Tools for Analyzing Router

Statistics
National Radio Astronomy Observatory
REU Research Summary

Tony Kom
tkom@nrao.edu
http://www.cv.nrao.edu/~tkom/

Supervisor: Gene Runion

grunion@nrao.edu

August 6, 2002
Introduction

The NRAO has 17 different sites networked together.

Although the routers are configured to collect traffic
information, we have no easy mechanism to monitor and
analyze the data for performance and for intrusion
detection.

My main assignment is to implement a system that will

gather this data systematically and use tools to analyze
and display it coherently.
What is a Router?
• Directs the flow of data
packets.

• Access Lists to
permit/deny packets

• Statistics

• In/Out traffic

• Transmission Errors

• Who is trying to
©2000 How Stuff Works

connect?

We can use SNMP to ask the router for these numbers and use
tools to analyze and graph them.
What is a Router?
• Directs the flow of data
packets.

• Access Lists to
permit/deny packets

• Statistics

• In/Out traffic

• Transmission Errors

• Who is trying to
©2000 How Stuff Works

connect?

We can use SNMP to ask the router for these numbers and use
tools to analyze and graph them.
How We GET the Data
How We WANT the Data

We want to be able to display the data in an

organized, graphical manner.

This makes analyzing and identifying trends and

patterns much easier.
Getting There

MRTG: Multi Router Traffic Grapher

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

RRDTool: Round-Robin Database Tool

http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/
MRTG
• MRTG is a tool to monitor the traffic load on network-
links. MRTG generates HTML pages containing graphs
which provide a LIVE visual representation of this
traffic.

• MRTG is a standalone tool that collects, stores, and

graphs your data.

• It does an ok job, but it has some performance and

flexibility issues.
MRTG - Issues

• MRTG generates each graph (we are generating 582

graphs!) every 5 minutes, creating a lot of overhead.

• It also has very few customizable graphing options.

• Disk space is always an issue.

RRDtool

• RRDtool is an enhanced, streamlined extension of

MRTG.

• RRDtool only incorporates the storage and graphing

capabilities of MRTG, not the ability to gather the data.

• You must either use a front-end program or write your

own scripts to connect to the router, gather the
statistics and send them to RRDtool.
RRDtool – Features

• RRDcgi: only creates a graph when you ask to see the

graph (by viewing it on a web page).

• RRD system stores data in a very compact way that

will not expand over time.

• VERY flexible in allowing you to add specific

information to your graphs.
Let’s Compare

RRDtool Graph
MRTG Graph
Results
Currently, I have graphed all the router data with MRTG,
and I am in the process of making RRDtool graph the
same data. In the mean time, MRTG still runs.

Eventually, I will completely transfer all graphing to

RRDtool and MRTG will be turned off.

MRTG Graphs: http://www.cv.nrao.edu/~tkom/mrtg/

RRDtool Graphs: http://www.cv.nrao.edu/~tkom/rrd/