Re: BitTorrent is 35% of traffic ?

[Marshall Eubanks]

Hello;


On Fri, 5 Nov 2004 00:57:17 -0500
 Patrick W Gilmore <[EMAIL PROTECTED]> wrote:
> 
> On Nov 5, 2004, at 12:45 AM, Petri Helenius wrote:
> 
> > Netflow is based on port numbers and many run bittorrent on fairly 
> > random ports. Look at the 30%+ unidentified on the report.
> 
> Yes, but HTTP tends to run on the same port, and it only made 15.76% of 
> bits and 18.53% of the packets.
> 
> I know P2P is "big", but is HTTP really only 16% of the bits on the 
> 'Net?
> 
> Question is: Is this data representative of "Internet 1"?  I'm thinking 
> not, since "Iperf" was more bits than HTTP.
> 

The fascinating thing with the time history of these data is that Napster used to
dominate. Then it was killed and the "unknown" category steadily grew to replace it.

The rise of Iperf is recent and seems silly. What, of course, is not clear is what 
fraction
of capacity it represents - maybe it is a small faction of what could be used.

I thought that BitTorrent (due to its shared use of bandwidth) would use well known 
ports, but
if not then it is clearly part of the "unknown." One wonders how Reuters and company 
could measure
it, but here is a back of the envelope guess.

BitTorrent is just under 50% of the _known_ P2P traffic. Assume that it is also 50%
of the _unknown_ P2P traffic. That gives it a known fraction of the total traffic of
4.94 % (measured) and 15% (guesstimated), or about 20%, which is larger than http.

So, its plausible that BT traffic is > http traffic, but I wouldn't want to further 
than that.

Yes, I would assume that P2P is a substantial fraction of I1 traffic. It certainly 
goes on at work.

Regards
Marshall 

> -- 
> TTFN,
> patrick
> 

Re: BitTorrent is 35% of traffic ?

[Patrick W Gilmore]

On Nov 5, 2004, at 12:45 AM, Petri Helenius wrote:
Netflow is based on port numbers and many run bittorrent on fairly 
random ports. Look at the 30%+ unidentified on the report.
Yes, but HTTP tends to run on the same port, and it only made 15.76% of 
bits and 18.53% of the packets.

I know P2P is "big", but is HTTP really only 16% of the bits on the 
'Net?

Question is: Is this data representative of "Internet 1"?  I'm thinking 
not, since "Iperf" was more bits than HTTP.

--
TTFN,
patrick

Re: BitTorrent is 35% of traffic ?

[Petri Helenius]

Marshall Eubanks wrote:
Reality check
This week's netflow for the Internet 2
 

Netflow is based on port numbers and many run bittorrent on fairly 
random ports. Look at the 30%+ unidentified on the report.

Pete
http://netflow.internet2.edu/weekly/20041025/
has BitTorrent taking up about 4.8 % of the traffic, http is 15 to 18%, and all
file sharing is about 10%, down from 50% 2 years ago.
Since file sharing and related uses are generally heavy traffic sources on I2, I would conclude
that the Reuter's numbers are too high. 

regards
Marshall Eubanks
On Fri, 5 Nov 2004 08:59:42 +0900
Tony Li <[EMAIL PROTECTED]> wrote:
 

For those not familiar, BitTorrent is a file sharing app that is 
commonly
used for exchanging full movies.  As such, folks are moving gigabyte
files regularly and it's not surprising that this is detectable.
Shuffling .mp3's around would be trivial by comparison.

Tony
On Nov 5, 2004, at 6:34 AM, Christopher L. Morrow wrote:
   

On Thu, 4 Nov 2004, Deepak Jain wrote:
 

http://in.tech.yahoo.com/041103/137/2ho4i.html
According to Reuters, BT is more traffic than web/other forms of
traffic? I'm thinking the sampling methodology here might be a little
skewed.
   

1) where was the measurement done?
2) how was the measurement done?
3) what population was sampled?
On some networks BT might account for far more than 30%, on others far,
far less... Perhaps the writers will answer?
-Chris
 

 

Re: BitTorrent is 35% of traffic ?

