best practices for analyzing voip at 10g
DESCRIPTION
Watch the full OnDemand Webcast: http://bit.ly/networkanalysis10G Network analysis on highly utilized 10G network segments is already a complicated business, and that’s just for traditional TCP/IP data protocols. Add time-sensitive protocols like VoIP into the mix, with its associated complexities like QoS configuration and MPLS segmentation, and you could have a real mess on your hands. Which network analysis systems can handle throughput at 10Gbps, especially with a high percentage of small packets that are characteristic of VoIP traffic? Which systems can display VoIP statistics in real-time, providing critical data and alerts on current VoIP performance, while also saving 10Gbps traffic to disk for more detailed post capture analysis? Which systems can capture and analyze the traffic from your busy enterprise VoIP system - thousands of concurrent VoIP calls? Your choices in addressing these issues are limited. In this webinar, Jim Frey, Managing Research Director at Enterprise Management Associates and Jay Botelho, Director of Product Management at WildPackets discuss the challenges network engineers face and walk you through your options. They will cover: Challenges of capturing and analyzing mixed network data on heavily utilized 10G network segments Conflicting demands of traditional (TCP/IP) data analysis and VoIP analysis Critical VoIP statistics and their relationship to call quality A real-time demo of the TimeLine appliance for network forensics What you will learn: Best practices for monitoring and analyzing heavily utilized 10G network segments with mixed data types How to configure TimeLine for optimum network analysis and troubleshootingTRANSCRIPT
www.wildpackets.com© WildPackets, Inc.
Jay Botelho
Director of Product Management
WildPackets
Follow me @jaybotelho
Show us your tweets!Use today’s webinar hashtag:
#wp_timelinewith any questions, comments, or feedback.
Follow us @wildpackets
Network Analysis At 10G
Real-time Statistics and VoIP
Jim Frey
Managing Research Director
Enterprise Management Associates
© WildPackets, Inc. 2A Confluence of Flows
Agenda
• Network Analysis Challenges at 10G
• Network Impacts Amplified by VoIP
• Combining Real-time Statistics And Post-Capture Analysis
• Monitoring and Analysis for Heavily Utilized 10Gig Network
Segments with Mixed Data
• Understanding and Interpreting VoIP Metrics
• TimeLine – Real-time Statistics AND Performance
• Company Overview
www.wildpackets.com© WildPackets, Inc.
Network Analysis
Challenges at 10G
© WildPackets, Inc. 4A Confluence of Flows
10G: Brave New World for Network Mgt
• 10x higher speeds, but what is impacted?‒ Device Monitoring: not greatly affected
‒ Flow Record Monitoring: increases incrementally
‒ Packet Monitoring: BIG IMPACT
• Early Approach‒ Put 10G interfaces on 1G instrumentation
‒ Worked great as long as 10G links not fully utilized
‒ Total throughput constrained by instrumentation capacity
‒ Typical breakpoint: 2-3 Gbps
© WildPackets, Inc. 5A Confluence of Flows
10G Driving New Monitoring Architectures
• Performance tools need to be re-architected
• Focus on high-volume, accurate collection and
storage of packet streams
• Can’t afford to miss anything – must assure
complete record
• Moore’s Law helps, but additional optimization
required‒ High capacity NICs
‒ High capacity backplanes
‒ High speed on-board storage
‒ Options for off-board storage for longer captures
www.wildpackets.com© WildPackets, Inc.
Network Impacts Amplified by VoIP
© WildPackets, Inc. 7A Confluence of Flows
VoIP/RTP: A special netizen
• VoIP and other real-time, interactive IP-based
(RTIPC) communications require special handling
‒Close monitoring of quality required
‒Specific Planning steps required
‒When problems occur, they are Real-Time!
© WildPackets, Inc. 8A Confluence of Flows
6%
36%
53%
57%
66%
0% 20% 40% 60% 80%
Other (Please specify)
Implementing access controls
Upgrading core network
Implementing QoS policies
Upgrading WAN links
EMA 2009: Sample Size = 47
Which changes has your company made to the network
infrastructure in order to support RTIPC?
© WildPackets, Inc. 9A Confluence of Flows
35%
76%
76%
88%
94%
0% 20% 40% 60% 80% 100%
R Factor
MOS
Jitter
Packet Loss
Latency
EMA 2009: Sample Size = 17
Which of the following quality metrics are you monitoring?
© WildPackets, Inc. 10A Confluence of Flows
53%
53%
71%
76%
0% 20% 40% 60% 80% 100%
Active (synthetic) agents
Call/session recording for forensic troubleshooting
Passive, packet-based monitoring
Call detail record analysis
Title
What monitoring techniques are you using for RTIPC?
