In
computer networks
A computer network is a collection of communicating computers and other devices, such as printers and smart phones. In order to communicate, the computers and devices must be connected by wired media like copper cables, optical fibers, or ...
, network traffic measurement is the process of measuring the amount and type of traffic on a particular network. This is especially important with regard to effective
bandwidth management
Bandwidth management is the process of measuring and controlling the communications (traffic, packets) on a network link, to avoid filling the link to capacity or overfilling the link,https://www.internetsociety.org/wp-content/uploads/2017/08/BWro ...
.
Techniques
Network performance could be measured using either active or passive techniques. Active techniques (e.g.
Iperf
iperf, Iperf, or iPerf, is a tool for network performance measurement and tuning. It is a cross-platform tool that can produce standardized performance measurements for any network. iperf has client and server functionality, and can create d ...
) are more intrusive but are arguably more accurate. Passive techniques have less network overhead and hence can run in the background to be used to trigger network management actions.
Measurement studies
A range of studies have been performed from various points on the Internet. The
AMS-IX (Amsterdam Internet Exchange) is one of the world's largest Internet exchanges. It produces a constant supply of simple Internet statistics. There are also numerous academic studies that have produced a range of measurement studies on frame size distributions, TCP/UDP ratios and TCP/IP options.
Tools
Various software tools are available to measure network traffic. Some tools measure traffic by
sniffing and others use
SNMP
Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. Devices that typically su ...
,
WMI or other local agents to measure bandwidth use on individual machines and routers. However, the latter generally do not detect the type of traffic, nor do they work for machines which are not running the necessary
agent software, such as rogue machines on the network, or machines for which no compatible agent is available. In the latter case, inline appliances are preferred. These would generally 'sit' between the LAN and the LAN's exit point, generally the WAN or Internet router, and all packets leaving and entering the network would go through them. In most cases the appliance would operate as a bridge on the network so that it is undetectable by users.
Some tools used for SNMP monitoring are
Tivoli Netcool/Proviso by
IBM
International Business Machines Corporation (using the trademark IBM), nicknamed Big Blue, is an American Multinational corporation, multinational technology company headquartered in Armonk, New York, and present in over 175 countries. It is ...
, CA Performance Management by
CA Technologies
CA Technologies, Inc., formerly Computer Associates International, Inc., and CA, Inc., was an American multinational corporation, multinational enterprise software developer and publisher that existed from 1976 to 2018. CA grew to rank as one o ...
.,
and
SolarWinds
SolarWinds Corporation is an American company that develops software for businesses to help manage their networks, systems, and information technology infrastructure. It is headquartered in Austin, Texas, with sales and product development offi ...
Functions and features
Measurement tools generally have these functions and features:
* User interface (web, graphical, console)
* Real-time traffic graphs
* Network activity is often reported against pre-configured traffic matching rules to show:
** Local IP address
** Remote IP address
** Port number or protocol
** Logged in user name
* Bandwidth quotas
* Support for
traffic shaping
Traffic shaping is a bandwidth management technique used on computer networks which delays some or all datagrams to bring them into compliance with a desired ''traffic profile''. Traffic shaping is used to optimize or guarantee performance, improv ...
or
rate limiting
In computer networks, rate limiting is used to control the rate of requests sent or received by a network interface controller. It can be used to prevent DoS attacks and limit web scraping.
Research indicates flooding rates for one zombie machin ...
(overlapping with the
network traffic control
In computer networking, network traffic control is the process of managing, controlling or reducing the network traffic, particularly Internet bandwidth, e.g. by the network scheduler.M. Noormohammadpour, C. S. Raghavendra"Datacenter Traffic C ...
page)
* Support website blocking and
content filtering
An Internet filter is software that restricts or controls the content an Internet user is capable to access, especially when utilized to restrict material delivered over the Internet via the Web, Email, or other means. Such restrictions can be appl ...
* Alarms to notify the administrator of excessive usage (by IP address or in total)
See also
*
IP Flow Information Export and
NetFlow
NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine thing ...
*
Measuring network throughput
*
Network management
Network management is the process of administering and managing computer networks. Services provided by this discipline include fault analysis, performance management, provisioning of networks and maintaining quality of service. Network managem ...
*
Network monitoring
Network monitoring is the use of a system that constantly monitors a computer network for slow or failing components and that notifies the network administrator (via email, SMS or other alarms) in case of outages or other trouble. Network monitor ...
*
Network scheduler
A network scheduler, also called packet scheduler, queueing discipline (qdisc) or queueing algorithm, is an arbiter on a node in a packet switching communication network. It manages the sequence of network packets in the transmit and receive ...
*
Network simulation
In computer network research, network simulation is a technique whereby a software program replicates the behavior of a real network. This is achieved by calculating the interactions between the different network entities such as routers, switc ...
*
Packet sniffer
A packet analyzer (also packet sniffer or network analyzer) is a computer program or computer hardware such as a packet capture appliance that can Traffic analysis, analyze and Logging (computing), log traffic that passes over a computer netwo ...
*
Performance management
Business performance management (BPM) (also known as corporate performance management (CPM) enterprise performance management (EPM),) is a management approach which encompasses a set of processes and analytical tools to ensure that a business o ...
*
Token bucket
The token bucket is an algorithm used in packet-switched and telecommunications networks. It can be used to check that data transmissions, in the form of packets, conform to defined limits on bandwidth and burstiness (a measure of the unevenne ...
References
{{reflist
Network management
Internet Protocol based network software