[Matthew S. Hallacy]

On Fri, Nov 05, 2004 at 08:59:42AM +0900, Tony Li wrote:
> 
> 
> For those not familiar, BitTorrent is a file sharing app that is 
> commonly
> used for exchanging full movies.  As such, folks are moving gigabyte
> files regularly and it's not surprising that this is detectable.
> Shuffling .mp3's around would be trivial by comparison.
> 
> Tony

It's also used for distributing large patches (XP SP2), the latest
ISO's of various (free) operating systems, any pretty much anything else
that would create a flash crowd load on a system that it could not handle
without distributing the traffic amoung the people downloading. 

This isn't a made-for-pirating-software/audio program, don't treat it as
such. 

-- 
Matthew S. HallacyFUBAR, LART, BOFH Certified
http://www.poptix.net   GPG public key 0x01938203

Re: BitTorrent is 35% of traffic ?

[Marshall Eubanks]

Reality check

This week's netflow for the Internet 2
 
http://netflow.internet2.edu/weekly/20041025/

has BitTorrent taking up about 4.8 % of the traffic, http is 15 to 18%, and all
file sharing is about 10%, down from 50% 2 years ago.

Since file sharing and related uses are generally heavy traffic sources on I2, I would 
conclude
that the Reuter's numbers are too high. 

regards
Marshall Eubanks


On Fri, 5 Nov 2004 08:59:42 +0900
 Tony Li <[EMAIL PROTECTED]> wrote:
> 
> 
> For those not familiar, BitTorrent is a file sharing app that is 
> commonly
> used for exchanging full movies.  As such, folks are moving gigabyte
> files regularly and it's not surprising that this is detectable.
> Shuffling .mp3's around would be trivial by comparison.
> 
> Tony
> 
> 
> On Nov 5, 2004, at 6:34 AM, Christopher L. Morrow wrote:
> 
> >
> >
> > On Thu, 4 Nov 2004, Deepak Jain wrote:
> >
> >>
> >>
> >> http://in.tech.yahoo.com/041103/137/2ho4i.html
> >>
> >> According to Reuters, BT is more traffic than web/other forms of
> >> traffic? I'm thinking the sampling methodology here might be a little
> >> skewed.
> >
> > 1) where was the measurement done?
> > 2) how was the measurement done?
> > 3) what population was sampled?
> >
> > On some networks BT might account for far more than 30%, on others far,
> > far less... Perhaps the writers will answer?
> >
> > -Chris
> >
> 

Sago Networks

[Hannigan, Martin]

Can someone from Sago please contact me regarding a problem
with a customer?

Thanks,

-M



--
Martin Hannigan (c) 617-388-2663
VeriSign, Inc.  (w) 703-948-7018
Network Engineer IV   Operations & Infrastructure
[EMAIL PROTECTED]

Re: BitTorrent is 35% of traffic ?

[Tony Li]

For those not familiar, BitTorrent is a file sharing app that is 
commonly
used for exchanging full movies.  As such, folks are moving gigabyte
files regularly and it's not surprising that this is detectable.
Shuffling .mp3's around would be trivial by comparison.

Tony
On Nov 5, 2004, at 6:34 AM, Christopher L. Morrow wrote:

On Thu, 4 Nov 2004, Deepak Jain wrote:

http://in.tech.yahoo.com/041103/137/2ho4i.html
According to Reuters, BT is more traffic than web/other forms of
traffic? I'm thinking the sampling methodology here might be a little
skewed.
1) where was the measurement done?
2) how was the measurement done?
3) what population was sampled?
On some networks BT might account for far more than 30%, on others far,
far less... Perhaps the writers will answer?
-Chris

can someone from Savvis and Radianz contact me?

[David Meyer]

I'm looking for some multicast information.

Thanks,

Dave

Re: BitTorrent is 35% of traffic ?

[Christopher L. Morrow]

On Thu, 4 Nov 2004, Deepak Jain wrote:

>
>
> http://in.tech.yahoo.com/041103/137/2ho4i.html
>
> According to Reuters, BT is more traffic than web/other forms of
> traffic? I'm thinking the sampling methodology here might be a little
> skewed.

1) where was the measurement done?
2) how was the measurement done?
3) what population was sampled?

On some networks BT might account for far more than 30%, on others far,
far less... Perhaps the writers will answer?

-Chris

BitTorrent is 35% of traffic ?

[Deepak Jain]

http://in.tech.yahoo.com/041103/137/2ho4i.html
According to Reuters, BT is more traffic than web/other forms of 
traffic? I'm thinking the sampling methodology here might be a little 
skewed.