EMA 2009: Sample Size = 17
www.wildpackets.com© WildPackets, Inc.
Combining Real-time Statistics +
Post-Capture Analysis
© WildPackets, Inc. 12A Confluence of Flows
Core Requirements: R/T+Capture for 10G
1. Protect Full Capture‒ Full line-rate streaming capture/storage
‒ Efficient retrieval for analysis
2. Real-time Statistics For Visibility‒ Reactive Workflows
• History + Top N (focuses/accelerates identification)
• Context-based drill-downs (accelerates analysis)
‒ Proactive Workflows• Recent history trending (reveals anomalies / potential issues)
• Top N views (guides issue assessment)
• Context-based drill-down (facilitates investigations)
‒ Metrics/measures appropriate for type traffic/activity• MOS for VoIP
• Bit/Packet/Protocol Volumes for non-real-time types
www.wildpackets.com© WildPackets, Inc.
Monitoring and Analysis for
Heavily Utilized 10Gig Network
Segments with Mixed Data
© WildPackets, Inc. 14A Confluence of Flows
Typical Network Analysis Workflow
Let It Roll!Alerts/Alarms
User Complaints
Problem?
Connect the Analyzer
Start a TraceReproduce
if Necessary
NO
YES
© WildPackets, Inc. 15A Confluence of Flows
1Gig Is Easy - Now
• Use almost any NIC
• Use almost any computer
• Capture and analyze all in real-time
• Little or no special hardware needed (taps, etc.)
• Little to no impact on existing network traffic
• ―Analysis on the fly‖ still feasible
© WildPackets, Inc. 16A Confluence of Flows
10Gig Network Analysis Workflow
Identify Key Analysis Pts
Deploy 24x7 Monitoring
Alarms/Alerts
Problem?
Rewind Data
AnalyzeTune if
Necessary
NO
YES
www.wildpackets.com© WildPackets, Inc.
Understanding and Interpreting
VoIP Metrics
© WildPackets, Inc. 18A Confluence of Flows
Key VoIP/Video Issues
CAMP IT Pinpointing the Problem 18
JitterLatency
Packet
Loss
© WildPackets, Inc. 19A Confluence of Flows
Latency's Effects• Talkover
‒ Occurs when excessive latency delays audio
– Conversation cadence is not natural or comfortable
– Callers feel as if they must “push to talk” or say “over” to control the
conversation
• Echo
‒ The speaker’s voice feeds back into the listener’s microphone
‒ The speaker then hears his own voice returning from the listener’s end,
but delayed due to latency
‒ Most callers find it difficult to maintain normal speech when echo delay
is prolonged
‒ Some VoIP systems attempt to cancel echo, but are not always
successful
High latency may also cause additional troubles such as loss of
synchronization between audio and video for multimedia sessions.
© WildPackets, Inc. 20A Confluence of Flows
Jitter's Effects
• Jitter causes weird ―sound effects‖ that vary with
jitter severity and environmental factors
• Examples include:‒ Static
‒ Stuttering or uneven audio – abnormal speech rhythm
‒ For multimedia systems, video may be “jerky” or irregular
• If jitter levels are high, packet loss can result‒ In some cases, severe jitter may sound similar to packet loss,
even if no packets are actually dropped
© WildPackets, Inc. 21A Confluence of Flows
Packet Loss Effects
• Causes missing sounds, syllables, words, or phrases
‒ DSP algorithms may compensate for up to 30 ms of missing data
‒ More than 30 ms of missing audio is noticeable by listeners
• An average person speaks at a rate of about 200 words per
minute
‒ That’s 3.33 words/sec = 300 ms per word
‒ For G.711, we would need to lose 15 consecutive RTP packets to lose
a whole word
‒ Dropping 15 packets/sec for G.711 would be a loss rate of 30%
• But losing only a few packets can still be very noticeable
‒ Loss of more than 2 consecutive packets will be heard
‒ Loss rates ≥ 2% will have a strong impact on quality
‒ Losses of 5 – 10% make calls all but intolerable
‒ Bursty periods of packet loss are worse than more dispersed loss
© WildPackets, Inc. 22A Confluence of Flows
VoIP Dashboard View
© WildPackets, Inc. 23A Confluence of Flows
Media View
www.wildpackets.com© WildPackets, Inc.
