Monitoring NetFlow traffic with Weathermap

[tommetje]

Hey all

We have a nice weathermap of our core network displaying the link utilization. We're currently looking at MPLS traffic engineering (TE) to steer traffic away from the heavy-utilized links. I picture this process as follows:

• Monitor the Weathermap on a daily basis.
• When you see one of the links gets too much traffic over longer periods of time, investigate with NetFlow
• Identify the flows you want to steer away from the link.
• Map this flow onto the Weathermap so you can easily see which hops this flow currently is using.
• Configure MPLS-TE to steer the flow to a different links.
• Monitor the weathermap to verify based on NetFlow that the traffic indeed is taking a new path.

Cacti + Weathermap can display the total load of the different links, as it's already doing now in our network. The flowview plugin does not support MPLS labels as a filter to select a flow, so we can't use this plugin. I've been looking at nfdump/nfsen as a method to gather NetFlow data and select flows from it as nfdump does support MPLS labsl (or so I've been told - I did not yet install these tools).

The question then becomes how I can utilize the RRD graphs from nfsen and insert them in a weathermap.

Does anyone has any experience with displaying NetFlow data (based on MPLS labels) in a weathermap?

[Howie]

I haven't actually done this, and it's been a while since I used nfsen, but you should be able to create shadow profiles in nfsen with an appropriate filter, and then use the generated rrd files in weathermap.

You will probably need to specify the DS names, as they're unlikely to be traffic_in and traffic_out. This is done like this:

TARGET that-rrd-file-over-there.rrd:input:output

where input and output are the DS names. If you get them wrong, weathermap will give you an error in the logs that should contain a list of the valid DS names. You can also use the 'rrdtool info' command to get that information.

As for "map this flow onto the weathermap", you probably will need to write some code for that. Some things that might be helpful:

1) You can make sure the link for the MPLS tunnel is overlaid on top of everything else using ZORDER (e.g. ZORDER 9999).

2) You can make a single link pass through a series of nodes using VIA with VIAs specified relative to nodes. For example: you know from your MPLS routers that the tunnel from cust1 to cust1a passes through rtr3, rtr4 and rtr6. You should be able to do this:

Code: Select all

   LINK cust1-MPLS
     NODES cust1 cust1a
     VIA rtr3 0 20
     VIA rtr4 0 20
     VIA rtr6 0 20
    VIASTYLE angled

So that's a single link passing through all the P/PE routers in the path (actually a point 20 pixels below each one, so you can still see the router names), with an angled style so the path should follow the underlying physical links a bit better than curves.

[Howie]

Just curious if you had a chance to play with this? It's an interesting application!