ANALYZING MICROBURSTS

Network microburst analysis is important for all network topologies to trouble shoot problems, understand network flow and optimization throughput/latency. FMADIO products have a powerful builtin microburst analyzer to assist and answer any microburst questions you can ask.

WHY ANALYZE MICROBURSTS?

To answer this requires an explanation on switch architecture. All switch silicon has limited buffering capacity, typically 1-8MB of on chip RAM of some description. Imagine a 4 Port 10G switch with say a 40G uplink as shown below. It means this switch can have an incomming packet on all 4 Ports, that needs to be forwarded to the 40G uplink. Making it 40Gbit (4x10G) write + 40Gbit (40G uplink) read, with a total bandwidth requirement of 80Gbits.

Using a plain vanilla store-and-forward style switch (to simplify it) each of the 10G ports needs to write its payload into the FIFO (in purple) while simultaneously the 40G uplink is reading packets from the same RAM. To make this more realistic, imagine a 24x10G port switch with 4x40G uplinks and its easy to see how this NxM simultaneous read/write bandwidth requirement gets into some crazy high numbers. This is one of the fundamental problem of packet switch technology, and is also why understanding your microbursts is important.

WHY IS IT IMPORTANT?

Imagine your switch has 1MB of FIFO space, and lets say there are 2x10G ports switching to a single 1x10G output port. For example 2 machines writing to a file server. Then both machines writes a 5MB file to the file server at exactly the same time at 10G line rate. In this situation it means the output 10G port has 10MB of traffic to output at line rate, and our switch needs to buffer 5MB of packets. But the switch only has 1MB of buffer space resulting in a ~50% packet loss, 20Gbps into 10Gbps with 1MB of buffer. And thus enter microburst packet loss analysis.

WHAT IS A MICROBURST?

This is often a conflicting and confusing topic, which revolves around how bandwidth is actually calculated. It sounds like a silly question to ask, "what does 10Gbit / second mean?" yet this is critical to understanding microbursts. The standard answer to this is 10Gbps means 10Gbits transfered over a period of 1 second, which is of course is true however outside DDOS attacks and even on teleco backbones this level of sustained line rate 1 minute+ throughput level is almost never seen.

However 10Mbits transfered over a 1 msec time interval is also by definition 10Mbit / 0.001sec == 10Gbps which leads us back to the topic of switch buffer sizes as 10Mbits is ~ 1.25MB and in the range of most switch`s onchip buffer size. This turns our hypothetical 2x10Gbps write to a 1x10Gbps file server example into something far more reasonable to occur. Short simultaneous 1msec 10G line rate microbursts, something a wide variety of applications exhibit.

10G MICROBURST ANALYZER

Of course we at FMADIO have the perfect solution for this! Our packet analyzer is designed for analyzing and reducing massive 100GB-16TB PCAP files into something more manageable and intuitive to work with.

You can select the time window to calculate microbursts, as shown in the image below. It supports 50 microsecond, 100 microsecond, 250 microsecond, 1 millisecond, 10 milliseconds, 100 milliseconds and 1 second. In addition you can view either Bits per second, or Packets per second to gain even more insight into the network flow.

Switching between time windows is almost instantaneous and tremendously helpful to gain intuition about the traffic. In the next set of images you can clearly get better intuition about the size, depth and impact of the microburst.

A MICROBURST ANALYSIS EXAMPLE

In the following example we`ve synthetically generated the perfect micro burst. Our fpga traffic generator outputs a constant ~ 1.5Gbps worth of 64B packets, then spikes it with a microburst of 10G line rate 10,000 x 1500B making the microburst ~ 15MB in total size. In the screen shot below we see a deceptive 100msec view of the the traffic pattern. By using the red & green time sliders the base packet stream is running at ~ 1.5Gbps-1.6Gbps.

Moving the time sliders to include the microburst, we can see at the 100msec level the peek rate is ~2.27Gbps, as shown below.

This is the deceptive nature of microburst`s. If there are packet drops on a link somewhere and you see it bursting only to 2.27Gbps then you might think its a faulty cable. Yet digging deeper and studying the microburst at the 100usec level, it shows a completely different picture and will change the direction of the investigation (shown below).

In the above screenshot we can see the microburst is hitting full line rate 9.987Gbps against the backdrop of ~ 1.6Gbps worth of traffic. Showing a completely different picture making the switch a prime suspect for any packet drop investigations.

And finally the FMADIO 10G packet analyzer can zoom all the way down and examine the microburst in fine detail. So much detail that we can see this specific microburst lasts for ~12.078 msec at full line rate.

SUMMARY

Knowing your microbursts is key to a smoothly functioning network environment. If that's for ultra low latency or high throughput enterprise networks having the right tools to understand your network flow is critical.

Contact us to find out more and schedule an evaluation today!