From: Neil Spring (nspring@cs.washington.edu)
Date: Sat Jan 20 2001 - 12:16:57 PST
> o Whether you think 90 second snapshots are sufficient (do you need
> longer traces) ?
I think I would want longer traces. If I wanted to look
at flow length (time, number of bytes), 90 seconds seems
too short. I'm not sure if increasing the duration of the
snapshot while fixing the size by sampling only certain
IP address pairs (eg. those packets with a source ending
in .14 and a destination ending in .33) would address
this problem. Even if it would, do you have the cycles
to burn on matching packet information?
> o Whether 8 samples per day are appropriate (would you rather have
> less samples per day, only a few days per week, only one week out
> of a month, ...) ?
Fewer, longer traces would seem fine to me. I don't really
care about daily usage patterns: only enough samples to
convince me that what I saw was not an effect of being
run at 5am would be sufficient.
> o How do you select trace files (by trace size, preference for particular
> sites, alternating, historical, ...) ?
I seek trace files that give me as clear a picture as
possible of the traffic over a particular link. This might
mean that I want a choke point - say the access link of a
university where I could expect to correlate transmissions
and acknowledgements. It might mean that I want to see
every packet in a flow. (In the past, it has even meant
that I want to saee packet contents; I know that's not
being attempted here).
> o Whether you are interested in historic data (shall we delete most
> of the trace data online, rather than tape archiving everything) ?
I am interested in historic data... assuming I can get the
sort of pictures I want (rather than summary statistics
about the size distribution of packets, for example).
However, one or two traces per month for as long as
possible would seem sufficient.
> o Would you like to see correlated traces from multiple monitors
> (including time syncronization) ?
I'm not sure what I would use these for.
> o How do you find the WWW interface to traces ? (we see a lot of
> aborted downloads, would you prefer a different medium, would
> you prefer ftp with reget option)
Is this the thing behind the form that says 'all fields
are optional' then complains that "name is bad e-mail is bad"
when you don't fill those in?
http://moat.nlanr.net/PMA/pmaform.html
or the Datacube that seems to return old data that I don't
know how to interpret? I haven't been able to make any
use of that interface.
> o What kind of documentation/graphs would you like to see along the
> raw traces ?
I don't know, but the thought of having automatically
generated graphs for the raw traces is interesting.
You wouldn't be able to automatically generate some of the
graphs from http://www.caida.org/outreach/papers/Inet98/?
Not serious, just a wish-list item. I'm curious how figure
8 changes over time.
-neil
This archive was generated by hypermail 2b30 : Thu Sep 27 2001 - 16:24:41 PDT