Then again, I could be biased. Any other facts that would support this?
DJ

RE: Network Monitoring System - Recommendations?

[Charlie Khanna - NextWeb]

Title: Re: Network Monitoring System - Recommendations?








We actually use it now and its fine for
what it does – however, I don’t think it provides a real integrated
solution.

 

-Charlie

 









From: Erik Amundson
[mailto:[EMAIL PROTECTED] 
Sent: Thursday, November 04, 2004
11:21 AM
To: Richard J. Sears; Charlie
Khanna - NextWeb
Cc: [EMAIL PROTECTED]
Subject: RE: Network Monitoring
System - Recommendations?



 





Not a lot of people seem to be using it,
but at my organization, we just love WhatsUp Gold by IPSwitch.





 





We first started using it about 4 years ago, when it was a
very simple product that pretty much just did SNMP and ping-polling.  Now,
it's a much more advanced system that can do loads of things...





 





Check it outwww.ipswitch.com





 





- Erik







 







From:
[EMAIL PROTECTED] on behalf of Richard J. Sears
Sent: Thu 11/4/2004 9:11 AM
To: Charlie Khanna - NextWeb
Cc: [EMAIL PROTECTED]
Subject: Re: Network Monitoring
System - Recommendations?





 

Hi Charlie -

We use JFFNMS here (http://www.jffnms.org/).

We have it monitoring BGP with our 6 backbone providers, all of our T1's
(300 or so), DSL lines, dedicated servers, backing up all of our router
configs, talking to our F5s, pretty much everything you are asking for.
We use it extensively to grab traps and notify my NOC of any problems.
Overall I would say that it is monitoring over 15,000 connections and
pieces of hardware.

We have its bandwidth monitoring and tracking talking directly to our
billing engine and allow our customers the ability to log into it and
view all of their stats as well.

We don't use it to monitor uptime as we utilize different hardware for
that but my guess is that with some minor tweaking it could do that as
well.

Hope this helps.

On Thu, 28 Oct 2004 00:01:42 -0700
"Charlie Khanna - NextWeb" <[EMAIL PROTECTED]> wrote:

> Hi - I was interested in finding out what software applications other ISPs
> are using for network monitoring?  For example:
>
> 
>
> 1)   Overall network health - uptime
reports
>
> 2)   Backup router config automatically
>
> 3)   Bandwidth reporting (or integration
with an MRTG-type app)
>
> 4)   SNMP trap support (BGP/OSPF session
drops - emails out)
>
> 5)   Database back end (port info into
or over to other apps)
>
> 
>
> I'm just looking for something well rounded for a small ISP.  I've
heard
> about OpenNMS and other apps but I'd like to get everyone's feedback.
> Thanks!
>
> 
>
> -Charlie
>
> 
>


**
Richard J. Sears
Vice President
American Internet
Services 

[EMAIL PROTECTED]
http://www.adnc.com

858.576.4272 - Phone
858.427.2401 - Fax
INOC-DBA - 6130


I fly because it releases my mind
from the tyranny of petty things . .


"Work like you don't need the money, love like you've
never been hurt and dance like you do when nobody's
watching."

Re: OT: looking for a contact at US .mil

[Patrick W Gilmore]

On Nov 4, 2004, at 11:26 AM, Gadi Evron wrote:
It doesn't really bother our network, but hey, this ain't right.
Send back some interesting answers. :)  That might get their attention.
--
TTFN,
patrick

OT: looking for a contact at US .mil

[Gadi Evron]

I realize some may believe this is not of a very high priority, but I
believe it is important. I apologize for going off-topic.
There seems to be a network misconfiguration over at .mil which our
intrusion detection systems caught. We are getting SNMP requests from
them (their network is 147.238.0.0/16 and ours is 147.237.0.0/16. I
suppose somebody probably typed a 7 where they should have typed an 8).
I've done quite a bit to try and contact somebody over there - I even
got somebody to talk to me on the phone in 4 distinct occasions and
considering their whois information is outdated to the extreme - I am
pretty proud.
Yet the traffic continues.
It doesn't really bother our network, but hey, this ain't right.
I tried contacting them through some private contact as well.. but I
figure that somebody over there who *cares* probably should see this
raised flag.
I appreciate your help,
	Gadi Evron.

