Many NetFlow Reporting applications claim to tell you who the top 10 bandwidth hogs are by displaying the top 10 or so hosts for a time period based on total amount of traffic sent or received. Yes, this is helpful but it can paint a distorted picture when it comes to network traffic analysis. What about Flow Volume?
“Customers across the country have received letters from Comcast warning them to limit their bandwidth consumption or face a one-year termination of service. “
Source: The New York Times
I think that it is safe to say that all sFlow and NetFlow analyzers display a top hosts report. Unfortunately, this is just the beginning when trying to diagnose a congestion issue. Often times we need to drill in further for details on the behavior of the hog to gain a more accurate picture of the problem. Below is a Top Hosts listing the total bytes transmitted per host for the time frame but, it doesn’t tell us how many flows (i.e. virtual circuits) each created. Should you care?
Benoit Felton of the Yankee Group said “Unfortunately, to the best of our knowledge, the way that telcos identify the Bandwidth Hogs is not by monitoring if they cause unfair traffic congestion for other users. No, they just measure the total data downloaded per user, list the top 5% and call them hogs.”
Benoit Felton
Some applications BitTorrent are more aggressive than traditional practices such as FTP when it comes to downloading files. I think Richard Bennett of the Information Technology and Innovation Foundation in Washington, DC explained it well:
“…… while TCP may be fair across all TCP virtual circuits, it doesn’t ensure fairness across all users of the network. This is because some users and some applications employ more TCP virtual circuits than others. This is particularly bothersome when users are running applications such as BitTorrent. In a typical scenario, BitTorrent uses 20-40 TCP virtual circuits at a time for each download in progress. TCP fairness ensures that each of these 20-40 VCs has a “fair” chunk of bandwidth, but it does nothing about the fact that the BitTorrent user is grabbing 20-40 times the bandwidth as the ftp user, who is only downloading on 1 VC.”
A report on Flow Volume is necessary to determine who is creating the most flows or the flow volume created by each of the top hosts.
How are you identifying top bandwidth hogs? If you are undecided, check out Scrutinizer for its best at NetFlow reporting which includes volume of flows per host!.
