Managing the Performance of CriticalApplications: IP Multicast

Executive Summary

As enterprises and government agencies look for cost-effective, bandwidthconserving technology for media-rich applications and simultaneous-user applications,IP Multicast has gained serious attention from IT professionals. However, managingsuch an environment can be difficult as a lack of tools and methodologies existfor monitoring and reporting on IP Multicast traffic, resulting in more time spentdetermining a problem’s location, rather than focusing on actually resolving theproblem.

This paper discusses how the nGenius® Solution provides the means to optimizeday-to-day delivery of IP Multicast applications in a complex network, plan globalcapacity, and create business-relevant reports for quantifying strategic IT decisionsto corporate executives. It further outlines a unique method to troubleshoot IPMulticast issues by joining a multicast session, and additional support for TIBCO IPMulticast environments.

2

Introduction

Traditional applications deliver data from a single sender to a singlereceiver – known as unicast communication, which is perfectly sensiblewhen there is only one receiver of data. But the rate of efficiency ofunicast declines exponentially as the number of recipients increases.

Imagine 1000 traders at a Manhattan brokerage firm, each requiring acontinuous feed of real-time stock prices. The process of sending 1000copies of real-time content over the network would continually consumea large amount of bandwidth and server overhead, possibly putting astrain on application and network availability, and certainly consuming alarge slice of the IT budget. Then imagine video-on-demand for a university’sdistance learning courses. Such high-bandwidth applications do not scalewell in a unicast environment when multiple end users require identicalcontent simultaneously.

Enter IP Multicast. IP Multicast communication meets today’s need for abandwidth-conserving technology. Where media-rich applications andsimultaneous-user applications are becoming more prevalent, thistechnology can help organizations address their growing bandwidthrequirements and resource budgets. Multicast reduces traffic by concurrentlydelivering a single copy of information to numerous recipients. While ithas been around for years, multicast has only recently gained seriousattention as enterprises are increasingly deploying it for strategic busi-ness applications, including those that:

• Enable new product offerings, like TV/movies on-demand or multi-user gaming

• Improve operational productivity and accuracy, such as stock marketdata delivery and retail inventory database replication

• Trim costs, such as interactive distance learning, webinars, andcorporate communications

Managing a multicast-enabled network is a demanding task becauseunlike unicast traffic, there are not many tools or methodologies formonitoring and reporting on the multicast domain. As a result, networkengineers often devote a great deal of time to ascertain the location andnature of a problem, rather than focus on solving the problem itself. Thisoutcome is partly due to the lack of tools that monitor and present theappropriate variables for multicast traffic. In addition, the bursty nature ofIP Multicast traffic complicates capacity planning for traffic engineers. AsIP Multicast applications continue to become more prevalent in thebusiness environment, corporations need the capability to manage theseapplications in concert with the rest of their business-critical infrastructure.

RouterServer

Source

Receivers

RouterServer

Source

Receivers

RouterServer

Source

Receivers

Definitions

With IP Multicast an IP packet is transmitted to agroup address that is identified by a single IP des-tination address. Multicast packets are replicated inthe network by intelligent routers enabled withProtocol Independent Multicast (PIM) and othersupporting multicast protocols. The routers forwardthe information to the appropriate network seg-ments interested in receiving the information for aparticular multicast group. IP multicast groupaddresses are represented by class-D IP addresses

reserved specifically for multicast communications,ranging from 224.0.0.0 through 239.255.255.255.

Membership in an IP Multicast group is dynamic,with hosts joining and leaving at will. A receiver orsubscriber joins an IP Multicast group by sending anInternet Group Management Protocol (IGMP) joinpacket to the local router. The router forwards IPMulticast information out each interface where ajoin has been received for a particular IP Multicast

group. The information gets forwarded simultane-ously from the router interfaces to the one or manyclients that have joined the group. Only one packetis sent out from each interface regardless ofwhether there is one or a thousand subscribers onthat segment. Clients also send IGMP leave mes-sages when they are no longer interested in receiv-ing the IP Multicast information.

How Multicast works:

Unicast is a networked communication between a single sender anda single receiver, i.e., between client and client, client and server orserver and server. The majority of today’s Internet traffic is unicast.Example applications include web, email, ftp and telnet.

Broadcast is a communication between a single sender and everyother node in the network. An example would be DHCP, where theclient broadcasts its need for an IP address across the network.

Multicast is a networked communication between a single sender andmany different recipients with packet replication done by the networkin order to reduce sender and network overhead. An example isstreaming media where the data comes from a central point and issent across the enterprise or Internet to multiple workstations orservers.

