From savikk at yahoo.co.in Tue Mar 9 06:09:03 2004 From: savikk at yahoo.co.in (=?iso-8859-1?q?Savitha=20Kumar?=) Date: Tue, 9 Mar 2004 05:09:03 +0000 (GMT) Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement Message-ID: <20040309050903.28495.qmail@web8204.mail.in.yahoo.com> Hi, Is there any activity going on to measure IPv6 traffic? If anybody is working on it, can you please share what tools are you using? I'm basically looking for an accounting tool which could recognize IPv6 packets and addresses. I got this tool called NeTraMet. Does anybody has any experience in using this tool for IPv6? Thanks, Savitha ________________________________________________________________________ Yahoo! India Insurance Special: Be informed on the best policies, services, tools and more. Go to: http://in.insurance.yahoo.com/licspecial/index.html From tjc at ecs.soton.ac.uk Tue Mar 9 08:53:23 2004 From: tjc at ecs.soton.ac.uk (Tim Chown) Date: Tue, 9 Mar 2004 07:53:23 +0000 Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040309050903.28495.qmail@web8204.mail.in.yahoo.com> References: <20040309050903.28495.qmail@web8204.mail.in.yahoo.com> Message-ID: <20040309075323.GD10497@login.ecs.soton.ac.uk> Hi, Have a look at this 6NET project document: http://www.6net.org/publications/deliverables/D6.2.3v2.pdf Tim On Tue, Mar 09, 2004 at 05:09:03AM +0000, Savitha Kumar wrote: > Hi, > > Is there any activity going on to measure IPv6 > traffic? If anybody is working on it, can you please > share what tools are you using? > > I'm basically looking for an accounting tool which > could recognize IPv6 packets and addresses. > > I got this tool called NeTraMet. Does anybody has any > experience in using this tool for IPv6? > > Thanks, > Savitha > > ________________________________________________________________________ > Yahoo! India Insurance Special: Be informed on the best policies, services, tools and more. > Go to: http://in.insurance.yahoo.com/licspecial/index.html From savikk at yahoo.co.in Wed Mar 10 06:19:50 2004 From: savikk at yahoo.co.in (=?iso-8859-1?q?Savitha=20Kumar?=) Date: Wed, 10 Mar 2004 05:19:50 +0000 (GMT) Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040309075323.GD10497@login.ecs.soton.ac.uk> Message-ID: <20040310051950.95136.qmail@web8201.mail.in.yahoo.com> Thanks!! I'm just wondering if an accounting tool would be useful in an enterprise. Generally an accounting tool is more used by service providers. Would there be any need for an accounting tool in enterprise market? Anbody has any ideas?? Thanks for your time! Savitha --- Tim Chown wrote: > Hi, > > Have a look at this 6NET project document: > > http://www.6net.org/publications/deliverables/D6.2.3v2.pdf > > Tim ________________________________________________________________________ Yahoo! India Insurance Special: Be informed on the best policies, services, tools and more. Go to: http://in.insurance.yahoo.com/licspecial/index.html From tjc at ecs.soton.ac.uk Wed Mar 10 10:47:01 2004 From: tjc at ecs.soton.ac.uk (Tim Chown) Date: Wed, 10 Mar 2004 09:47:01 +0000 Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040310051950.95136.qmail@web8201.mail.in.yahoo.com> References: <20040309075323.GD10497@login.ecs.soton.ac.uk> <20040310051950.95136.qmail@web8201.mail.in.yahoo.com> Message-ID: <20040310094700.GD793@login.ecs.soton.ac.uk> Why would there not be? On Wed, Mar 10, 2004 at 05:19:50AM +0000, Savitha Kumar wrote: > Thanks!! > > I'm just wondering if an accounting tool would be > useful in an enterprise. Generally an accounting tool > is more used by service providers. > Would there be any need for an accounting tool in > enterprise market? > Anbody has any ideas?? > > Thanks for your time! > Savitha > > --- Tim Chown wrote: > Hi, > > > > Have a look at this 6NET project document: > > > > > http://www.6net.org/publications/deliverables/D6.2.3v2.pdf > > > > Tim > > > ________________________________________________________________________ > Yahoo! India Insurance Special: Be informed on the best policies, services, tools and more. > Go to: http://in.insurance.yahoo.com/licspecial/index.html From matthew.ford at bt.com Wed Mar 10 12:26:07 2004 From: matthew.ford at bt.com (matthew.ford at bt.com) Date: Wed, 10 Mar 2004 11:26:07 -0000 Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement Message-ID: <0AAF93247C75E3408638B965DEE11A7006141F63@i2km41-ukdy.domain1.systemhost.net> Note that this document doesn't mention ntop (www.ntop.org) which now supports IPv6 in CVS and can be used as an open-source alternative to Cisco's netflow. Mat > -----Original Message----- > From: ipv6-wg-admin at ripe.net [mailto:ipv6-wg-admin at ripe.net] > On Behalf Of Tim Chown > Sent: 09 March 2004 07:53 > To: ipv6-wg at ripe.net > Subject: Re: [ipv6-wg at ripe.net] IPv6 traffic measurement > > Hi, > > Have a look at this 6NET project document: > > http://www.6net.org/publications/deliverables/D6.2.3v2.pdf > > Tim > > On Tue, Mar 09, 2004 at 05:09:03AM +0000, Savitha Kumar wrote: > > Hi, > > > > Is there any activity going on to measure IPv6 traffic? If > anybody is > > working on it, can you please share what tools are you using? > > > > I'm basically looking for an accounting tool which could recognize > > IPv6 packets and addresses. > > > > I got this tool called NeTraMet. Does anybody has any experience in > > using this tool for IPv6? > > > > Thanks, > > Savitha > > > > > ______________________________________________________________________ > > __ Yahoo! India Insurance Special: Be informed on the best > policies, > > services, tools and more. > > Go to: http://in.insurance.yahoo.com/licspecial/index.html > > From savikk at yahoo.co.in Thu Mar 11 05:41:13 2004 From: savikk at yahoo.co.in (=?iso-8859-1?q?Savitha=20Kumar?