The HP Network Node Manager iSPI Performance for Traffic Software (NNM iSPI for Traffic) analyzes IP traffic flows exported by network management devices to provide performance monitoring management functions such as traffic classification and capacity planning. Therefore, it is imperative that your flow analysis solution be stable, high performing, and scalable to handle the capabilities of this demanding network management.
The exponential growth in the volume of data passing through today’s networks results in an ever-increasing number of exported traffic flows to NNM iSPI for Traffic. The supporting of higher scale on NNM iSPI for Traffic depends on several factors:
NNM iSPI for Traffic can scale only if the hardware size of the servers is increased according the incoming higher level of traffic flows, this requires planning and cost to the existing setup. It is still possible for NNM iSPI for Traffic to scale without distributing the existing deployment by configuring sampling. Sampling has a direct impact on the NNM iSPI for Traffic ability to process the incoming flows towards Leaf collectors.
Sampling is a solution to be used when flow analytics has to be done on a device or on Leaf. Sampling defines that instead of every packet, one out of N packets (where N is the sampling rate) is captured and sent to traffic analytics. Based on the information in one packet, the traffic pattern for the rest of the packets is constructed.
Sampling is very useful for capacity planning or network planning when every flow may not be needed to understand the network behavior.
NNM iSPI for Traffic supports the following sampling of flows.
Device Flow sampling
NNM iSPI sampling
Device Flow sampling
Sampled Flow allows you to collect Flow statistics for a subset of incoming (ingress) traffic on an interface. Sampled Flow significantly reduces CPU utilization on a router, reduces export volume but still allows a view of most of the IP flows switching in the device.
Sampling at the router level results in less flow records being exported by the router. This results in reduced processing load on the collector. Now it is possible for the SPI to support flow monitoring of bigger networks with very high volumes of data.
Types of Sampling supported on various types of Flows (Netflow, Sflow)
Deterministic sampling: Deterministic sampling will select every Nth packets, with N specified by the user.
Time-based sampling: Time-based sampling will select a sampled packet every N milli-seconds.
Random sampling: Random sampling will randomly select one out of N packets with N specified by the user. Random sampling is considered the best technique for packet sampling.
How to enable: For more details on configuring sampling at the router level, refer to corresponding device documentation.
Leaf Collector sampling: This type of sampling is applied on the collection engine (Leaf in the NNM iSPI for Traffic) and works by sampling flow records from exported datagrams (exported packets) received from the router. An export datagram packet may contain up to 30 flow records for version 5 or 9 flow export.
Once the NNM iSPI for Traffic detects the flow record for sampling, the algorithm samples a flow record and it processes all the subsequent flow records corresponding to the same IP flow. As a result of this capability, NNMi SPI for Traffic Sampling is much better with level of accuracy in terms of bytes, packets, and flows information compared with Device Flow sampling. Thus, it produces better estimates of network traffic without involving any extrapolation.
Leaf sampling can be configured in two sampling modes.
Random Sampling: It samples one out of every N sequential flow records.
Top Flow Record Sampling: It samples a flow record (from N sequential flow records) that has maximum value of bytes in it. This mode caters to specific use cases where the operator is interested in capturing flow records with high volume (more bytes). Such high volume flow records may remain non-sampled with Random sampling as it randomly picks a flow record irrespective of its volume (byte value).
How to enable sampling on NNM iSPI for Traffic
The NNM iSPI for Traffic allows admins to achieve the processing of higher scale flows by configuring Leaf Sampling through a configuration page that accepts sampling rate and sampling mode inputs. Performance and scale numbers on the Leaf is directly proportional to sampling rate. For better accuracy, it is recommended that sampling rate is entered between 2 to 10.