Utilizing Stream For Different Things Than System Information Is the coke machine half vacant or half full?

Presentation Transcript

IBM Research – Zurich Using Flow For Other Things Than Network Data Is the coke machine half void or half full?

Anaphera (hot-reinforcement) DB Why are we doing this We have built up our own particular superior & adaptable Flow Analyzer (Anaphera) First exclusively focused at Network Traffic, which was our essential center Does conglomeration, connection and inconsistency location nodeA IPFIX nodeB nodeX Using Flow For Other Things Than Network Data

Why just take a gander at system data? Various IBM interior associations saw our device when utilized for system utilization and where for the most part inspired with the speed adaptability and ease of use of the UI. The SONAS (Scale Out Network Attached Storage) group asked for in the event that we could likewise make a comparable instrument for their capacity line of items. We realize that IPFIX is an entirely reduced, effortlessly parseable and generatable arrangement and because of the Enterprise IDs and adaptable Element IDs can undoubtedly be made useable for other information than system. We hence upgraded our apparatus to have the capacity to dissect any sort of information which is (in part) the thought behind IPFIX and why not do it, same motor, simply more information, more connection Biggest preferred standpoint: a solitary parser for IPFIX Using Flow For Other Things Than Network Data

SNMP versus IPFIX SNMP = survey, IPFIX = push Problem with SNMP is that one needs to survey every one of the gadgets Want estimations each n minutes, out of 100.000 meters Great test in making a device that can survey that measure of meters Especially when gadgets are not generally on the web/reachable TCP state confounds matters as well, for the most part need to appropriate accumulation over various machines With IPFIX, simply design those 100.000 gadgets to push their measurements out each n minutes Need an authority which can acknowledge entirely bursty activity Could anycast gatherers to spread load if truly required Using Flow For Other Things Than Network Data

XML Registry IANA IPFIX Information Element registry http://www.iana.org/assignments/ipfix/ipfix.xhtml <xml… . <registry… . … <record> <name>IBM_disk_reads</name> The name of the segment <ibm_title>Disk Reads</ibm_title> Title for the charts <ibm_type>uint</ibm_type> The esteem is a whole number <ibm_related> Related values <elementId>IBM_disk_writes</elementId> <elementId>IBM_cpu_load</elementId> </ibm_related> <group>IBM-Storage-Disk</group> What amass it has a place with <elementId>10001</elementId> The IEID <enterpriseId>2</enterpriseId> The IBM Enterprise ID <description> Little portrayal for people <paragraph> CPU Usage, User part </paragraph> </description> </record> Using Flow For Other Things Than Network Data

Data Types String (BPSL style) ISO Country Code (eg .ch) IP address (4 bytes it is IPv4, 16 it is IPv6) EUI48 (MAC Address) IE (Information Element) Hex Float Unsigned Integer Datetime Time Octets Packets Flows ASN FlowLabel Port Domain Interface FlowVersion VLan ICMP Using Flow For Other Things Than Network Data

Static Templates are shoddy Implementation shrewd, making an IPFIX meter is 'shabby': Define a static structure Fill structure each <n> time with information Export structure over the system Once in a while send a layout that depicts the structure Can without much of a stretch be done in silicon Watch out for endian issues ;) Using Flow For Other Things Than Network Data

Use of new IPFIX BasicLists https://datatracker.ietf.org/doc/draft-ietf-ipfix-organized information/IETF Working Group thing, yet not settled yet Defines an approach to store rehashing data into IPFIX records Useful for example when one has different harddisks, numerous cpus, additionally ASPaths Using Flow For Other Things Than Network Data

Aspects Command arrange: perspective new <name> <type> [<components> … ] viewpoint new cpu tva ip_exp (*IBM_cpu_idle *IBM_cpu_iowait *IBM_cpu_system) angle set name "Have CPU Usage" This designs a viewpoint called "cpu" with name "Have CPU Usage" which creates diagrams for every host. The keys will be produced from the IP address of the exporter (ip_exp) and the IEID (Information Element Identifier) of the segments determined, the esteem will be what the IEID indicates. The bullet before a part name demonstrates that the name goes into the key and the esteem is utilized for the esteem. Regularly, as for ip_exp over, the esteem is put away in the key. The supports show an arrangement of "or" segments, eg to store both source and goal addresses one can utilize: viewpoint new host tva (ip_src ip_dst) Using Flow For Other Things Than Network Data

IPFIX over Delay Tolerant Networking or SMTP Not all gadgets are associated day in and day out DTN determines two conventions for store-and-forward informing (Licklider + Bundle) Can likewise utilize SMTP which is less demanding to setup, simply have a neighborhood mailspool which gets flushed when the host dials into the system/interfaces. Valuable for recovering measurements from hubs which are not generally associated like sensors that are dropped around a place where the sensors don't have a great deal of battery power Using Flow For Other Things Than Network Data

Storage Performance administration is critical away situations Can join organize patterns with plate action Instead of top talkers, make sense of what documents are "hot", and all things considered move those records/squares of information to SSD for snappier get to Can improve LRU and MU reserves in light of information that is gathered Example insights: NFS Samba/CIFS Disk Usage CPU stack In absolute >2500 isolate measurements… Using Flow For Other Things Than Network Data

Electric autos & Windmills EDISON: Electric vehicles in an appropriated and incorporated market utilizing feasible vitality and open systems One a player in this includes Electric Vehicles (EVs) and overseeing when these EVs re-charge, in an approach to not over-burden the electrical system and utilizing renewable assets as productively as could be expected under the circumstances. At the point when the autos charge, they can speak with a focal server. We then send utilizing IPFIX the arrived at the midpoint of speed, drive length, control utilization and so on to the IPFIX authority. The driver can demonstrate what sort of treks will be attempted and when the auto ought to be completely charged. Different calculations then teach the auto when it is least expensive to charge and at which times It is liked to charge itself because of system load Using Flow For Other Things Than Network Data

Road Traffic System which can recognize tags Record speed at point X => Send utilizing IPFIX: tag, shading and speed Record speed at point Y => Send utilizing IPFIX: tag, shading and speed Collector can normal the estimations out, hurl the tag Add a street topology to the blend and you pick up understanding on what courses autos take and where there are a great deal of autos, where blockage Happens what changes in speed there are amid clog and so on. Utilizing Flow For Other Things Than Network Data

Open Issues/Future Work Standardize the sorts and the additional data in the Central/Global registry where each association can enlist their Information Elements most likely IANA will be fitting for this as the default IPFIX IEs are likewise there Using Flow For Other Things Than Network Data

Is the coke machine half void or half full? Once in a while you need a drink Sometimes the candy machine is vacant Do you need to stroll over to see whether it is vacant, or would you like to simply remain in your seat? => Instrument the candy machine Vending machine has an installment convention Cards contain an ID, credit is midway directed. Take advantage of the serial convention between the candy machine and the credit machine Let the sniffer create IPFIX bundles, exclusively with respect to the convention recognizing installment and the kind of item purchased. Utilizing Flow For Other Things Than Network Data

Questions?

Screenshots Using Flow For Other Things Than Network Data