POSTECH DP&NM Lab

Network Monitoring
J. Won-Ki Hong Dept. of Computer Science and Engineering POSTECH Tel: 054-279-2244 Email: jwkhong@postech.ac.kr

POSTECH DP&NM Lab

Table of Contents
Introduction Monitored Types of Information Network Monitoring Configurations Network Monitoring Methods Performance Monitoring
Performance Indicators Performance Monitoring Functions

Fault Monitoring
Problems of Fault Monitoring Fault Monitoring Functions

Accounting Monitoring
2

POSTECH DP&NM Lab

Introduction
Network monitoring is concerned with observing and analyzing the status and behavior of the end systems, intermediate systems, and subnetworks that make up the network to be managed Issues in network monitoring
what to monitor?
define what is to be monitored

how to monitor?
how to obtain information from managed resources

what to do with the monitored information?

how the monitored information is used in various management functional areas

POSTECH DP&NM Lab

Monitored Types of Information

Static information
hardly changes current configuration information
e.g., the number and identification of ports on a router

Dynamic information
changes frequently information related to events in the network
e.g., change of state, transmission/reception of packets

Statistical information
derived from dynamic information
e.g., average number of packets transmitted per unit time
4

POSTECH DP&NM Lab

Organization of a Management Information Base

MANAGEMENT INFORMATION BASE (MIB) Statistical data base Call_Blocked Time_Delay Packet_Loss Throughput Abstraction of state and event variables Dynamic data base State_Variable Event_Variable Sensor activation and data collection Sensor data base Buffer Switch_server Source Server Station_Info Switch_Buffer Switch_Source Configuration data base Static data base Status_Sensor Derived_Status_Sensor Event_Sensor

POSTECH DP&NM Lab

Monitoring System Components

monitoring application
includes the functions of monitoring that are visible to the user
e.g., performance, fault, accounting

manager function
performs the basic monitoring function of retrieving information

agent function
gathers and records management information for one or more network elements and delivers the information to the monitor

managed objects
mgmt information that represents resources and their activities

monitoring agent
generates summaries and statistical analysis of mgmt information
6

POSTECH DP&NM Lab

Functional Architecture for Network Monitoring

Monitoring application Manager function Monitoring application Manager function Monitoring agent

Agent function Managed objects

Agent function Managed objects

...

Agent function Managed objects

(a) manager-agent model

(b) A model for summarization 7

POSTECH DP&NM Lab

Network Monitoring Configurations

Monitoring application Manager function Agent function Managed objects (a) Managed resources in manager system Monitoring application Manager function Monitoring application Manager function Monitoring application Manager function

Subnetwork or internet

Agent function Managed objects (b) Resources in agent system

Subnetwork or internet

Subnetwork or internet Agent function LAN observed traffic (c) External monitor

Agent function LAN

(d) proxy monitor agent 8

POSTECH DP&NM Lab

Network Monitoring Methods

Polling
a request-response interaction between a manager and agent a manager sends request to an agent which processes the request and responds with information from its MIB a manager may use polling to
learn about the configuration it is managing obtain periodically an update of conditions investigate an area in detail after being altered to a problem

Event Reporting
information flow is initiated from the agent to manager an agent may generate report periodically to give the manager its current status or whenever a significant event (e.g., change of a state) or an unusual event (e.g., fault) occurs good for detecting problems as soon as they occur
9

POSTECH DP&NM Lab

Performance Monitoring
Measuring the performance of the network (or performance monitoring) is absolutely required in NM
to detect & fix problems that cause performance degradation to better plan network upgrades

Problems in selecting and using appropriate indicators (or metrics)

too many indicators in use the meaning of most indicators are not yet clearly understood some indicators are supported by some manufacturers only frequently, the indicators are accurately measured but incorrectly interpreted by human or mgmt application the calculation of indicators takes too much time
10

POSTECH DP&NM Lab

Network Performance Indicators

Service-oriented
Availability: the percentage of time that a network system, a
component, or an application is available for a user

Response Time: how long it takes for a response to appear at

a users terminal after a user action calls for it

Accuracy: the percentage of time that no errors in the

transmission and delivery of information

Efficiency-oriented
Throughput: the rate at which application-oriented events (e.g.,
file transfers) occur

Utilization: the percentage of the theoretical capacity of a

resource (e.g., transmission line, switch, CPU) that is being used
11

POSTECH DP&NM Lab

Elements of Response Time

TO Workstation Network interface (e.g., router) SI Server

Network

SO WI TI RT = TI + WI + SI + CPU + WO + SO + TO WO CPU

RT = response time TI = inbound terminal delay WI = inbound queuing time SI = inbound service time

CPU = CPU process delay WO = outbound queuing time SO = outbound service time TO = outbound terminal delay
12

POSTECH DP&NM Lab

Performance Monitoring Functions

Performance Measurement
the actual gathering of statistics about network traffic & timing typically performed by agents within network devices e.g., amount of data in and out of a node, number of connections, traffic per connection

Performance Analysis
analyzing the gathered data and presenting it e.g., total, average, min, max, histogram

Synthetic Traffic Generation

generating artificial traffic load permits the network to be observed under a controlled load
13

POSTECH DP&NM Lab

Typical Performance-Related Questions

Performance measurements can be used to answer a number of questions
Why is the response so slow? (a very loaded question!) Why is the retransmission rate so high? Is traffic evenly distributed among network users or are there source-destination pairs with unusually heavy traffic? What is the percentage of each type of packet? What is the channel utilization and throughput? What is the effect of traffic load on utilization, throughput & time delays? When does traffic load start to degrade system performance? What is the maximum capacity of the channel under normal operating conditions? How many active users are necessary to reach this maximum?
14

POSTECH DP&NM Lab

Fault Monitoring
To detect faults as quickly as possible after they occur and to identify the cause of the fault so that correctional action may be taken Problems of Fault Monitoring
Fault Detection Problems
Unobservable faults: e.g., deadlock, device not monitorable Partially observable faults: insufficient to pinpoint the problem Uncertainty in observation: not clear what the problem is

Fault Isolation Problems

Multiple potential causes Too many related observations Interference between diagnosis and local recovery procedures Absence of automated testing tools
15

POSTECH DP&NM Lab

What happens when the T1 link fails?

802.5 802.3

Client

Router

Router

Server

MUX

T1

MUX

PBX

PBX

802.3

Heterogeneous Network Environment

16

POSTECH DP&NM Lab

Propagation of Failures to Higher Layers

Application failure

Transport failure

Client Server Data link failure Transmission Mux Mux break Router Router 17

POSTECH DP&NM Lab

Fault Monitoring Functions

Logging
record important events and errors logs should be accessible by managers (e.g., via polling)

Event Reporting
sending events, errors to managers sending alarms to manager to warn possible problems

Diagnostic Functions
connectivity test (e.g., traceroute) response-time test liveness test (e.g., ping) protocol integrity test loopback test
18

POSTECH DP&NM Lab

Accounting Monitoring
Keeping track of users usage of network resources
communication facilities computer hardware software and systems services

Usage may need to be broken down by account, by project, or by individual user for appropriate accounting purposes

19

POSTECH DP&NM Lab

Summary
Network monitoring is the most basic aspect of NM The purpose of network monitoring is to gather information about the status and behavior of network elements Information to be gathered include
static, dynamic and statistical information

Monitoring methods - polling & event reporting Monitoring functions

performance monitoring fault monitoring accounting monitoring

READ Chapter 2 of Textbook

20