Re: Low latency forwarding failure detection

[David Barak]

--- John Kristoff <[EMAIL PROTECTED]> wrote:

>   I'm cco-familiar with GLBP.  It appears to have
> essentially the same
>   timing knobs with the ability to actively load
> balance traffic.  Is
>   my assumption that some traffic will not
> experience any packet loss
>   if it is not using the failed path correct?  For
> anyone who has used
>   this, was the added complexity of this protocol
> worth it?

I've used GLBP, and I was pleasantly surprised at how
well it worked.  Certain types of failures were
hitless, and non-hitless failures were still pretty
fast.  I'm not sure if it's fast enough for your
application, but I thought it was great.



=
David Barak
-fully RFC 1925 compliant-



__ 
Do you Yahoo!? 
Check out the new Yahoo! Front Page. 
www.yahoo.com 
 

Re: Low latency forwarding failure detection

[Fergie (Paul Ferguson)]

John,

I'm using GLBP round-robin in a specific scenario with
"ip routing" as the tracking mechanism, and only in this
one specific segment if the network (OSPF elsewhere), with
EIGRP as the routing protocol between R1, R2, R3, and R4:

-+---FE+-
 | |
R1R2
 | |
T3 T3
 | |
R3R4
 | |
 +FE---+-


GLBP works very well here for us based on EIGRP routing
metrics.

There's a very good GLBP config white paper on CCO.

No sure if this answers your question, or not

- ferg


-- John Kristoff <[EMAIL PROTECTED]> wrote:

  I'm cco-familiar with GLBP.  It appears to have essentially the same
  timing knobs with the ability to actively load balance traffic.  Is
  my assumption that some traffic will not experience any packet loss
  if it is not using the failed path correct?  For anyone who has used
  this, was the added complexity of this protocol worth it?

 
--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 [EMAIL PROTECTED] or
 [EMAIL PROTECTED]

Re: Network Monitoring System - Recommendations?

[Richard J. Sears]

Hi Charlie - 

We use JFFNMS here (http://www.jffnms.org/).

We have it monitoring BGP with our 6 backbone providers, all of our T1's
(300 or so), DSL lines, dedicated servers, backing up all of our router
configs, talking to our F5s, pretty much everything you are asking for.
We use it extensively to grab traps and notify my NOC of any problems.
Overall I would say that it is monitoring over 15,000 connections and
pieces of hardware.

We have its bandwidth monitoring and tracking talking directly to our
billing engine and allow our customers the ability to log into it and
view all of their stats as well.

We don't use it to monitor uptime as we utilize different hardware for
that but my guess is that with some minor tweaking it could do that as
well.

Hope this helps.

On Thu, 28 Oct 2004 00:01:42 -0700
"Charlie Khanna - NextWeb" <[EMAIL PROTECTED]> wrote:

> Hi - I was interested in finding out what software applications other ISPs
> are using for network monitoring?  For example:
> 
>  
> 
> 1)   Overall network health - uptime reports
> 
> 2)   Backup router config automatically
> 
> 3)   Bandwidth reporting (or integration with an MRTG-type app)
> 
> 4)   SNMP trap support (BGP/OSPF session drops - emails out)
> 
> 5)   Database back end (port info into or over to other apps)
> 
>  
> 
> I'm just looking for something well rounded for a small ISP.  I've heard
> about OpenNMS and other apps but I'd like to get everyone's feedback.
> Thanks!
> 
>  
> 
> -Charlie
> 
>  
> 


**
Richard J. Sears
Vice President 
American Internet Services  

[EMAIL PROTECTED]
http://www.adnc.com

858.576.4272 - Phone
858.427.2401 - Fax
INOC-DBA - 6130


I fly because it releases my mind 
from the tyranny of petty things . . 


"Work like you don't need the money, love like you've
never been hurt and dance like you do when nobody's
watching."

Low latency forwarding failure detection

[John Kristoff]

Not receiving any response for over a week after posting this query to
cisco-nsp I thought perhaps folks here might have some input.  In my
scenario, Cisco is the likely gear involved, but even if people have
vendor neutral feedback about this I'd be interesting in hearing it.

