skip to main content
10.1145/1644893.1644910acmconferencesArticle/Chapter ViewAbstractPublication PagesimcConference Proceedingsconference-collections
research-article

On calibrating enterprise switch measurements

Published: 04 November 2009 Publication History

Abstract

The complexity of modern enterprise networks is ever-increasing, and our understanding of these important networks is not keeping pace. Our insight into intra-subnet traffic (staying within a single LAN) is particularly limited, due to the widespread use of Ethernet switches that preclude ready LAN-wide monitoring. We have recently undertaken an approach to obtaining extensive intra-subnet visibility based on tapping sets of Ethernet switch ports simultaneously. However, doing so leads to a number of measurement calibration issues that require careful consideration to address. First, one must correctly account for redundant copies of packets that appear due to switch flooding, which if not accurately identified can greatly skew subsequent analysis results. We show that a simple, natural rule one might use for doing so in fact introduces systematic errors, but an altered version of the rule performs significantly better. We then employ this revised rule to aid with calibration issues concerning the fidelity of packet timestamps and the amount of measurement loss that our collection apparatus incurred. Additionally, we develop techniques to "map" the monitored network in terms of identifying key topological components, such as subnet boundaries, which hosts were directly monitored, and the presence of "hidden" switches and hubs. Finally, we present initial analyses demonstrating that the magnitude and diversity of traffic at the subnet level is in fact striking, highlighting the importance of obtaining and correctly calibrating switch-level enterprise traces.

References

[1]
Colasoft. CGMP (Cisco Group Management Protocol). http://www.protocolbase.net/protocols/protocol_CGMP.php, 2006.
[2]
F. Giroire, J. Chandrashekar, G. Iannaccone, K. Papagiannaki, E. Schooler, and N. Taft. The Cubicle vs. The Coffee Shop: Behavioral Modes in Enterprise End-Users. In Proc. PAM, 2008.
[3]
R. Gusella. A measurement study of diskless workstation traffic on an Ethernet. IEEE Transactions on Communications, 38(9), Sept. 1990.
[4]
IEEE Standards Association. IEEE 802.3 LAN/MAN CSMA/CD Access Method. http://standards.ieee.org/getieee802/802.3.html, 2008.
[5]
R. Pang, M. Allman, M. Bennett, J. Lee, V. Paxson, and B. Tierney. A First Look at Modern Enterprise Traffic. In Proc. ACM IMC, Oct. 2005.
[6]
V. Paxson. Automated packet trace analysis of TCP implementations. In Proc. SIGCOMM, 1997.
[7]
V. Paxson. On calibrating measurements of packet transit times. In Proc. SIGMETRICS, June 1998.
[8]
V. Paxson. Bro: A System for Detecting Network Intruders in Real-Time. Comp. Networks, 31(23-24), 1999.

Cited By

View all
  • (2014)TimeAudit: Blind dissection and analysis of transaction delays in enterprise networks2014 26th International Teletraffic Congress (ITC)10.1109/ITC.2014.6932937(1-9)Online publication date: Sep-2014
  • (2010)A preliminary analysis of TCP performance in an enterprise networkProceedings of the 2010 internet network management conference on Research on enterprise networking10.5555/1863133.1863140(7-7)Online publication date: 27-Apr-2010

Index Terms

  1. On calibrating enterprise switch measurements

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Conferences
    IMC '09: Proceedings of the 9th ACM SIGCOMM conference on Internet measurement
    November 2009
    468 pages
    ISBN:9781605587714
    DOI:10.1145/1644893
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Sponsors

    In-Cooperation

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 04 November 2009

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. enterprise networks
    2. network traces
    3. switch-based packet capture
    4. trace calibration

    Qualifiers

    • Research-article

    Conference

    IMC '09
    Sponsor:
    IMC '09: Internet Measurement Conference
    November 4 - 6, 2009
    Illinois, Chicago, USA

    Acceptance Rates

    Overall Acceptance Rate 277 of 1,083 submissions, 26%

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)4
    • Downloads (Last 6 weeks)1
    Reflects downloads up to 20 Feb 2025

    Other Metrics

    Citations

    Cited By

    View all
    • (2014)TimeAudit: Blind dissection and analysis of transaction delays in enterprise networks2014 26th International Teletraffic Congress (ITC)10.1109/ITC.2014.6932937(1-9)Online publication date: Sep-2014
    • (2010)A preliminary analysis of TCP performance in an enterprise networkProceedings of the 2010 internet network management conference on Research on enterprise networking10.5555/1863133.1863140(7-7)Online publication date: 27-Apr-2010

    View Options

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Figures

    Tables

    Media

    Share

    Share

    Share this Publication link

    Share on social media