[9898] in North American Network Operators' Group
Re: A question of stats..
daemon@ATHENA.MIT.EDU (Daniel Senie)
Sun Jun 8 12:09:06 1997
Date: Sun, 08 Jun 1997 11:52:56 -0400
To: Brian Horvitz <horvitz@websecure.net>, nanog@merit.edu
From: Daniel Senie <dts@openroute.com>
In-Reply-To: <Pine.GSO.3.95.970608090208.18031A-100000@sp02.websecure.ne
t>
At 09:07 AM 6/8/97 -0400, Brian Horvitz wrote:
>Here is something which has been troubling my mind lately.
>The basic question is, how do I turn an in and an out into
>an aggregate? Here is a scenario: I measure usage on a
>customer's T1 at my router port. Every 5 minutes a sample
>the port and figure the average bps both in and out for the
>last five minutes. Now, I want to make a number that
>represents the aggregate usage across that port but, I cannot
>simply add the two ins and outs (as I am doing now) because
>they were both averages over a period of time. Doing this
>produces some strange effects which can show nice trends but
>also lies about the real usage. Perhaps I simply lack the
>math experience to do this correctly but I can't see a good
>way to do it.
If you're doing this for accounting (i.e. money collection) purposes, I see
a cause for customers to be very alarmed. I've seen a lot of attacks lately
that were ping floods or other such traffic, frequently originating from
RFC1918 addresses. I know if my upstream charged by the packet, I'd be all
over them to deduct from my bill EVERY packet I'm not interested in. Could
cause providers a lot of trouble.
Even charging for packets a site transmits is potentially at risk in such
cases, if the systems send back ICMP unreachables or other rejection packets.
Dan
>
> Brian Horvitz
> WebSecure, Inc.
>
>
>
Daniel Senie mailto:dts@openroute.com
Sr. Staff Engineer http://www.openroute.com/
OpenROUTE Networks, Inc. (a wholly owned subsidiary of
Proteon, Inc.)