=) Date: Thu, 11 Mar 2004 04:41:13 +0000 (GMT) Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040310094700.GD793@login.ecs.soton.ac.uk> Message-ID: <20040311044113.55487.qmail@web8203.mail.in.yahoo.com> In an enterprise, accounting tool could be used for user monitoring or security monitoring and things like that. These cannot be attributed as accounting in the real sense. I believe any monitoring tool could be used for this purpose. However, I've also got a feedback that demand is rising for Cisco's NetFlow in the enterprise market. -Savitha --- Tim Chown wrote: > Why would there not be? > > On Wed, Mar 10, 2004 at 05:19:50AM +0000, Savitha > Kumar wrote: > > Thanks!! > > > > I'm just wondering if an accounting tool would be > > useful in an enterprise. Generally an accounting > tool > > is more used by service providers. > > Would there be any need for an accounting tool in > > enterprise market? > > Anbody has any ideas?? > > > > Thanks for your time! > > Savitha > > > > --- Tim Chown wrote: > Hi, > > > > > > Have a look at this 6NET project document: > > > > > > > > > http://www.6net.org/publications/deliverables/D6.2.3v2.pdf > > > > > > Tim > > > > > > > ________________________________________________________________________ > > Yahoo! India Insurance Special: Be informed on the > best policies, services, tools and more. > > Go to: > http://in.insurance.yahoo.com/licspecial/index.html > ________________________________________________________________________ Yahoo! India Insurance Special: Be informed on the best policies, services, tools and more. Go to: http://in.insurance.yahoo.com/licspecial/index.html From pim at ipng.nl Tue Mar 16 19:35:37 2004 From: pim at ipng.nl (Pim van Pelt) Date: Tue, 16 Mar 2004 19:35:37 +0100 Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040309050903.28495.qmail@web8204.mail.in.yahoo.com> References: <20040309050903.28495.qmail@web8204.mail.in.yahoo.com> Message-ID: <20040316183537.GA17476@bfib.colo.bit.nl> On Tue, Mar 09, 2004 at 05:09:03AM +0000, Savitha Kumar wrote: | Hi, | | Is there any activity going on to measure IPv6 | traffic? If anybody is working on it, can you please | share what tools are you using? | | I'm basically looking for an accounting tool which | could recognize IPv6 packets and addresses. | | I got this tool called NeTraMet. Does anybody has any | experience in using this tool for IPv6? I was thinking of building IPv6 support in my YAPS program. Look at http://sf.net/projects/yaps-pcap/ and let me (and the list) know if this interrests you. We (AS12859) are using YAPS to account for approximately 400 Mbps of IPv4 traffic on a P4 with commodity hardware. They key to IPv6 implementation is a decent hash function for Ipv6 addresses. If anybody has some knowledge or data on this, let me know. Otherwise I have something statistical I think may work fine .. It should take me less than 5 working days of coding to implement IPv6 in this program. -- ---------- - - - - -+- - - - - ---------- Pim van Pelt Email: pim at ipng.nl http://www.ipng.nl/ IPv6 Deployment ----------------------------------------------- From savikk at yahoo.co.in Tue Mar 23 10:58:22 2004 From: savikk at yahoo.co.in (=?iso-8859-1?q?Savitha=20Kumar?=) Date: Tue, 23 Mar 2004 09:58:22 +0000 (GMT) Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040316183537.GA17476@bfib.colo.bit.nl> Message-ID: <20040323095822.95062.qmail@web8204.mail.in.yahoo.com> > I was thinking of building IPv6 support in my YAPS > program. Look at > http://sf.net/projects/yaps-pcap/ > > and let me (and the list) know if this interrests > you. We (AS12859) > are using YAPS to account for approximately 400 Mbps > of IPv4 traffic > on a P4 with commodity hardware. I took a look at your project at the above URL. Looks good. But the catch here is that it is a packet sniffer. An accounting tool essentially uses packet sniffers generally libpcap but does something more than that (using SNMP MIBS, or something like that). The advantage of this is it can be used for large enterprises/networks and the most important point is if the network is migrated to gigabit Ethernet or something packet sniffers would'nt work as they don't follow a standard. I've just thrown in my views. Please let me know if I'm not correct. > > They key to IPv6 implementation is a decent hash > function for Ipv6 > addresses. If anybody has some knowledge or data on > this, let me know. > Otherwise I have something statistical I