Optimize the day-to-day delivery of IP Multicastin a complex environment

The complexity of today’s networks makes it more difficult to troubleshootissues that impact IP Multicast applications. The nGenius Solution providesthe key to understanding and resolving problems with a comprehensiveset of real-time information from the multiple applications and technologiesin the network. This detailed information facilitates quick and efficientdiagnosis and eliminates impediments to IP Multicast application perform-ance, speeding mean-time-to-repair and ensuring the highest performancelevels of these business-critical services.

Top-to-bottom, high-resolution troubleshooting

The nGenius Solution collects data from across all areas of the network,including Gigabit Ethernet, Frame Relay, and MPLS-based networks, withthe objective of helping the IT group gain quick insight into the troublespots impacting IP Multicast applications to ensure that business require-ments are being met.

From a high level all the way through the most minute details: Here thenGenius Solution shows application traffic for the Regional HQs groupand each individual location, 1-minute granularity of a Web download,and a packet decode on that same conversation.

Proactively alarm on IP Multicast applications

The nGenius Solution proactively alarms on conditions which indicate anemerging network degradation or an unexpected change in IP Multicastactivity. Users can set utilization thresholds on any application, includingan IP Multicast application. For instance, a 70% utilization may suggest abottleneck is imminent, or a low, 10% utilization at a primary tradingoffice may indicate the disappearance of stock market data application.Discovering an issue before end users notice or before an all-out faultoccurs ensures that the IP Multicast services continue to run smoothly.

Quickly isolate and resolve problems affecting IP Multicast

Since the nGenius Solution incorporates all application information fromacross the entire network in a single solution, the IT department can dis-play a side-by-side comparison of the precise set of metrics needed to solvea problem, saving valuable investigation time and minimizing businessimpact. For example, IT can determine whether a newly-introduced voice-

3

Managing the Performance of Critical Applications: IP Multicast

Identify and analyze your IP Multicast applications

Visibility into application traffic illustrates how the business uses the networkinfrastructure and therefore quantifies strategic IT decisions. The nGenius®

Performance Management Solution incorporates real-time and historicalreporting of all applications, including those delivered via IP Multicast,which eliminates the need for separate products to manage each individualapplication.

The nGenius® Solution processes IP Multicast applications exactly as anyother networked application, such as HTTP or SAP. NetScout’s patent-pending CDM™ Technology (Common Data Model), with its uniformarchitecture for mapping performance data, seamlessly extends monitoringand reporting capabilities to IP Multicast and TIBCO IP Multicast(discussed below in greater detail) applications. Data collected includevolume, utilization, and publisher-to-group conversation statistics, and thecapability to perform packet decodes of multicast protocols (e.g., IGMP,PIM, RTP). This data is made available for multiple purposes, includingtroubleshooting, capacity planning, forensic analysis, application andnetwork monitoring through the nGenius Solution and modeling, usage-based billing, expert analysis, and intrusion detection through 3rd-partysoftware.

Displaying IP Multicast side-by-side with unicast-based applications asthey compete for resources provides total visibility and context into theglobal networking environment. For instance, a network manager canview how e-mail, Citrix, and other unicast business applications are usingthe network alongside IP Multicast traffic to determine how they areimpacting one another. Therefore, IT professionals gain the knowledgeand insight they need to ensure service levels, detect and more quicklytroubleshoot degradations, support intelligent capacity planning andreport performance results to the enterprise.

The nGenius Solution provides granular visibility into IP Multicast from theData Link through Application layers.

Custom groups provide business-relevant reports

over-IP service is consuming more bandwidth than projected, adverselyimpacting the IP Multicast inventory update stream or whether the culpritis a high-bandwidth video replay of last night’s sporting event. Regardlessof the problem source, the nGenius Solution with its contextual perspec-tive can show whether one application is consuming more than its fairshare of bandwidth, who the users are, whether the traffic is legitimate,and whether the activity is taking place at an appropriate time.

Network forensics for microburst analysis

Traffic microbursts can severely disrupt the flow of critical streaming IPMulticast applications, yet they are often hard to isolate, and as a result,create inexplicable performance degradations. To investigate intermittentperformance issues, the nGenius Solution continuously captures andstores a complete packet-by-packet audit trail to support post-eventreconstruction. The web-based user interface combines intuitive graphicalviews, a powerful decode engine, and sub-second granularity to provideat-a-glance identification and quick resolution of difficult, subtle, or inter-mittent network problems.

Scenario:

The London office of a global brokerage firm had been complaining aboutintermittent performance problems with their networked application.Usually these user complaints came after the event had occurred. The ITorganization suspected a microburst, but since the problem was intermit-tent they were having trouble isolating the cause. To get at the root of theissue, they installed an nGenius® Flow Recorder on the segment to workin conjunction with the firm’s already-existing nGenius® Probes to recordall packets that were traversing the London link.

