Measuring packet forwarding behavior in a production network

Today routers mainly "fast switch" their traffic applying dedicated hardware. However "process switching" which involves the router OS may occur occasionally before caches in hardware modules are updated. Fast switching is preferred as it requires less time and is more deterministic than process switching. Under normal operating, the majority of all packets are fast switched. However, in the event of a miss-configuration and/or system error, routers and switches may start to process switch large portions of the traffic. This may lead to higher packet jitter, and even loss. This paper shows that by applying active measurement unusual process switching behavior in routers in a production network is detected. Hence access to router internals is not required. By interpreting measurement statistics intermediate routers are found which add jitter unrelated to traffic or intermediate bottleneck links. The added jitter is caused by process switched packets requiring longer and varying processing time. Probe packets applied were time stamped at source and destination by high precision hardware (data acquisition cards) as well as lower precision Linux OS functions. Interestingly, results based on a large number of observations show that hardware and Linux OS timestamps present similar number in terms of jitter measurements.



  • Lars Landmark
  • Otto Wittner
  • Olav Kvittem
  • Øivind Kure

Part of session

Network monitoring

Related documents