Monday, April 2, 2018

Flow smoothing

The sFlow-RT real-time analytics engine includes statistical smoothing. The chart above illustrates the effect of different levels of smoothing when analyzing real-time sFlow telemetry.

The traffic generator in this example creates an alternating pattern: 1.25Mbytes/second for 30 seconds followed by a pause of 30 seconds. Smoothing time constants between 1 second and 500 seconds have been applied to generate the family of charts. The blue line is the result of 1 second smoothing and closely tracks the traffic pattern. At the other extreme, the dark red line is the result of 500 second smoothing, showing a constant 625Kbytes/second (the average of the waveform).

There is a tradeoff between responsiveness and variability (noise) when selecting the level of smoothing. Selecting a suitable smoothing level depends on the flow analytics application.

Low smoothing values are appropriate when fast response is required, for example:
Higher smoothing values are appropriate when less variability is desirable, for example:

Generating the chart

The results described in this article are easily reproduced using the testbed described in Mininet flow analytics.

The following, smooting.js, script defines a set of flows with different smoothing periods:
var times = [1,2,5,10,20,50,100,200,500];
for(var i = 0; i < times.length; i++) {
Start sFlow-RT:
env RTPROP=-Dscript.file=smoothing.js ./
Start Mininet:
sudo mn --custom extras/ --link tc,bw=10
Type the following Mininet command to open terminals on simulated hosts, h1 and h2:
mininet> xterm h1 h2
In h2 terminal window:
iperf -s
In h1 terminal window:
while true; do iperf -c -t 30; sleep 30; done
Plot the chart by opening the sFlow-RT URL:
See Writing Applications for more information.

No comments:

Post a Comment