booloo@lll-crg.llnl.gov (Mark Boolootian) (10/27/90)
Does anyone have any information (or can you point me at some) regarding the number of expected ethernet collisions given some network utilization. I can well imagine one needs to consider (the distribution of) frame size and access patterns. I'm interested in knowing when the number of collisions occuring is excessive. Any info is appreciated. Thanks. mb booloo@lll-crg.llnl.gov
cmaeda@EXXON-VALDEZ.FT.CS.CMU.EDU (Christopher Maeda) (10/27/90)
Roy Maxion did a paper on this in the last Fault Tolerant Computing Conference (FTCS-20). Basically, he keeps a vector of expected values for collisions (also load, packet counts, etc) for each monitoring epoch (currently 1 minute). Newly observed data is compared with the expected values and alarms are triggered if the values are not consistent with expectations. Note that the meaning of "consistent with expectations" is a topic of current research. One heuristic is if the number of collisions is 3 stds above the mean. The models are also updated to take new observations into account using a kind of exponential regression Chris ps: Maxion, Roy A., Anomaly Detection for Diagnosis. In 20th International Symposium on Fault-Tolerant Computing (FTCS20), (1990) 20-27.
vjs@rhyolite.wpd.sgi.com (Vernon Schryver) (10/28/90)
In article <9010271814.AA17575@ucbvax.Berkeley.EDU>, cmaeda@EXXON-VALDEZ.FT.CS.CMU.EDU (Christopher Maeda) writes: > Roy Maxion did a paper on this in the last Fault Tolerant Computing > Conference (FTCS-20). Basically, he keeps a vector of expected values > for collisions (also load, packet counts, etc) ... This work is interesting for detecting anomalies like suddenly broken hardware, but how do you know if your net is "normally" overloaded? If you have 90% collisions every day between 10 am and 4 pm, the envelope/standard deviation calculation will tell you that everything is just peachy. We've been using a rule of thumb that says if more than 30% of an active station's packets collide, it is time to split the network. That is, does it make sense to say things are bad if the quotient of the "Opkts" and "Coll" columns of netstat are >= .3, provided Opkts>100,000? Ethernets that met this criterion here have been painfully slow. (Yes, rather BSD-network-UNIX oriented. Sorry.) Vernon Schryver, vjs@sgi.com