CERN

(diagram from CINBAD RAID 2009 poster)

The CINBAD (CERN Investigation of Network Behavior and Anomaly Detection) project applies sFlow monitoring to the CERN IT infrastructure, "Even in CERN 'academic' environment, we can not afford network downtimes, especially when LHC starts to produce peta bytes of data."

Note: A previous posting looked at the use of sFlow within the Large Hadron Collider (LHC) to monitor the high speed Ethernet switches that form the control and data collection components the LHCb experiment.

The white paper, CINBAD keeps an eye on the CERN network, describes the CERN network, "CERN's campus network has more than 50,000 active user devices interconnected by 10,000 km of cables and fibres, with more than 2500 switches and routers. The potential 4.8 Tbps throughput within the network core and 140 Gbps connectivity to external networks offers countless possibilities to different network applications."

The paper goes on to describes the challenge of monitoring the CERN network, "To acquire knowledge about the network status and behaviour, CINBAD collects and analyses data from numerous sources. A naive approach might be to look at all of the packets flying over the CERN network. However, if we did this we would need to analyse even more data than the LHC could generate. The LHC data are only a subset of the total data crossing via these links."

Finally, the paper describes CERN's chosen solution "CINBAD overcomes this issue by applying statistical analysis and using sFlow, a technology for monitoring high-speed switched networks that provides randomly sampled packets from the network traffic."

While few organizations currently face the challenges of managing a network as large and complex as CERN's, many have plans to expand data centers, deploy converged networks, virtualization and cloud-based computing. Selecting network equipment that supports the sFlow standard delivers the scalable visibility and control needed to manage growth as new services are deployed.