Networking Accounting Management Strategies

Network Management: Accounting and Performance Strategies - Graphically Rich Book Network Management: Accounting and Performance Strategies by Benoit Claise - CCIE No. 2686; Ralf Wolter Publisher: Cisco Press Pub Date: June 20, 2007 Print ISBN-10: 1-58705-198-2 Print ISBN-13: 978-1-58705-198-2 Pages: 672 ACCOUNTING MANAGEMENT

Understanding the need for Accounting Management What is accounting management? Why do networks require accounting management? Why is accounting almost a stealth area within network management? Which problems do accounting management solutions solve? How can the business use this information for network planning, redesign, and billing? What aspects make up accounting (data collection, data analysis, reporting, billing, and so on)?

Defining accounting management

ITU-T definition (M.3400 and X.700, Definitions of the OSI Network Management Responsibilities): "Accounting management enables charges to be established for the use of resources in the OSIE [Open Systems Interconnect Environment], and for costs to be identified for the use of those resources

ITU-T definition (M.3400 and X.700, Definitions of the OSI Network Management Responsibilities): Accounting management includes functions to: management includes "inform users of costs incurred or resources consumed inform functions to: Accounting "enable accounting limits to be set and tariff schedules to be associated with the use of resources; limit "enable costs to be combined where multiple resources are invoked to achieve a given communication objective." Cost combine

Telecommunication Management Forum (TMF) definition: + = ITU M3400 additional details for billing in the enhanced Telecom Operations Map (eTOM) TMF The Fulfillment, Assurance, and Billing (FAB) model of TMF's eTOM

Telecommunication Management Forum (TMF) definition: The TMF refers to the ITU-T accounting definition (M.3400) and provides additional details for billing in the enhanced Telecom Operations Map (eTOM), The Business Process Framework, Document GB921. The Fulfillment, Assurance, and Billing (FAB) model of TMF's eTOM positions the "Network Data Management" building block between assurance and billing. "Network Data Management: this process encompasses the collection of usage data and network and information technology events and data for the purpose of network performance and traffic analysis. This data may also be an input to Billing (Rating and Discounting) processes at the Service Management Layer, depending on the service and its architecture." Chapter 3 explains the FAB model in more detail.

IETF definition: Request For Comment (RFC) 2975, Introduction to Accounting Management the collection of resource consumption data for the purposes of capacity and trend analysis, cost allocation, auditing, and billing. Accounting management requires that resource consumption be measured, rated, assigned, and communicated between appropriate parties."

In this book, we use the term accounting management to describe the following processes: Collecting usage data records at network devices Optionally preprocessing data produced by the device (for example, filter, sample, aggregate) Exporting the data from the device toward a collection server Processing the data at the collection server (for example, filter, sample, aggregate, de-duplicate) performance, SLA, fault, security, billing, planning, and so on Converting usage records into a common format to be used by higher- layer applications : the mediation procedure

Figure 1-3. Accounting Management Architecture

Figure 1-3. Accounting Management Architecture Collecting usage data records at network devices

Figure 1-3. Accounting Management Architecture Optionally preprocessing data produced by the device (for example, filter, sample, aggregate)

Figure 1-3. Accounting Management Architecture Exporting the data from the device toward a collection server

Figure 1-3. Accounting Management Architecture Processing the data at the collection server (for example, filter, sample, aggregate, de- duplicate)

Figure 1-3. Accounting Management Architecture Converting usage records into a common format to be used by higher-layer applications (for example, performance, SLA, fault, security, billing, planning, and so on): the mediation procedure

Figure 1-5. Network Management Building Blocks the focus of accounting is to track the usage of network resources and traffic characteristics.

The Purposes of Accounting Various accounting scenarios: Application monitoring and profiling Capacity planning User monitoring and profiling Network monitoring Application monitoring User monitoring and Network monitoring Traffic profiling and Peering and transit Capacity planning Security analysis and profiling agreements engineering profiling Billing

