Overview of Network Monitoring Activity in Norway Belgrade

Overview of Network Monitoring Activity in Norway Belgrade, October 21 2009 Vidar Faltinsen, UNINETT

Norway in a nutshell n n ~4. 5 mill inhabitants Scattered population Many mountains and fjords Shortest distance south to north: 1 752 km u u n Approx. 3 days by car If we rotate Norway upside down the North Cape reaches Macedonia! Coastline of 25 148 km u ~62% of the length of the equator 2

The UNINETT research network n n n Nationwide, high capacity (1 -10 Gbps), open and resilient network. IPv 6 and multicast enabled 15 + 5 year IRU agreement on dark fibre and wavelenghts More than 70 Po. P Established hybrid network infrastructure between the four major university cities. Operations in Trondheim n 40 universities and university collages > 200 institutions 250. 000 users n Equipment on NREN level: n n u n Juniper, Cisco, (HP) Equipment at campus level: u Cisco, HP, (Alcatel) 3

” We are convinced that most campuses do not take the task of measuring and understanding their traffic flows sufficiently seriously ” - SERENATE, December 2003 4

Legend n n All tools used by UNINETT are either made by ourself (in-house) or made elsewhere available as open-source The following icons are used in this presentation: u u n Open-source In-house: Note: UNINETT has a policy of making all in-house tools freely available as open-source 5

Tools used by UNINETT NOC 6

Zino – a status monitor n Monitors status of routers using trap-directed SNMP polling u u u n n Main focus on interface status (links) Also monitors BGP peer status (on IPv 4) Also monitors Juniper chassis and system alarms Embedded event handling system holding the administrative status of network failure events Implemented in Scotty (TCL/TK). Back-end monitor. Front-end either X or web-based 7

Weather maps Geographical 8 Logical (Zino)

Traffic statistics from Zino Including summary graphs 9 n n Summarizes traffic statistics for a group of physical interfaces (in the example all custumer connecions) Zino is used by NORDUnet, UNINETT, SUNET and FUNET

Weathermap in NAV using Open. Street. Map http: //metanav. uninett. no/ http: //www. openstreetmap. org/ Trondheim 10 Oslo

Availability reports & error reports 11

Measurement beacons 29 in operation, 12 more coming 12 n n n Verifies multicast connectivity Measures one way delay, loss and jitter Requires GPS time synchronization for optimal results (μsec level)

MPING n Round trip measurements 13 NDT n End-user speed test

Py. Metric n n Interactive routing simulation and visualization tool X-based, implemented in Python Config file defines your graph tree with link costs. Interactive command diplays prefered route 14

Py. Metric n n Simulates metric changes, router failures and link outages In the example osl-trd is taken down: u What happens to the route from ”elv” to ”mo”…? 15 n Link load: u u n Can also show link load Calculates and displays likely load redistribution when simulating link outages. Anycast u u Show anycast ”gravity” (which routers belong to which anycast node Simulate changes with link outages http: //software. uninett. no/pymetric/

The service monitor Hobbit 16 n n Agent on servers that reports on the ”local” status Monitors CPU load, disk usage, memory, processes running and whatever you script Servers are organized in groups. Alarms are showed on a per group basis. Drill down to details of when an alarm occured and reported reason http: //hobbitmon. sourceforge. net/

The performance monitor Munin 17 n n Performence monitoring for servers Has a focus on graphing system parameters. Complements Hobbit Uses RRD http: //munin. projects. linpro. no/

Tools deployed on campus 18

Giga. Campus tool boxes GC n n Managing 30 campus networks around Norway The tool boxes are servers containing a number of management tools: u NAV: Proactive network management u nfsen: Netflow traffic analysis u Stager: Netflow and Qflow u Hobbit: Service monitoring u tftp server, syslog server, radius server The tool boxes are placed on campus and used by the local IT staff. Management, tool enhancements, software upgrades, etc, is done by UNINETT. http: //metanav. uninett. no Stager http: //software. uninett. no/stager/ nfsen http: //nfsen. sourceforge. net/ Free training in tool usage is given. http: //hobbitmon. sourceforge. net/ 19

NAV – Network Administration Visualized n Network management system developed by NTNU and UNINETT since 1999. Key features n Inventory information with topology u u n n sms and email alarms Client machine tracking u n 20 Status monitor with alarm system u n topology autodetected L 3, L 2, per vlan based on ARP and bridge table data Client machine detention Statistics and graphing Get NAV preinstalled n Virtual appliance available http: //metanav. uninett. no/navappliance …or get the whole tool box preinstalled! http: //metanav. uninett. no

Stager n n Developed at UNINETT since 2002. Generic tool for storage, aggregation and presentation of network statistics u Netflow analysis u Round trip and packet loss u Generic SNMP data gathering u Qflow analysis Stores data in a postgre. SQL database High performance u Netflow database > 1 TB in size at UNINETT… 21 http: //software. uninett. no/stager/

Measurement beacons 29 in operation, 12 more coming 22 • Throughput • Packet delay and loss • Multicast connectivity • IPv 6 flows • Session intensity • Available capacity • Traffic behaviour

In Summary n n UNINETT will continously enhance our suite of NREN-focused tools We will continue to deliver campus tools to the universities around Norway on the: u u n tool box platform measuring beacon platform Our tools are open source. We are happy to promote usage and assist in getting code up and running outside the borders of Norway 23