think may > work fine .. > > It should take me less than 5 working days of coding > to implement IPv6 > in this program. > -- > ---------- - - - - -+- - - - - ---------- > Pim van Pelt Email: pim at ipng.nl > http://www.ipng.nl/ IPv6 Deployment > ----------------------------------------------- > ________________________________________________________________________ Yahoo! India Insurance Special: Be informed on the best policies, services, tools and more. Go to: http://in.insurance.yahoo.com/licspecial/index.html From gert at space.net Tue Mar 23 11:01:35 2004 From: gert at space.net (Gert Doering) Date: Tue, 23 Mar 2004 11:01:35 +0100 Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040316183537.GA17476@bfib.colo.bit.nl> References: <20040309050903.28495.qmail@web8204.mail.in.yahoo.com> <20040316183537.GA17476@bfib.colo.bit.nl> Message-ID: <20040323100135.GE8040@Space.Net> Hi, On Tue, Mar 16, 2004 at 07:35:37PM +0100, Pim van Pelt wrote: > | I got this tool called NeTraMet. Does anybody has any > | experience in using this tool for IPv6? > I was thinking of building IPv6 support in my YAPS program. Look at > http://sf.net/projects/yaps-pcap/ > > and let me (and the list) know if this interrests you. Yes, that would certainly be interesting. I've been doing some experimenting with IPv6 netflow, and my home-grown collector is far from "production quality"... Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 60210 (58081) SpaceNet AG Mail: netmaster at Space.Net Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 80807 Muenchen Fax : +49-89-32356-299 From pim at ipng.nl Tue Mar 23 11:31:12 2004 From: pim at ipng.nl (Pim van Pelt) Date: Tue, 23 Mar 2004 11:31:12 +0100 Subject: [ipv6-wg@ripe.net] IPv6 traffic measurement In-Reply-To: <20040323095822.95062.qmail@web8204.mail.in.yahoo.com> References: <20040316183537.GA17476@bfib.colo.bit.nl> <20040323095822.95062.qmail@web8204.mail.in.yahoo.com> Message-ID: <20040323103112.GC10214@bfib.colo.bit.nl> Hi Savitha, Gert, Regarding IPv6 accounting using a PCAP program: | > http://sf.net/projects/yaps-pcap/ | | I took a look at your project at the above URL. Looks | good. But the catch here is that it is a packet | sniffer. An accounting tool essentially uses packet | sniffers generally libpcap but does something more | than that (using SNMP MIBS, or something like that). | The advantage of this is it can be used for large | enterprises/networks and the most important point is | if the network is migrated to gigabit Ethernet or | something packet sniffers would'nt work as they don't | follow a standard. Well, scaling is the problem we had at AS12859 also, when we upgraded from an STM1 to multiple dark fibers carrying GigE. Allthough today's hardware is indeed capable of examining line rate gigabit traffic, it's not optimal and kind of difficult to get the traffic to a single measuring point when you have multiple exitpoints. This is actually exactly why I wrote YANA (Yet Another Netflow Analyser) two weeks ago. What this does is extend the way YAPS works (accounting IPv4 addresses using pcap), to support IPv4 accounting per interface per cflow source; This way, one can answer questions like "What is the top10 speaker at the DE-CIX shared medium (fa0/2 @ cis1.de-cix) ?" or "From AS-BIT, who talks the most to AS3356 at AMS-IX (ge-0/1/0.100 @ jun1.ams-ix); Not to plug this software, but it seems natural to respond to your scaling issue. It's well under control using (statistical) flow management.o Back to IPv6. Gert seems interrested, and at least so am I. What I need is to change the source code a bit to use a new hashing library which I wrote for YANA. It is able to hash IPv6 addresses too and should be just as fast on both endian platforms, taking only memory for the IPv6 addresses that actually use resources. Gert (or others), would you be interrested in per-prefix (ie, per /48 or per /64) statistics, or per-host (/128) stats ? I am interrested in all three of them, but implementing it takes careful consideration. The /128 approach can be aggregated into accounting per /64 or other size, of course using potentially a lot more memory .. at 48 bytes per counter, if somebody started sending traffic to your /32, you'd quickly end up exhausting available primary storage on the measuring box. One method I could think of, is only initializing a new counter for a /128 which you've actually seen *outbound* traffic on. This way, random junk and portscanning will not explode your counter counts that much. It still remains difficult though, due to the numbers of (potentially) active IPv6 addresses ... Another is timestamping. We could make counters disappear after N seconds of idletime; this way noise can be eliminated and all idle IPv6 (and IPv4) addresses are eliminated... hmm, thinking aloud on this forum may help. Any other thoughts on this (YAPS and YANA) approach ? Does anybody want to help test (even develop?) this software ? -- ---------- - - - - -+- - - - - ---------- Pim van Pelt Email: pim at ipng.nl http://www.ipng.nl/ IPv6 Deployment -----------------------------------------------