Macha Monitoring: Difference between revisions
No edit summary |
|||
Line 83: | Line 83: | ||
* tcpdstat -d <tracefile> | * tcpdstat -d <tracefile> | ||
To analyse packet size distribution:L tcpdstat -w out.log <tracefile> | To analyse packet size distribution:L tcpdstat -w out.log <tracefile> | ||
=== Understanding port numbers === | |||
* Database of known official and unofficial port numbers being used (http://ports.tantalo.net/?q=gnutella) | |||
=== DNS analysis === | === DNS analysis === | ||
Line 92: | Line 96: | ||
* Check with | * Check with | ||
last reboot | last reboot | ||
Revision as of 07:08, 17 February 2010
Purpose
Rural wireless networks in developing regions often depend on slow satellite links for their Internet access. This paper will try to quanitify the traffic patterns and usage of a slow satellite internet link in a rural wireless network and compare this to recent studies of Internet uisage patterns in the developed world to understand key challenges. This will be used as a starting point for further work to try and optimize Internet usage over slow satellite links in developing regions.
Team Members
- David Johnson
- Elizabeth Belding
- Kevin Almeroth
- Gertjan van Stam
Idea description
Main challenges
Milestones
Changes made on machines in Macha to enable monitoring
Tools installed on my machine for analysis
Python tools fro analysing tcpdump files or live interface
- pypcap
sudo apt-get install python-pypcap dpkg --listfiles python-pypcap ... to see files that it installes svn checkout http://dpkt.googlecode.com/svn/trunk/ dpkt-read-only cd dpkt-read-only sudo make install cd /usr/share/doc/python-pypcap/examples python test.py
- Examples using pypcap
- Pyscan logger (http://code.activestate.com/recipes/576690/)
- Packet monitoring with dpkt (http://code.activestate.com/recipes/576678/)
Primary obstacles
Evaluation
Metrics that will be measured
- Percentage of local traffic
- Caching efficiency (ratio of incoming traffic to external destination to outgoing traffic to external destination)
- DNS hit rate
- DNS delays (can be quite significant) , % of DNS hit on local DNS
- Up/Down Traffic usage over a 2 week loggin interval
- Flow analysis
- TCP connection durations - Number of simultaneous flows in the network over time - Plot of bandwidth used per IP source address in the network - check if there are clear dominant users - # Retransmissions - TCP round trip times for ACKS
- Breakdown of application classes using port numbers
- Peer-to-peer traffic - Web - video streaming ... protocols like RTSP have there own port - also IP based for flash sites like youtube - VoIP ... prototocols like SIP and some known Skype ports - Skype is a challenge if using port 80 - Instant messaging ... could catch things like IRC but maybe IP addresses based again - tunneling
Useful links
Monitoring tools
- tshark
Scraping tcpdump files
- List of useful tools (http://www.comlab.uni-rostock.de/research/tools.html)
- TCPdump tips - filters can also be used with pcapy (http://www.cs.ucr.edu/~marios/ethereal-tcpdump.pdf)
- Crawdad has tools but mostly looks like wifi specific (http://crawdad.cs.dartmouth.edu/tools.php)
- ipsumdump
- tcpflow
- tcpdstat -d <tracefile>
To analyse packet size distribution:L tcpdstat -w out.log <tracefile>
Understanding port numbers
- Database of known official and unofficial port numbers being used (http://ports.tantalo.net/?q=gnutella)
DNS analysis
- Macha uses dnsmasq (uses a default of only 150 names in the cache)
dnsmasq -c --cache-size=<cachesize> - if cachesize=0 it disables it
Checking reboot commands issued
- Check with
last reboot
Squid proxy analysis
- Description of meaning of all log files (http://www.tenon.com/support/webten/papers/squidlog.shtml)
- Hit rate for proxy server (http://www.squid-cache.org/Scripts/)
- Squid analysis (http://squid-graph.securlogic.com/)