[Micronet] Network Statistics, reduce number of Broadcast/Multicast packets

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

[Micronet] Network Statistics, reduce number of Broadcast/Multicast packets

Andrew Ring
Hello Micronetters,

According to the network router statics pages
(http://fragment1.berkeley.edu/~cricket/), one of my labs has a high
amount of "Broadcast/Multicast Packets/Second" traffic.

I am having difficulty discerning how concerned I should be and what
complications to expect from a large amount of this traffic.  I am
certain that the lion's share is garbage.  How important is it to reduce
this traffic?

Thoughts?

Thank you,
Andrew

 
-------------------------------------------------------------------------
The following was automatically added to this message by the list server:

To learn more about Micronet, including how to subscribe to or unsubscribe from its mailing list and how to find out about upcoming meetings, please visit the Micronet Web site:

http://micronet.berkeley.edu

Messages you send to this mailing list are public and world-viewable, and the list's archives can be browsed and searched on the Internet.  This means these messages can be viewed by (among others) your bosses, prospective employers, and people who have known you in the past.
Reply | Threaded
Open this post in threaded view
|

Re: [Micronet] Network Statistics, reduce number of Broadcast/Multicast packets

Erik Klavon
On Tue, Jan 18, 2011 at 12:56:30PM -0800, Andrew Ring wrote:
> According to the network router statics pages
> (http://fragment1.berkeley.edu/~cricket/), one of my labs has a high
> amount of "Broadcast/Multicast Packets/Second" traffic.

How much is "high"?

> I am having difficulty discerning how concerned I should be and what
> complications to expect from a large amount of this traffic.  I am
> certain that the lion's share is garbage.  How important is it to reduce
> this traffic?

How do you know it is garbage? Is the traffic causing a problem?

Erik

 
-------------------------------------------------------------------------
The following was automatically added to this message by the list server:

To learn more about Micronet, including how to subscribe to or unsubscribe from its mailing list and how to find out about upcoming meetings, please visit the Micronet Web site:

http://micronet.berkeley.edu

Messages you send to this mailing list are public and world-viewable, and the list's archives can be browsed and searched on the Internet.  This means these messages can be viewed by (among others) your bosses, prospective employers, and people who have known you in the past.
Reply | Threaded
Open this post in threaded view
|

Re: [Micronet] Network Statistics, reduce number of Broadcast/Multicast packets

Andrew Ring


On 1/18/11 1:00 PM, Erik Klavon wrote:
> On Tue, Jan 18, 2011 at 12:56:30PM -0800, Andrew Ring wrote:
>> According to the network router statics pages
>> (http://fragment1.berkeley.edu/~cricket/), one of my labs has a high
>> amount of "Broadcast/Multicast Packets/Second" traffic.
>
> How much is "high"?
High around 700 m Packets In per second.
>
>> I am having difficulty discerning how concerned I should be and what
>> complications to expect from a large amount of this traffic.  I am
>> certain that the lion's share is garbage.  How important is it to reduce
>> this traffic?
>
> How do you know it is garbage? Is the traffic causing a problem?
I am guessing that it is garbage really.  I don't know that I am running
anything that has reason to receive so much traffic.

I don't know that it is causing issues, but I don't know that it is not.
  That is unfortunately one of the areas I would need some guidance on.
>
> Erik

Thank you,
Andrew

 
-------------------------------------------------------------------------
The following was automatically added to this message by the list server:

To learn more about Micronet, including how to subscribe to or unsubscribe from its mailing list and how to find out about upcoming meetings, please visit the Micronet Web site:

http://micronet.berkeley.edu

Messages you send to this mailing list are public and world-viewable, and the list's archives can be browsed and searched on the Internet.  This means these messages can be viewed by (among others) your bosses, prospective employers, and people who have known you in the past.
Reply | Threaded
Open this post in threaded view
|

Re: [Micronet] Network Statistics, reduce number of Broadcast/Multicast packets

Erik Klavon
On Tue, Jan 18, 2011 at 01:04:56PM -0800, Andrew Ring wrote:
> On 1/18/11 1:00 PM, Erik Klavon wrote:
> >On Tue, Jan 18, 2011 at 12:56:30PM -0800, Andrew Ring wrote:
> > > According to the network router statics pages
> > > (http://fragment1.berkeley.edu/~cricket/), one of my labs has a high
> > > amount of "Broadcast/Multicast Packets/Second" traffic.
> >
> > How much is "high"?
>
> High around 700 m Packets In per second.

