introductions

Traffic Management Readers,

I wanted to introduce my organization with the hopes that others may be
similar and be open to discussion and comparing notes.

Davis is one of 10 sites with the University of California. We are lucky
to have the vast majority of our equipment sflow capable. Many of our
other devices are sending netflow to Traffic Server.

I had put together some information about our implementation and will
include that. Please feel free to write if there is anything you would
like to know about our implementation...or write to the list if it is of
general interest.

Hope we all get familiar and help each other out.

Kevin Kawaguchi
UC Davis Network Operations Center

----------------------------------------------------------------------------
Hardware/Softare

     * 4xProcessor, 4GB RAM
     * Disk array split for 2x1T Partitions
     * RedHat Linux
     * InMon Traffic Server 4.0.21

Relevant Background Information

     * University/Education traffic levels and trends
     * 2 Border Routers
     * Roughly 4 Core switches
     * Roughly 13 Geographic Area switches
     * Roughly 120 Building switches
     * Roughly 1400 Edge switches
     * Roughly 30,000 MAC Addresses
     * Single host per port not required
     * Layer2/3 vendor well know sFlow supporter
     * Chose ~1/512 sampling rate after traffic survey

Features Activated/Installed

     * Named Zones and Subnets for all VLANs (750+)
     * Installed GraphViz for Path Analysis Graphical View
     * Configured RRD Options for WAN type interfaces
     * Enabled email notifications (traps when thresholds tuned)
     * Implemented simple security option including non-central DHCP detection
     * Set security RulesCapture to 1000
     * Active minutes set to 525600 (1 year)
     * HistoryDays set to 1095 (3 years)
     * Active minutes to own partition
     * History, State, Logs, etc to own partition
     * Trace enabled
     * SNMP community used
     * Thresholds set to different levels depending on interface speed
     * Forwarding locally set to 6400-6402 for sflowtool | tcpdump

Findings

     * About 800G on each external partition
     * 2.7G Active data per day at summertime levels
     * 630M History,etc per day at summertime levels
     * Enough disk for 296 days active, 1270 Days History, etc
     * 18708 active interfaces
     * Samples during summer 900-1500 per second
     * Samples during school 1500-1800 per second
     * Some loss at this sample rate
     * CPU load w/o querries about 0.40
     * CPU load with querries less than 2.00
     * RAM usage started at 8% and climbs as active data grows
Received on Thu Sep 2 20:46:07 2004