On calibrating enterprise switch measurements

The complexity of modern enterprise networks is ever-increasing, and our understanding of these important networks is not keeping pace. Our insight into intra-subnet traffic (staying within a single LAN) is particularly limited, due to the widespread use of Ethernet switches that preclude ready LAN-wide monitoring. We have recently undertaken an approach to obtaining extensive intra-subnet visibility based on tapping sets of Ethernet switch ports simultaneously. However, doing so leads to a number of measurement calibration issues that require careful consideration to address. First, one must correctly account for redundant copies of packets that appear due to switch flooding, which if not accurately identified can greatly skew subsequent analysis results. We show that a simple, natural rule one might use for doing so in fact introduces systematic errors, but an altered version of the rule performs significantly better. We then employ this revised rule to aid with calibration issu...

• Type: Conference
• Year: 2009
• Where: IMC
• Authors: Boris Nechaev, Vern Paxson, Mark Allman, Andrei Gurtov
• Keywords: Calibration Issues, Ethernet Switch Ports, IMC 2009, Internet Technology, Modern Enterprise Networks