An ISP's business revolves around traffic but traffic behavior is very difficult to extract from a network. SNMP MIB interface counters can give a link's loading but offer no clue as to why it's loaded. NetFlow collectors give a detailed source/destination breakdown of the traffic on a link but the data is so voluminous that it's difficult even to acquire, much less analyze, categorize and correlate across an entire topology. Although we have lots of traffic data, little useful information gets extracted from it.

Route/flow data fusion—combining flow measurements (NetFlow, sflow, MPLS tunnel counters, sniffer traces, etc.) with IGP and BGP routing data—makes it possible to construct tools that show, in real time, where traffic is distributed across a topology. Unlike a simple traffic matrix, this analysis can show not only what are the ingress to egress loads but also how loaded are the intermediate links, who loaded them, and why.

Route/flow fusion is scalable and doesn't require much effort to set up: since routing transforms a flow measurement made at a point to flow along an entire path, flows only need to be collected on customer and peering links. Since the meta information needed to classify and aggregate the flow data is already in the routing data (e.g., address-to-prefix mappings, prefix-to-AS, and prefix-to-community mappings) the tools can almost entirely self-configure.

This talk will describe algorithms and give examples of how to fuse flow and routing data and how to analyze and visualize the results. Examples will use real flow and routing data from a large ISP and emphasize solving real operational, engineering and business problems.

About the Presenter
Van Jacobson did some networking stuff a long time ago. These days he spends most of his time chauffeuring a grumpy teenager & a loud seven year old. Occasionally he gives talks for people who are too busy doing real work to talk about it.