Cricket uses SI[1] symbology[2] in its graphs, so m is mili, 10^-3, as
opposed to mega or M, 10^6. Our instance of Cricket is configured to
poll interfaces every five minutes; the value shown is the difference
in packet count from the last measurement to the current one divided
by the polling interval; this averaging gives rise to the fractional
rate. (Assuming the Cricket polling interval were 1 second, under what
circumstances would only .7 of a packet be transmitted in a second?)

> > > I am having difficulty discerning how concerned I should be and what
> > > complications to expect from a large amount of this traffic.  I am
> > > certain that the lion's share is garbage.  How important is it to reduce
> > > this traffic?
> >
> > How do you know it is garbage? Is the traffic causing a problem?
>
> I am guessing that it is garbage really.  I don't know that I am running
> anything that has reason to receive so much traffic.
>
> I don't know that it is causing issues, but I don't know that it is not.
> That is unfortunately one of the areas I would need some guidance on.

IPv4 relies on ARP, which broadcasts queries and responses. ARP by
itself will account for some broadcast traffic on any IPv4
subnet. IPv6 uses multicast for several different addressing
functions, and is enabled on many operating systems by default. Some
legacy protocols (NetBIOS comes to mind) also make use of broadcast
traffic.

I wouldn't worry much about 700 m pps. If you're curious, you can use
tools like tcpdump or wireshark to look at the broadcast traffic on
your network.

Erik

[1] http://lamar.colostate.edu/~hillger/
[2] http://www.simetric.co.uk/siprefix.htm

 
-------------------------------------------------------------------------
The following was automatically added to this message by the list server:

To learn more about Micronet, including how to subscribe to or unsubscribe from its mailing list and how to find out about upcoming meetings, please visit the Micronet Web site:

http://micronet.berkeley.edu

Messages you send to this mailing list are public and world-viewable, and the list's archives can be browsed and searched on the Internet.  This means these messages can be viewed by (among others) your bosses, prospective employers, and people who have known you in the past.
Reply | Threaded
Open this post in threaded view
|

Re: [Micronet] Network Statistics, reduce number of Broadcast/Multicast packets

Andrew Ring
Thank you, that clears up a lot.

On 1/18/11 3:46 PM, Erik Klavon wrote:

> On Tue, Jan 18, 2011 at 01:04:56PM -0800, Andrew Ring wrote:
>> On 1/18/11 1:00 PM, Erik Klavon wrote:
>>> On Tue, Jan 18, 2011 at 12:56:30PM -0800, Andrew Ring wrote:
>>>> According to the network router statics pages
>>>> (http://fragment1.berkeley.edu/~cricket/), one of my labs has a high
>>>> amount of "Broadcast/Multicast Packets/Second" traffic.
>>>
>>> How much is "high"?
>>
>> High around 700 m Packets In per second.
>
> Cricket uses SI[1] symbology[2] in its graphs, so m is mili, 10^-3, as
> opposed to mega or M, 10^6. Our instance of Cricket is configured to
> poll interfaces every five minutes; the value shown is the difference
> in packet count from the last measurement to the current one divided
> by the polling interval; this averaging gives rise to the fractional
> rate. (Assuming the Cricket polling interval were 1 second, under what
> circumstances would only .7 of a packet be transmitted in a second?)
>
>>>> I am having difficulty discerning how concerned I should be and what
>>>> complications to expect from a large amount of this traffic.  I am
>>>> certain that the lion's share is garbage.  How important is it to reduce
>>>> this traffic?
>>>
>>> How do you know it is garbage? Is the traffic causing a problem?
>>
>> I am guessing that it is garbage really.  I don't know that I am running
>> anything that has reason to receive so much traffic.
>>
>> I don't know that it is causing issues, but I don't know that it is not.
>> That is unfortunately one of the areas I would need some guidance on.
>
> IPv4 relies on ARP, which broadcasts queries and responses. ARP by
> itself will account for some broadcast traffic on any IPv4
> subnet. IPv6 uses multicast for several different addressing
> functions, and is enabled on many operating systems by default. Some
> legacy protocols (NetBIOS comes to mind) also make use of broadcast
> traffic.
>
> I wouldn't worry much about 700 m pps. If you're curious, you can use
> tools like tcpdump or wireshark to look at the broadcast traffic on
> your network.
>
> Erik
>
> [1] http://lamar.colostate.edu/~hillger/
> [2] http://www.simetric.co.uk/siprefix.htm

 
-------------------------------------------------------------------------
The following was automatically added to this message by the list server:

To learn more about Micronet, including how to subscribe to or unsubscribe from its mailing list and how to find out about upcoming meetings, please visit the Micronet Web site:

http://micronet.berkeley.edu

Messages you send to this mailing list are public and world-viewable, and the list's archives can be browsed and searched on the Internet.  This means these messages can be viewed by (among others) your bosses, prospective employers, and people who have known you in the past.