The ONL Tutorial

Tutorial >> Filters, Queues and Bandwidth TOC

Sampling Filters

Sampling filters allow you to probabilistically select a fraction of packets that match an auxilliary filter and are typically used for monitoring packet flows. You may want to skip this section for now and return to it after you have read about how to use router plugins . Although a sampling filter can be used without a plugin, it becomes much more useful in conjunction with a plugin that can process the sampled packets. The main things to remember are:

[[ Port 2 Route Table ]]

For example, suppose we use the one-NSP configuration shown to the right and send traffic from n1p2 to n1p3. We install an auxilliary filter (shown below) at egress port 3 that will sample at the 25% level and send all selected packets to a stats plugin. The filter shows that selected packets are sent to SPC queue 8 which has a QID of 136. The stats plugin counts the number of ICMP, TCP, and UDP packets and then drops the packet. It is summarized in Predefined_Plugins and its use is described in Monitoring With A Plugin.

[[ Port 2 Route Table ]]

[[ Port 2 Route Table ]]

The plugin table at port 3 is shown to the right. It is linked to the filter via the SPC QID of 8. That is, packets selected by the filter is sent to the SPC via SPC QID 8, and the plugin reads packets from SPC QID 8. To test the capabilities of the sampling filter, we send four consecutive flows through port 3:

We send a command to the stats plugin requesting that it display the number of ICMP, TCP and UDP packets that it has seen to show how many packets the plugin has been sent by the filter. We do this before each flow and then after the last flow. The response from the plugin is shown below.
[[ Port 2 Route Table ]]

The output shows that the number of ICMP (ping) packets seen by the stats plugin for each of the first three flow are 9, 13, and 10. Note that the count is not exactly 25% of the 32 packets sent, and the count is different in each case. In the case of the UDP flow, the plugin counted 122 packets. Again, the count is not exactly 25% of the 500 packets sent; i.e., not 125.


 Revised:  Fri, Feb 15, 2008 

  
  

Tutorial >> Filters, Queues and Bandwidth TOC