I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
-
Between your two questions, it seems you want to drive a nail with a screwdriver. IPFIX is the wrong tool for the job. I can't even really understand why you would want to know the variance in packet sizes in a flow; it just doesn't seem like useful information.– Ron Maupin ♦Commented Feb 7, 2017 at 14:29
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.– Ron Maupin ♦Commented Aug 6, 2017 at 20:45
Add a comment
|
4 Answers
IPFIX's purpose is to measure packet flow, not the size of the single packet.
However, you can calculate the variance of packet size by time calculating the average size of a packet as the total flow volume divided by the number of packets during different intervals, and seeing how this value changes over time.
If you want to calculate the variance in size of different individual packets in a single flow, that's not possible AFAIK.
-
It can be a solution to add an entity to the IPFIX protocol? Commented Feb 7, 2017 at 13:25
RMON can show the number of frames by size class, e.g. for HP Provision switches show rmon statistics <portno>:
Status and Counters - Port Counters for port 24
Drop events : 0 Jabbers : 0
Octets : 227,397,427 Collisions : 0
Packets : 3,714,994,853 64 oct pkts : 210,643,368
Broadcast pkts : 24,326,013 65-127 oct pkts : 1,722,528,356
Multicast pkts : 83,481,276 128-255 oct pkts : 719,535,071
CRC errors : 0 256-511 oct pkts : 243,979,239
Runts : 0 512-1023 oct pkts : 172,346,388
Giants : 0 1024-1518 oct pkts : 2,666,523,301
Fragments : 0
Understanding the characteristics of your data can be critical. If you can't get what you need with IPFIX, and it's somewhere you can get pcap files from, tcpdump-type tools plus awk-type tools will give you an answer pretty easily.
Use tcpdump or similar to get the packets you're interested in:
13:49:41.046756 IP 192.168.1.1.58465 > 192.168.1.88.17050: UDP, length 986
13:49:46.047115 ARP, Request who-has 192.168.1.88 tell 192.168.1.1, length 46
13:49:46.047165 ARP, Reply 192.168.1.88 is-at 30:65:ec:7f:3f:93, length 28
13:49:51.055195 IP 192.168.1.1.57133 > 192.168.1.88.17050: UDP, length 986
13:50:06.048098 IP 192.168.1.1.51649 > 192.168.1.88.17050: UDP, length 986
Then pipe through awk to get your statistics:
$ cat TCPDUMPOUTPUT \
| awk '{++n; l=$NF; x+=l; xx+=l*l;}\
END{m=x/n; printf("n=%d m=%.2f sd=%.2f\n", n, m, sqrt((xx/n)-(m*m)))}'
n=5 m=606.40 sd=464.95
If you care about the statistical niceties (stability, pop vs sample etc) use R or python instead. Certainly R will give you nice graphs to understand the distribution of whatever categorisations you're interested in.
answered Nov 5, 2017 at 14:24
It is not possible to directly export the variance of the packet sizes in a IPFIX flow record. There is a now expired draft RFC that proposed additional IPFIX fields that would have provided statistical variance information (ipTotalLengthSampleMean, ipTotalLengthSampleVariance), but this was never approved, and the additional fields are not listed in the IANA IPFIX registry.
However using some of the standard IANA fields (octetDeltaCount, packetDeltaCount, octetDeltaSumOfSquares) that a device might include in an exported flow record it is possible to determine the variance and standard deviation.
Variance = (octetDeltaSumOfSquares/packetDeltaCount) - (octetDeltaCount/packetDeltaCount)²
The "Packet Sampling for Flow Accounting: Challenges and Limitations" paper by Tanja Zseby, Thomas Hirsch, Benoit Claise, is a good reference on the foundational theory of this statistical calculation.