Network Monitoring Class 0 Packets Bytes Class 1 Packets Bytes Class 2 Packets Bytes Time (Hour) 0 1 2 3 4 5 6 7 8 9 38 55 41 13 16 19 21 19 5 4 2735 3676 36661 1660 14456 2721 24725 3064 925 457 1300 400 400 200 400 400 600 700 1200 1300 59800 44700 16800 8400 44700 44400 35600 412200 15 176000 1 104100 1242 3 61 4 4 4 1 516 1002 9791 240 424 420 48 20648 677 48 148920 5 48 Table 1-2. Example of a Daily Report with Three Servicee Classes 10 5 3004 1900 109190 0 39800 54200 1 11 12 4 4 451 456 400 800 545 1017 22641 108969 9 3240 3287 27578 144 322 192 424 424 936 835 235 13 14 15 16 17 18 19 20 21 22 23 5 4 5 4 4 4 5 4 5 7 9 510 455 511 454 457 455 3095 398 1126 782 7701 500 400 800 100 500 400 1300 100 800 1300 600 41600 99300 36800 4000 309500 2 34100 104100 4 15200 54200 104100 4 35600 36 15 685 3 4 4 12 1 back back

User Monitoring and Profiling The trend of running mission-critical applications on the network is OVERWHELMING Voice over IP (VoIP), virtual private networking (VPN), and videoconferencing are increasingly being run over the network. At the same time, people use (abuse?) the network to download movies, listen to music online, perform excessive surfing, and so on. next next

User Monitoring and Profiling This information can be used to: A traffic matrix illustrates the patterns between the origin and destination of traffic in the network Build a traffic matrix per subdivision, group, or even user additional value-added services subdivision, group, or even Document usage trends by Track network usage Monitor and profile Identify opportunities to sell Build a traffic matrix per to targeted customers. user, group, and department per user users user back back

Application Monitoring and Profiling Figure 1-7. Characterizing Traffic by Application back back

Figure 1-8. IP Protocol Distribution Figure 1-8. IP Protocol Distribution

Table 1-3. Example of Daily Report (Extended Version) Class 0 Class 1 Class 2 Application (Bytes) Application (Bytes) Load Load Load Application (Bytes) Peer-to- Peer 752 100 8812 979 216 24 382 42 378 42 48 48 18583 2065 609 68 48 96 1489205 1340285 148921 Time (Hour) 0 1 2 3 4 5 6 7 8 9 Packets Bytes 38 55 41 13 16 19 21 19 5 4 Voice 264 128 780 328 128 1164 9856 2048 512 256 Other 2471 3548 55881 1332 14328 1557 14869 1016 413 201 Packets Bytes 1300 400 400 200 400 400 600 700 1200 1300 E-mail 38870 29055 10920 5460 29055 28860 23140 267930 114400 67665 SAP 20930 15645 5880 2940 15645 15540 12460 144270 61600 36435 Packets Bytes 13 61 4 4 4 10 516 15 12 1242 HTTP Other 150 0 0 0 0 384 0 0 816 0 2735 3676 56661 1660 14456 2721 24725 3064 925 457 59800 44700 16800 8400 44700 44400 35600 412200 176000 104100 1002 9791 240 424 420 480 20648 677 960 10 5 3004 1684 1320 1900 1091900 709735 382165 3 256 230 26 0 11 12 4 4 451 456 96 64 355 392 400 800 39800 54200 25870 35230 13930 18970 545 1017 22641 1089699 980729 20377 2264 108970 0 0 13 14 15 16 17 18 19 20 21 22 23 5 4 5 4 4 4 5 4 5 7 9 510 455 511 454 457 455 3095 398 1126 782 7701 128 416 496 128 256 196 2048 286 956 612 2096 382 39 15 326 201 259 1047 112 170 170 5605 500 400 800 100 500 400 1300 100 800 1300 600 41600 99300 36800 4000 309500 34100 104100 15200 54200 104100 35600 27040 64545 23920 2600 201175 22165 67665 9880 35230 67665 23140 14560 34755 12880 1400 108325 11935 36435 5320 18970 36435 12460 36 15 685 3 2 4 4 4 12 4 2 3240 3287 27578 144 322 192 424 424 936 835 235 2916 2958 24820 130 290 173 382 382 842 752 212 324 329 2758 14 32 19 42 42 94 84 24 0 0 0 0 0 0 0 0 0 0 0

Capacity Planning A service provider might consider the following: next next

Capacity Planning POP Which point of presence (PoP) generates the most revenue? A service provider might consider the following: ACCESS Which access points are not profitable and should be consolidated? CAPACITY SPARE Should there be spare capacity for premium users? SEGMENT In which segment is the traffic decreasing? Did we lose customers to the competition? What might be the reason? next next

Capacity Planning An enterprise IT department might consider the following Which departments are growing the fastest? Which links will require an upgrade soon? GROW AVAILABILITY For which department is network connectivity business-critical and therefore should have a high-availability design? HIGH back back