Chapter 12. Summary of Data Collection Methodology

This chapter serves two purposes. First, you can read it as a summary of the chapters in Part II to get an overview of the accounting and performance device instrumentation features. With that in mind, this chapter summarizes the high-level technical characteristics of all features discovered in the previous chapters and provides a way to structure, categorize, and compare the features.

Second, this chapter offers an entry point into the accounting and performance features. So that you won't read all the chapters and then discover that some of the accounting and performance features are not suitable for your specific scenario, the two matrixes in this chapter guide you toward the features of interest.

The previous eight chapters offer many details about the Cisco different device instrumentation features for accounting and performance management. Because the variety of functions could make it difficult to choose the "right" feature, this chapter offers you some guidance in the selection process. Two matrixes compare the features from a technical and business perspective.

Tables 12-1 and 12-2 assess the accounting and performance features described in Part II. Table 12-1 offers answers to the fundamental questions:

  • What to collect?

  • Who is the user?

  • How to collect (metering method)?

Table 12-1. Overall Functional Area Comparison Related to the Collected Details
AreaDataSNMPIP AccountingMAC Address IP AccountingPrecedence IP AccountingACL IP AccountingNetFlowBGP PAAAANBARIP SLA
What to collect?DSCP/ToSNA  check mark check mark  check mark 
MIBNA         
MemoryNA         
Response timeNA        check mark
BGP AS numberNA    check markcheck mark   
Applications/typeNA       check markcheck mark
AvailabilityNA        check mark
Session start timeNA    check mark check mark  
Session stop timeNA    check mark check mark  
Who is the user?Interface countersNAcheck markcheck markcheck mark check mark  check mark 
MAC addressNA check mark  check mark    
IP addressNAcheck mark   check mark check markcheck markcheck mark
UsernameNA      check mark  
How to collect (metering method)?Observed trafficcheck markcheck markcheck markcheck markcheck markcheck markcheck markcheck markcheck mark 
Synthetic traffic         check mark
Sampling     check mark    
Direction: ingresscheck mark check markcheck markcheck markcheck markcheck markcheck markcheck mark 
Direction: egresscheck markcheck markcheck markcheck markcheck markcheck markcheck markcheck markcheck mark 
Originated trafficcheck mark    check markcheck mark check mark 
Destined trafficcheck mark    check mark check markcheck mark 
Transit trafficcheck markcheck markcheck markcheck mark check markcheck mark check mark 
How to collect (collecting method)?SNMP readcheck markcheck markcheck markcheck mark check mark[*]check markcheck mark[*]check markcheck mark
SNMP writecheck markcheck mark   check mark[*]check mark check markcheck mark
Security options check mark        check mark

[*] Partly supported

Table 12-2. MIB-Specific Functional Area Comparison Related to the Collected Details
 MIB-I, II; IF-MIBPING-MIBPROCESS-MIBENVMON-MIB, MEMORY-POOL-MIBDATA-COLLECTION-MIBCB-QOS-MIBFRAME-RELAY-MIBMLS-TE-MIBExpression and Event MIBRMON, SMON, DSMON, ART MIB
DSCP/ToS     check mark   check mark[*]
CPU Utilization  check mark     check mark 
Memory  check markcheck mark    check mark 
Response Time check mark       check mark
BGP AS Number          
Applications/type          
Availabilitycheck markcheck mark      check markcheck mark
Session Start Time          
Session Stop Time          
Interface Counterscheck mark     check markcheck mark check mark
MAC Address         check mark
IP Address         check mark


[*] Partly supported

Here are some comments for clarification:

  • Collection details relate to IP address, MAC address, interface counters, BGP autonomous system number, ToS/DSCP, and more. Because this is a summary table, only the most important parameters are described.

  • SNMP has two rows because most features support SNMP read operations but only some have writable MIB objects. Note that only a subset of available MIBs is listed.

  • Most features meter observed traffic, which is the actual network traffic. Metering observed traffic does not have an impact on the network traffic, compared to synthetic traffic, which is generated specifically for measurement purposes.

  • The session start and stop time parameters are explicitly required for billing solutions.

  • The metering interface (ingress or egress) and the traffic destination are distinguished. Transit traffic passes the network element and has a remote destination, whereas destined traffic targets the collection device. Originated traffic is generated at the metering device itself. Note that destined traffic can be collected only at the ingress interface and originated traffic is captured only at the egress interface. Figure 12-1 illustrates the different metering options per traffic direction.

    Figure 12-1. Metering Direction and Interface

    [View full size image]

  • The Security Options row considers SNMPv3 as security for the listed MIBs and MD5 authentication for IP SLA.

  • SNMP is the protocol to transfer the MIB variables' content and therefore is independent of their type. Thus, the SNMP protocol cannot answer the questions "What to collect?" and "Who is the user?" This is why Table 12-1 shows several "not applicable" (NA) cells. These two questions are answered in Table 12-2 for the most important MIBs covered in this book.


    [Pages 517 - 518]

Table 12-3 assigns accounting and performance features to the different business cases. The idea of this table is to help you choose the feature that offers exactly the level of detail you need. An alternative would be to select a feature that collects all the details and keep only the required fields. Even though this is a valid option, it is not an economical approach, because more data is collected than is actually required. For example, if you are interested in only the total amount of traffic per interface, the SNMP interface statistics provide sufficient details. Of course, alternatively you could collect all NetFlow records and aggregate the flows afterwards, but this is not suggested. Current best practice advises that you meter exactly the level of detail that fulfills your requirements.

Table 12-3. Functional Area Comparison Related to Business Cases
 MIB-I, II; IF-MIBPING-MIBPROCESS-MIBENVMON-MIB, MEMORY-POOL-MIBDATA-COLLECTION-MIBCB-QOS-MIBFRAME-RELAY-MIBMLS-TE-MIBExpression and Event MIB
Device Performance Monitoringcheck markcheck mark[*]check markcheck markcheck markcheck markcheck mark check mark
Network Performance Monitoring and Baseliningcheck markcheck mark  check markcheck markcheck markcheck markcheck mark
User Monitoring and Profilingcheck mark[*]   check mark   check mark
System and Server Performance Monitoring  check markcheck mark    check mark
Application Performance Monitoring and Profiling    check markcheck mark[*]   
Link Capacity Planningcheck markcheck mark  check markcheck markcheck markcheck markcheck mark
Network-Wide Capacity Planning    check mark  check mark 
Traffic Profiling and Engineering    check markcheck mark check mark 
Peering and Transit Agreements    check mark    
Source- and Destination-Sensitive Billing         
Generic Service Monitoring check mark      check mark
Class/Quality of Service Billing     check mark check mark 
Application- and Content-Based Billing         
Time- and Connection-Based Billing         
VoIP Billing         
Security Analysis         
Fault Management        check mark
 RMON, SMON, DSMON, ARTIP AccountingMAC Address IP AccountingPrecedence IP AccountingACL IP AccountingNetFlowBGP PAAAANBAR
Device Performance Monitoringcheck markcheck markcheck mark  check mark check markcheck mark
Network Performance Monitoring and Baseliningcheck mark    check markcheck markcheck mark 
User Monitoring and Profilingcheck markcheck markcheck mark  check mark check mark 
System and Server Performance Monitoringcheck mark        
Application Performance Monitoring and Profilingcheck mark    check markcheck mark check mark
Link Capacity Planningcheck markcheck mark   
Part II: Implementations on the Cisco Devices