Uploaded image for project: 'Network Observability'
  1. Network Observability
  2. NETOBSERV-520

(R&D) Investigate alternative solutions to do no sampling but still scale

    • Icon: Spike Spike
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • None
    • False
    • None
    • False
    • NetObserv - ShiftWeek 4.15

      Flow sampling is problematic and misleading.  Using OVS IPFIX and sampling enabled, it calculates bytes and packets by multiplying the value with the sampling rate.  If the sampling rate is 400, then all byte and packet values are some multiple of 400.  And with this sampling rate or even as low as 10:1, the odds of missing the packet entirely is extremely high.  You are practically guaranteed to get incorrect metrics.

      Using eBPF agent and sampling enabled, the bytes and packets are simply the values of the sampled data with no adjustments.  The metrics will also be incorrect as it will report a substantially lower value than the actual value.

      If we want accurate byte/packet counts, then it needs to process every flow.  However to scale better, it does not need to save every flow and so this could be the tradeoff between resources and scalability.

       

              jtakvori Joel Takvorian
              stlee@redhat.com Steven Lee
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: