Bandwidth Management and Monitoring for IP Network Traffic: An
Total Page：16
File Type：pdf, Size：1020Kb
Bandwidth Management and Monitoring for IP Network Traffic: An Investigation Barry Vivian William Irwin Submitted in fulfilment of the requirements for the Master of Science in the Department of Computer Science Rhodes University January 2001 Abstract Bandwidth management is a topic which is often discussed, but on which rela- tively little work has been done with regard to compiling a comprehensive set of techniques and methods for managing traffic on a network. What work has been done has concentrated on higher end networks, rather than the low bandwidth links which are commonly available in South Africa and other areas outside the United States. With more organisations increasingly making use of the Internet on a daily basis, the demand for bandwidth is outstripping the ability of providers to upgrade their infrastructure. This resource is therefore in need of management. In addition, for Internet access to become economically viable for widespread use by schools, NGOs and other academic institutions, the associated costs need to be controlled. Bandwidth management not only impacts on direct cost control, but encompasses the process of engineering a network and network resources in order to ensure the provision of as optimal a service as possible. Included in this is the provision of user education. Software has been developed for the implementation of traffic quotas, dynamic firewalling and visualisation. The research investigates various methods for monitoring and management of IP traffic with particular applicability to low bandwidth links. Several forms of visualisation for the analysis of historical and near-realtime traffic data are also discussed, including the use of three-dimensional landscapes. A number of band- width management practices are proposed, and the advantages of their combina- tion, and complementary use are highlighted. By implementing these suggested policies, a holistic approach can be taken to the issue of bandwidth management on Internet links. Preface The writer would like to acknowledge the help and assistance given by a number of individuals during the course of this research. My first thanks are to my supervi- sor, Mr George Wells for his input and for allowing me to follow my own ideas. I also wish to thank three fellow students for their contribution to this work; David Siebörger and Fred Fourie for their assistance in the development of the three- dimensional visualisation tools, in particular the animation sequences, and Guy Halse and David Siebörger for intellectual debate and discussions relating to the topic under study, often in the small hours. My appreciation also goes to Kevan Watkins and ‘Jaco’ Jacot-Guillarmod of the Rhodes University Information Tech- nology Division for their willingness to facilitate my data collection and testing. My appreciation also goes to the the Department of Computer Science at Rhodes University for the facilities and equipment without which this research would not have been possible. Finally, a very special thanks is expressed to my parents, for their support of this research, particularly for their critical discussion of the style and for proofreading. i Contents Preface i Table of Contents ii List of Figures vii List of Tables ix 1 Introduction 1 1.1 Aims . 2 1.2 Document Layout . 2 2 TCP Evolution and performance evaluation 4 2.1 Standards Process . 5 2.2 TCP Evolution . 6 2.2.1 Early developments . 6 2.2.2 TCP for Transactions (T/TCP) . 13 2.2.3 Selective Acknowledgement . 14 2.3 The Integration of Quality of Service . 14 2.4 Packet Sizing . 16 2.5 Future Development . 17 2.6 Summation . 18 ii CONTENTS iii 3 Monitoring and Visualisation 20 3.1 Monitoring . 20 3.1.1 Active monitoring . 21 3.1.2 Case Study 1: Bandwidth Probe . 21 3.1.3 Passive monitoring . 24 3.1.4 Case Study 2: Internet Traffic Monitor . 24 3.1.5 Suitability of monitoring . 27 3.1.6 Passive Monitoring Tools . 28 3.1.6.1 Tcpdump . 28 3.1.6.2 IP Flow meter (ipfm) . 29 3.1.6.3 Trafshow . 30 3.1.6.4 NTOP . 30 3.1.6.5 SNMP . 31 3.1.7 Sniffer Placement . 31 3.1.8 Active Tools . 33 3.1.8.1 Ping . 33 3.1.8.2 Bing . 33 3.1.8.3 Tcpblast . 35 3.1.8.4 Netperf . 35 3.2 Data Storage . 35 3.3 Visualisation . 37 3.3.1 The need for visualisation . 37 3.3.2 Visualisation types . 39 3.3.2.1 Simple Graphing . 39 3.3.2.2 Layered Graphs . 41 CONTENTS iv 3.3.2.3 Colour Maps . 44 3.3.2.4 Three-Dimensional Landscapes . 47 3.4 Other Interpretation Methods . 54 3.5 Summation . 54 4 Bandwidth Management Strategies 56 4.1 The ying-yang of bandwidth management . 57 4.2 Traffic Accounting Strategies . 59 4.2.1 Sub-Network Accounting . 59 4.2.2 Host Accounting . 59 4.2.3 User Accounting . 60 4.3 Quota Systems . 61 4.3.1 Running Quota Systems . 62 4.3.1.1 Calculation . 64 4.3.1.2 Quota Renewal . 64 4.3.2 Case Study 3: RUCUS Proxy Web and FTP Quotas . 68 4.3.3 Case Study 4: Quota based shaping on Cisco Routers . 71 4.4 Traffic Shaping . 76 4.4.1 Application Level . 78 4.4.2 IP Level . 79 4.4.2.1 DummyNet . 79 4.4.3 Case Study 5: Implementation of traffic shaping in the Squid Caching Web Proxy . 80 4.4.4 Case Study 6: Dummynet as a bandwidth management tool . 83 4.4.5 Hybrid Systems . 86 CONTENTS v 4.5 Traffic queues and Quality of Service . 87 4.5.1 Quality of Service . 89 4.5.1.1 First In First Out (FIFO) . 90 4.5.1.2 Priority Queueing (PQ) . 90 4.5.1.3 Fair Queueing (FQ) . 90 4.5.1.4 Stochastic Fairness Queueing (SFQ) . 91 4.5.1.5 Token Bucket Filter (TBF) . 91 4.5.1.6 Custom Queueing (CQ) . 91 4.5.1.7 Weighted Fair Queueing (WFQ) . 92 4.5.1.8 RSVP . 92 4.5.2 Congestion Avoidance . 93 4.5.2.1 Random Early Detection (RED) . 93 4.5.2.2 Gentle Random Early Detection (GRED) . 94 4.5.2.3 Weighted Random Early Detection (WRED) . 94 4.5.3 Type Of Service and Differentiated Service bits . 94 4.6 Active Content Control . 95 4.6.1 Case Study 7: ‘Ad-banner’ filtering and content filtering as a means of bandwidth saving. 96 4.7 Limitation of Services . 102 4.7.1 Implementing dynamic filtering as a means of traffic man- agement . 103 4.7.2 Case Study 8: A dynamic firewalling mechanism . 105 4.8 Threshold management . 109 4.9 Caching Proxy Servers . 110 4.10 Compression . 114 4.11 Network Address Translation . 116 CONTENTS vi 4.12 Satellite Connections . 117 4.13 User Education . 117 4.14 Summation . 119 5 Conclusion 120 Glossary 125 References 130 Appendicies 147 A Example Configurations 147 A.1 Squid . 147 A.1.1 Example User and host lists . 155 A.1.2 Content Type Blocklists . 156 A.1.3 Example proxy.pac . 157 A.2 IPFW Example . 158 A.2.1 Traffic Shaping . 158 A.2.2 Traffic Accounting . 159 A.3 Cisco Router Configuration . 162 A.3.1 Traffic Accounting . 163 A.3.2 Delay Configuration . 164 B An analysis of IP traffic on the Rhodes University network 167 B.1 TCP Traffic . 168 B.1.1 Source Ports . 168 B.1.2 Destination Ports . 168 CONTENTS vii B.2 UDP Traffic . 171 B.2.1 Source Ports . 171 B.2.2 Destination Ports . 172 B.3 ICMP . 172 B.4 Ranges of port usage . 174 B.5 Type of Service Field . 174 C Visualisation Tools and Techniques 175 C.1 Simple Graphing . 175 C.2 Layered Graphs . 175 C.3 Colour Maps . 176 C.4 Three-Dimensional Landscapes . 177 D Software Developed 179 D.1 Squid Quota Management . 179 D.2 Dynamic firewalling . 180 E CD-ROM Contents 181 List of Figures 2.1 The 4.3BSD Tahoe slow start algorithm . 8 3.1 Route between rucus.ru.ac.za and linux.moria.org . 22 3.2 Example output from the Bandwidth Probe . 23 3.3 Rhodes Internet link utilisation . 25 3.4 Logical layout of the traffic monitoring system . 25 3.5 Example output from monitor system . 26 3.6 Example tcpdump output illustrating decoding of four packets . 29 3.7 Example trafshow output of network traffic . 30 3.8 Placement options for a sniffer on a network . 32 3.9 Data Storage Methods vs Space Requirements . 38 3.10 Example MRTG and RRDTool Output . 40 3.11 Layered graphs . 43 3.12 Example Colour Maps . 46 3.13 Contour map . ..