Network design

1. Network design Topic 3 Analysing network traffic

2. Agenda • Traffic flows • Traffic load • Traffic behaviour • Quality of Service (QoS)

3. User communities and data stores • A user community is a set of workers who use a particular application or set of applications • May be located within a department • May be a virtual team that crosses department boundaries • Survey users to identify which applications they use and where the user is located • Document user community name, number of users, location and applications used • Locate data stores • Server, server farm, SAN, mainframe, tape back-up, digital video library • Document the data store name, the location, the application that uses the data store and the user community that uses the application

4. Traffic flows • An individual traffic flow is protocol and application information transmitted between hosts during a single session • Attributes include: • Direction • both directions or just one direction • Symmetry • is higher performance (QoS) required in one direction • Routing path • Number of packets • Number of bytes • End point addresses • Measured by protocols analysers or network management systems NMS • Cisco FlowCollector and data analyzer

5. Well known flow types • Terminal/host traffic flow • Usually asymmetric, telnet • Client/server traffic flow • Clients send queries and requests to servers, servers respond with data, • Flow is bidirectional and asymmetric, SMB, NFS, HTTP • Caching can change the flow • Thin clients, Citrix and MS Terminal services, large volumes of data often at the same time of day • Peer-to-peer traffic flow • Bidirectional and symmetric, small LANs access to data • Peer-to-peer applications for downloading music, software, videos • Videoconferencing • Server/server traffic flow • Directory services, caching, data backup, management applications • Generally bidirectional, symmetry depends on application • Distributed computing traffic flow • Multiple nodes share the processing load • Flows are individual

6. Voice over IP flows • Multiple flows • Call setup and teardown • Client-server flow, phone to gatekeeper or gateway, H.323, skinny, SGCP and MGCP, SIP • Server or phone switch handles call control, call setup and teardown, addressing and routing, rules and capabilities, information and supplementary services • Call switching, moving calls through infrastructure • Audio voice flow and video flow • Peer-to-peer between phones or software such as Cisco Softphone • Distinct traffic flow which may follows a different path than call setup packets and requires QoS and bandwidth

7. Documenting traffic flows • Create a table in your documentation to identify: • Name of application • Type of traffic flow • Terminal/host • Client/server • Peer-to-peer • Server/server • Protocols used • User community using application • Data stores • Approximate bandwidth requirements • QoS requirements

8. Traffic load • Traffic load is the sum of all the data that network hosts have ready to send at a particular time • Network capacity should be adequate to handle the traffic load to avoid bottlenecks • Consider: • Number of stations • Average time that a station is idle between sending frames • Time required to transmit a message – frame size • Number of stations * bits per second sent • Estimate the load per application flow • Investigate infrequent flows • Such as printing monthly statements

9. Application usage patterns • Identify: • User communities • Number of users in the community • Applications used by users • Frequency, number of sessions per day, week, month • Length of average session • Number of simultaneous users of an application • Use information to predict total bandwidth requirement for all users of the application

10. Estimating traffic load of applications • What size are the data objects sent by applications? • What is the size of overhead caused by protocols? • 802.3 frame header and trailer = 46 bytes • IP header = 20 bytes • TCP header = 20 bytes • What is the size of any additional load caused by the application flow (initialisation)?

11. Estimating traffic load of routing protocols • Large distance vector (RIP) routing tables can be sent every 30 secs • Significant load on slow WAN links • OSPF and EIGRP use very little bandwidth • However OSPF database synchronisation packets every 30 mins could be a concern • Hello packets (OSPF 10 secs, EIGRP 5 secs) are very small and effect is negligible

12. Traffic behaviour • Broadcast traffic • Broadcast radiation, the effect of broadcasting by a host can degrade performance • NICs pass broadcasts and some multicasts to processor • If more than 20% of network traffic is broadcast or multicast traffic segment the network with routers or VLANs • Misconfiguration of subnet masks can cause intermittent broadcast storms • IP network, limit the number of stations in a single broadcast domain to 500

13. Network efficiency • Whether applications and protocols use bandwidth efficiently • Frame size • Use the largest MTU possible for large data transfers • Configure on routers • Protocols used • Tune protocol timers • Investigate read/write speeds of storage • Windowing and flow control • By increasing memory and CPU power on receiving hosts a larger receive window can be supported • Error-recovery • Selective ACKS, only missing segments are retransmitted

14. Quality of Service • Is the bandwidth requirement flexible or non-flexible? • Voice is inflexible to delay • Sensitive to packet loss – clipped speech • Packet loss occurs on congested links • Protocols (RSVP) to allow hosts to reserve network bandwidth in advance and receive a guarantee of a negotiated level of service • Packet classifier that determines the QoS class • Admission control – are sufficient resources available on the intermediate nodes • Packet scheduler – determines when packets are forwarded to meet the QoS requirements

15. Agenda • Traffic flows • Traffic load • Traffic behaviour • Quality of Service