  From: John Kristoff <[EMAIL PROTECTED]>
  To: [EMAIL PROTECTED]
  Subject: Low latency forwarding failure detection
  Date: Tue, 26 Oct 2004 17:14:57 -0500
  X-Mailer: Sylpheed-Claws 0.9.12 (GTK+ 1.2.10; i686-pc-linux-gnu)

  I've got a situation where something like HSRP seems appropriate for a
  redundant default gateway configuration.  However, this application will
  want very low latency in finding and using the alternative gateway.
  Note, while the hosts have two NICs, they are both on the same subnet
  with one interface the default source and sink as long as it has link.
  I don't get to change this behavior.

  Default HSRP failure detection time however is likely not quick enough
  to bring a standby interface up to get traffic moving again.  I see that
  HSRP provides for hello and hold times in milliseconds.

  I have a few questions for people who may have had a need to get very
  low latency recovery of links and routers.  Have you used HSRP to do
  this?  On a typical local ethernet (gig) LAN configuration, what sorts
  of latencies and packet loss have you seen during a failure event?

  I'm cco-familiar with GLBP.  It appears to have essentially the same
  timing knobs with the ability to actively load balance traffic.  Is
  my assumption that some traffic will not experience any packet loss
  if it is not using the failed path correct?  For anyone who has used
  this, was the added complexity of this protocol worth it?

  As a general question... are people looking at implementing BFD?



  Here I'm draft-familiar with what this is and I believe some vendors
  have code for it, but I've yet to try it.  I believe the spec is held
  up for security and IESG review.  This work looks very useful for some
  related applications going forward.  For this crowd, is this deployable
  and useful for minimizing forwarding failure time?

  This doesn't appear to be on the roadmap for HSRP/GLBP from what I
  can tell, but perhaps that would a worthwhile application of BFD?

  Are there other things people are doing (besides plain old load sharing)
  to get very low latency failover?

John

Re: PathControl vs. Internap(hardware)

[Richard J. Sears]

Hi Dave,

We utilize the 5014 box from Pathcontrol (having been connected to
Internap before that) and it works great.

We have just upgraded to the near latest software rev after waiting
through the .0 and .1 releases.

I can tell you that the box operates like they say it does. We have a
total of 6 backbones, adding another 3 or 4 in the next month and it
does not break a sweat keeping up with all the traffic.

While I liked the Internap model, it shifted greatly from what we were
sold and I had to find a way to keep my customers happy. I needed 
best performance routing and we found out that what we had been
getting was least cost routing. In my case, it was getting the
PathControl box and connecting to a bunch of backbones.

In looking at all the hardware solutions, we looked at NetVMG before
they were acquired by Internap and were not impressed with their product
for a variety of reason.

Hope this helps.




On Thu, 4 Nov 2004 08:03:34 -0500 (EST)
Dave Temkin <[EMAIL PROTECTED]> wrote:

> 
> Has anyone done any comparisons recently?  I know that RouteScience
> changed their model of not providing the hardware anymore, but I was
> overall satisfied with their product when I had it before.  Has anyone
> stacked the Internap (former NetVMG/Sockeye) soft against the
> PathControl software?
> 
> What were your impressions if so?
> 
> Thanks,
> -Dave


**
Richard J. Sears
Vice President 
American Internet Services  

[EMAIL PROTECTED]
http://www.adnc.com

858.576.4272 - Phone
858.427.2401 - Fax
INOC-DBA - 6130


I fly because it releases my mind 
from the tyranny of petty things . . 


"Work like you don't need the money, love like you've
never been hurt and dance like you do when nobody's
watching."

PathControl vs. Internap(hardware)

[Dave Temkin]

Has anyone done any comparisons recently?  I know that RouteScience
changed their model of not providing the hardware anymore, but I was
overall satisfied with their product when I had it before.  Has anyone
stacked the Internap (former NetVMG/Sockeye) soft against the
PathControl software?

What were your impressions if so?

Thanks,
-Dave

Re: Question for WHOIS query

[Andrei Robachevsky]

Dan Lockwood wrote:
Where can a person go to get a "one stop" WHOIS query for AS and prefix
information instead of trying ARIN, then RIPE, etc?
RIPE database mirrors RADB, APNIC, ARIN, VERIO and JPIRR. You may use 
'-a' flag with whois query to search through all the sources.


Thanks,
Dan
Regards,
Andrei Robachevsky
RIPE NCC