="">
+61 (0)458 803 740</a><br class="">
_______________________________________________<br class="">
AusNOG mailing list<br class="">
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank" class="">AusNOG@lists.ausnog.net</a><br class="">
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank" class="">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br class="">
</font></span></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
<br class="">
_______________________________________________<br class="">
AusNOG mailing list<br class="">
<a href="mailto:AusNOG@lists.ausnog.net" class="">AusNOG@lists.ausnog.net</a><br class="">
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank" class="">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br class="">
<br class="">
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br class="">
AusNOG mailing list<br class="">
<a href="mailto:AusNOG@lists.ausnog.net" class="">AusNOG@lists.ausnog.net</a><br class="">
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" class="">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>