random musings from a twisted mind
Uncategorized
playing with tcptrace and xplot
Sep 29th

# tcpdump -ni en0 port 80 -w output.trace
# tcptrace -G output.trace
# xplot *tput.xpl
From the online manpage:
- Yellow: instantaneous packets
- Red: Throughput for the last few packets
- Blue: Throughput since the start of the stream/connection
Other useful graphs:
- _owin.xpl – outstanding data/congestion
- _rtt.xpl – round trip time/time
- _ssize.xpl – segment size/time
- _tput.xpl – throughput/time
- _tsg.xpl – time sequence graph
- _tline.xpl – Timeline graph – W Richard Stevens style
Just some notes here so I don’t forget the basics – manual over at here.
interesting posts from NANOG
Sep 26th
Following reply by iljitsch van Beijnum about queueing delays in IP, looked to be a good little summary.
The answer is that delay is only one aspect of performance, another important one is packet loss. As link bandwidth increases, queuing delays decrease proportionally. So if you’re using your 10 Mbps link with average 500 byte packets at 98% capacity, you’ll generally have a 49-packet queue. (queue = utilization / (1 – utilization)) Our 500 byte packets are transmitted at 0.4 ms intervals, so that makes for a 19.6 ms queuing delay.
So now we increase our link speed to 100 Mbps, but for some strange reason this link is also used at 98%. So the average queue size is still 49 packets, but it now only takes 0.04 ms to transmit one packet, so the queuing delay is only 1.96 ms on average.
As you can see, as bandwidth increases, queuing delays become irrelevant. To achieve even 1 ms queuing delay (that’s only 120 miles extra fiber) at 10 Gbps you need an average queue size of 833 even with 1500-byte packets. For this, you need a link utilization of almost 99.9%.
However, due to IP’s bursty nature the queue size is quite variable. If there is enough buffer space to accommodate whatever queue size that may be required due to bursts, this means you get a lot of jitter. (And, at 10 Gbps, expensive routers, because this memory needs to be FAST.) On the other hand, if the buffer space fills up but packets keep coming in faster than they can be transmitted, packets will have to be dropped. As explained by others, this leads to undesired behavior such as TCP congestion synchronization when packets from different sessions are dropped and poor TCP performance when several packets from the same session are dropped. So it’s important to avoid these “tail drops”, hence the need for creative queuing techniques.
However, at high speeds you really don’t want to think about this too much. In most cases, your best bet is RED (random early detect/drop) which gradually drops more and more packets as the queue fills up (important: you need to have enough buffer space or you still get excessive tail drops!) so TCP sessions are throttled back gradually rather than traumatically. Also, the most aggressive TCP sessions are the most likely to see dropped packets. With weighted RED some traffic gets a free pass up to a point, so that’s nice if you need QoS “guarantees”. (W)RED is great because it’s not computationally expensive and only needs some enqueuing logic but no dequeuing logic.
the war of the worlds reprise
Sep 14th
well it looks like war of the worlds is going to be back on tour in the UK next year, so will definitely have to look at going to see a show when they’re in London.
What I didn’t know is that they used image metrics to model Richard Burton’s face during the dialogue, which I remembered reading about in the last few weeks. So will be interesting to see what they can do coming up
solaris zone utilisation via SNMP
Sep 8th
It’s been a bug-bear for a long time for me that the CPU metrics when querying a Solaris 10 host are global and not zone specific (which of course makes sense, just makes it harder to track zone utilisation).
So finally wrote a basic perl script that will provide that information via a SNMP mib, output looks like the following:
> snmpwalk -v 1 -c public localhost .1.3.6.1.4.1.2021.255.7
UCD-SNMP-MIB::ucdavis.255.7.0 = STRING: "Zone name"
UCD-SNMP-MIB::ucdavis.255.7.1 = STRING: "global"
UCD-SNMP-MIB::ucdavis.255.7.2 = STRING: "gallery"
UCD-SNMP-MIB::ucdavis.255.7.3 = STRING: "nakos"
UCD-SNMP-MIB::ucdavis.255.7.4 = STRING: "mcdougallfamily"
UCD-SNMP-MIB::ucdavis.255.7.5 = STRING: "shared"
UCD-SNMP-MIB::ucdavis.255.7.6 = STRING: "packer"
UCD-SNMP-MIB::ucdavis.255.7.7 = STRING: "si"
Script is available at here
Current bugs/issues
# snmpwalk will not step through all the sub-trees
iWeb
Aug 12th
well, just sat down and actually had a play with iWeb ’08, and it’s actually pretty good – ok, i’ve yet to have a good look at the HTML it creates; but in terms of ease of use – it’s very easy, though i did have to use a rsync script to make publishing a little simpler (although webdav does work pretty well if that’s your thing)
I just wonder how long it’s going to last though