TimeLine – Real-time Statistics
AND
Performance
© WildPackets, Inc. 25A Confluence of Flows
TimeLine Unique Value Proposition
• Capture every single packet in highly-utilized
networks
• See the most real-time data possible for immediate
assessment of ongoing network performance
• Know exactly when to drill in based on real-time data
displays
• Maximize historical data retrieval efficiency
© WildPackets, Inc. 26A Confluence of Flows
Fast Network Recording
11 Gbps sustained CTD with zero packet loss
© WildPackets, Inc. 27A Confluence of Flows
Real-time Statistical Display
© WildPackets, Inc. 28A Confluence of Flows
Real-time Media Metrics
• Call Quality
• Call vs. Network Utilization
© WildPackets, Inc. 29A Confluence of Flows
Forensics Search
© WildPackets, Inc. 30A Confluence of Flows
Forensics Search Results _ VoIP
www.wildpackets.com© WildPackets, Inc.
Company Overview
© WildPackets, Inc. 32A Confluence of Flows
Corporate Background
• Experts in network monitoring, analysis, and troubleshooting
‒ Founded: 1990 / Headquarters: Walnut Creek, CA
‒ Offices throughout the US, EMEA, and APAC
• Our customers are leading edge organizations
‒ Mid-market, and enterprise lines of business
‒ Financial, manufacturing, ISPs, major federal agencies,
state and local governments, and universities
‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000
• Award-winning solutions that improve network performance
‒ Internet Telephony, Network Magazine, Network Computing Awards
‒ United States Patent 5,787,253 issued July 28, 1998• Different approach to maintaining availability of network services
© WildPackets, Inc. 33A Confluence of Flows
What We Do
• Provide network visibility and intelligence …‒ WatchPoint, OmniPeek, OmniEngines
• Expert systems – we find the problems for you
• Superior drill-down capability – trouble-shoot from anywhere
• Flexible, customizable, extensible – leverage your investment
‒ Professional services, training, best practices
• For all network segments …‒ Data center to desktop to remote office
‒ LAN, WAN, Wireless …
‒ HTTP, Email, Database, VoIP, Video …
• To …‒ Network engineers; IT Management; Developers
© WildPackets, Inc. 34A Confluence of Flows
Real-World Deployments
Education
Health Care / Retail
Financial
Telecom
Government
Technology
© WildPackets, Inc. 35A Confluence of Flows
Product OfferingsSoftware and Turnkey Appliances
• Enterprise Monitoring and Reporting‒ WatchPoint Server
‒ OmniFlow, NetFlow, and sFlow Collectors
• Network Probes & Recorders‒ Omnipliance Network Recorders – Edge, Core
‒ TimeLine Network Recorder
‒ OmniAdapter Analysis Cards
• Distributed Analysis Software‒ OmniPeek – Enterprise, Professional, Basic, Connect
‒ OmniEngine – Enterprise, Desktop, OmniVirtual
• Portable Solutions‒ OmniPeek software
‒ Omnipliance Portable
© WildPackets, Inc. 36A Confluence of Flows
TimeLine Network Recorder11.7Gbps Sustained Capture
• Fastest network recording and real-time statistical
display — simultaneously‒ Network statistics display in TimeLine visualization format
• Rapid, intuitive forensics search and retrieval‒ Historical network traffic analysis and quick data rewinding
‒ Several pre-defined forensics search templates making
searches easy and fast
• A natural extension to the WildPackets product line
• Turnkey bundled solution
© WildPackets, Inc. 37A Confluence of Flows
Omnipliance Network RecordersPrice/performance solutions for every application
Portable Edge Core TimeLineRuggedized
Troubleshooting
Small Networks /
Remote Offices
Regional Offices /
Small Datacenter
Datacenter
Workhorse
Chassis 1U 3U 3U
Memory 2 GB / 8 GB 4 GB / 8 GB 6 GB / 24 GB 18 GB / 24 GB
Expansion 1 PCI-E / 2 PCI-X 1 PCI-E or 1 PCI-X 4 PCI-E 4 PCI-E
Storage 500 GB / 2.5 TB 1 TB 8 TB 8 TB / 16 TB / 32 TB
© WildPackets, Inc. 38A Confluence of Flows
Key Differentiators
• High-level network monitoring to root-cause analysis
• Single solution for today’s converged networks‒ Wired, Wireless, 1GB, 10GB, VoIP, Video, TelePresence, IPTV
• Reduce and even eliminate network downtime‒ Automated monitoring 24x7
‒ Speedy resolution of network bottlenecks
• Improve network and application performance
• Uniquely Extensible Platform – tailored to your needs‒ Plug-ins and APIs for integration and customization
www.wildpackets.com© WildPackets, Inc.
Q&A
Show us your tweets!Use today’s webinar hashtag:
#wp_timelinewith any questions, comments, or feedback.
Follow us @wildpackets
Follow us on SlideShare!Check out today’s slides on SlideShare
www.slideshare.net/wildpackets
www.wildpackets.com© WildPackets, Inc.
Thank You!
WildPackets, Inc.
1340 Treat Boulevard, Suite 500
Walnut Creek, CA 94597
(925) 937-3200