RFC 2123 (rfc2123) - Page 1 of 34

Traffic Flow Measurement: Experiences with NeTraMet

Network Working Group                                       N. Brownlee
Request for Comments: 2123                   The University of Auckland
Category: Informational                                      March 1997


          Traffic Flow Measurement:  Experiences with NeTraMet

Status of this Memo

   This memo provides information for the Internet community.  This memo
   does not specify an Internet standard of any kind.  Distribution of
   this memo is unlimited.

Abstract

   This memo records experiences in implementing and using the Traffic
   Flow Measurement Architecture and Meter MIB. It discusses the
   implementation of NeTraMet (a traffic meter) and NeMaC (a combined
   manager and meter reader), considers the writing of meter rule sets
   and gives some guidance on setting up a traffic flow measurement
   system using NeTraMet.

Table of Contents

 1 Introduction                                                        2
   1.1 NeTraMet structure and development . . . . . . . . . . . . . .  3
   1.2 Scope of this document . . . . . . . . . . . . . . . . . . . .  4
 2 Implementation                                                      4
   2.1 Choice of meter platform . . . . . . . . . . . . . . . . . . .  4
   2.2 Programming support requirements . . . . . . . . . . . . . . .  5
     2.2.1 DOS environment  . . . . . . . . . . . . . . . . . . . . .  6
     2.2.2 Unix environment . . . . . . . . . . . . . . . . . . . . .  7
   2.3 Implementing the meter . . . . . . . . . . . . . . . . . . . .  7
     2.3.1 Data structures  . . . . . . . . . . . . . . . . . . . . .  7
     2.3.2 Packet matching  . . . . . . . . . . . . . . . . . . . . .  8
     2.3.3 Testing groups of rule addresses . . . . . . . . . . . . .  8
     2.3.4 Compression of address masks . . . . . . . . . . . . . . .  9
     2.3.5 Ignoring unwanted flow data  . . . . . . . . . . . . . . . 10
     2.3.6 Observing meter reader activity  . . . . . . . . . . . . . 11
     2.3.7 Meter memory management  . . . . . . . . . . . . . . . . . 12
   2.4 Data collection  . . . . . . . . . . . . . . . . . . . . . . . 14
   2.5 Restarting a meter . . . . . . . . . . . . . . . . . . . . . . 15
   2.6 Performance  . . . . . . . . . . . . . . . . . . . . . . . . . 16
 3 Writing rule sets                                                  16
   3.1 Rule set to observe all flows  . . . . . . . . . . . . . . . . 17
   3.2 Specifying flow direction, using computed attributes . . . . . 18
   3.3 Subroutines  . . . . . . . . . . . . . . . . . . . . . . . . . 21
   3.4 More complicated rule sets . . . . . . . . . . . . . . . . . . 23



Brownlee                     Informational