Subject: Re: [ipfix] ipfix vs. RMON

From: "Christopher R. Cook" <[email-masked]>
Date: Thu, 04 Apr 2002 12:07:07 -0500

RMON / RMON2 and SNMP in general were never designed to handle the 
incredible data volumes that will need to be transferred. IPFIX rides on to 
of TCP, more reliable however less efficient that UDP, but reliability is 
the key. The efficiencies (I hope) are being build in to IPFIX 
implementation...  as both ( reliability & efficiency )   are required...

Thoughts ?

Cheers..
.
At 11:17 AM 4/4/2002 -0500, [email-masked] wrote:
>Hi,
>
>I was asked about what the differences between IPFIX and RMON (also 
>defined at IETF) are. In particular, what IPFIX can do that RMON cannot do?
>
>My two cents are that IPFIX runs on top of reliable TCP, hence allows 
>exporting large chunk of data. Whereas RMON runs on top of UDP, not 
>efficient for large amount of data transporting. I may have missed the 
>main points. So any comments are appreciated.
>
>Best regards
>Man Li
>
>
>--
>Help        mailto:[email-masked] and say "help" in message body
>Unsubscribe mailto:[email-masked] and say
>"unsubscribe ipfix" in message body
>Archive     http://ipfix.doit.wisc.edu/archive/

Christopher R. Cook
Director of Product Management			Voice (781) 359-5055
Quarry Technologies			
8 New England Executive Park
Burlington MA, 01803

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Peter Ludemann" <[email-masked]>
Date: Thu, 4 Apr 2002 10:19:01 -0800

Does anybody have any figures to back up the statement that "TCP is less
efficient than UDP" when working on a LAN, with no packet loss, duplication,
or reordering? [Or even working over a WAN; because a UDP-based system would
also need to do retransmission and congestion handling.] NFS-3 seems to
indicate that there is no significant loss in efficiency.

If there is a significant efficiency issue, we should note it. If there is
no significant efficiency issue, we should put the matter to rest. [I did
look at Ganesh's presentation
http://ipfix.doit.wisc.edu/IETF52/1_ipfix-export-using-tcp.ppt; but it
wasn't clear to me how much was due to the particular way that TCP was
implemented on his system - there seemed to be more copies than needed, for
example and I didn't see a comparison with UDP, and it wasn't clear to me
whether this was a theoretical calculation or actual measurements.]

There might be inefficiencies in particular TCP stacks, although that can be
minimised by techniques such as scatter/gather write (an option in the
Berkeley socket library).

[I don't have any figures beyond what I found posted
http://ipfix.doit.wisc.edu/archive/0823.html; but I can tell you that at
1000 rec/sec (25 fields, about 100 bytes total), I can barely measure the
CPU (user/system/kernel) on a Solaris system (in burst tests, without any
special tuning, we've done much faster - and this is without attempting to
minimise data copying (either in queuing up the records or in calling the
send() routine ... we have an implementation that avoids data copy but we're
not currently using it in our test systems because its API is more complex
and there doesn't seem to be a need for our current applications). I'd like
to have more precise numbers, but that would require a more sophisticated
measurement system, possibly using a real-time system, and unfortunately I
don't have time to investigate further at the moment.]

Peter Ludemann            +1.408.330.5732
Chief Architect           +1.650.248.3973 (mobile)
XACCT Technologies        [email-masked]
2900 Lakeside Drive       http://www.xacct.com
Santa Clara CA 95054

> -----Original Message-----
> From: majordomo listserver [mailto:[email-masked]]On Behalf
> Of Christopher R. Cook
> Sent: Thursday, April 04, 2002 9:07 AM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: Re: [ipfix] ipfix vs. RMON
>
>