Within a short period of time, the problem reoccurred. This time, the ITgroup had all the information needed to recreate the event and figure outwhat had occurred so they could prevent it from reoccurring.

4

1. By specifying the time frame during whichthe event occurred, they quickly determined thehot spot to investigate and easily drilled intothe sub-second traffic spike.

2. This screen displays the Top Applications asso-ciated with the event. The application consumingthe most bandwidth was IP Multicast. In orderto further discover the cause, they looked deeperinto the details…

3...to discover the source of the problem. Thegraph shows that their data provider was over-flooding their WAN link. Upon speaking withthe service provider, the issue was resolved.

To create business-relevant definitions of networked data, the IT group cancreate application groups and custom location groups that reflect the organi-zational structure. From group summary reports, the IT operator can quicklydrill down to see the individual applications, locations, users, and/or conver-sations contributing to that activity. Examples of custom groups include:

• Application groups: segregate group applications into business-relevant cat-egories. For example, IP Multicast groups may have been defined as,“Training,” “Reuters Feed,” and “Database Updates,” as unique applicationsin the nGenius Solution. However, these applications can be further classi-fied by associating them to an application group, for example “IP Multicast.”

• Custom locations: create a group of physical or logical segments that identifybusiness groups. For example, location (Asia), department (Finance), orimportant business unit (Trading Floor).

This NewsPaper report shows a custom application group “Market Data”which is the second most utilized application group for the custom locationgroup “Regional HQs.”

5

Managing the Performance of Critical Applications: IP Multicast

This historical report identifies which publishers were most active for theweek in the London office. Are there servers where you could redistributeload? To view the groups each server publishes to, look further into theconversation details.

Forecasting application and network growth

Many factors affect the continued growth of network traffic – new initiativessuch as corporate communications over IP Multicast or even unsanctionedusage like streaming radio. It is essential to predict trends in order toproactively avoid congestion that might disrupt critical network processes,to manage the budget, and to understand the application usage of end-users.The nGenius Solution projects growth rates and forecasts the number ofdays until bandwidth reaches a user-defined percentage utilization. Twotypes of forecasts are available to examine long-term trends.

• Application forecasts are used to gauge the growth of and demand foran application, such as an IP Multicast-based market data application,and to gain insight into the impact that growth has on bandwidthacross the enterprise and key network segments. Supporting detailsshow volume, utilization, hosts, and conversations between IPMulticast publishers and groups.

• Segment and circuit forecasts illustrate how quickly traffic in key networklocations is growing, so that congestion can be proactively avoided, andall applications running across the segment, including IP Multicast, canflow freely. Supporting details of segment and circuit forecasts demon-strate which applications contribute to bandwidth growth.

This application forecast shows that IP Multicast traffic is increasing onthe link to the New York office. Drilling down into the IP Multicast appli-cation, one can ascertain the publishers and groups contributing to thegrowth at that location.

Profile IP Multicast behavior and plan global capacity

Today, understanding network and application trends is as equally importantto an IT organization as troubleshooting. Adequate capacity is particularlycrucial in the case of IP Multicast applications since they are UDP based(best effort delivery) and need sufficient bandwidth to prevent dropped orout-of-sequence packets. The nGenius Solution provides the application-level historical reports needed to ensure adequate space to supportnetworked business services. These baselines and forecasts enablenetwork engineers to fine-tune traffic flows across the enterprise,understand normal behavior patterns of IP Multicast, and accurately planfor long-term network and application growth.

Identifying IP Multicast publishers and groups activity

The nGenius Solution provides the ability to view application hosts andconversations on the network – who is talking to whom, at what time ofday, and using what application – revealing how valuable networkresources are being consumed. In the case of IP Multicast applications,conversations expose traffic between IP Multicast publishers and groups– giving IT insight into how the business is using IP Multicast and whichgroups may be generating the most interest.

Evaluating IP Multicast activity

The nGenius Solution supplies invaluable information for evaluating IPMulticast design and deployment issues. By automatically aggregatinginformation from across the enterprise, the nGenius Solution demon-strates how much IP Multicast traffic is moving through the network, aswell as across the various locations and departments within the corporation.A pattern of behavior, a baseline, of an application is mathematicallyconstructed from historical metrics gathered over a period of time –typically 30 days. This information helps to evaluate how an applicationimpacts a given segment or the other applications that share or competefor bandwidth.

Traffic engineering across the enterpriseThe nGenius Solution provides a complete picture for planning capacity byaggregating data from across the global network, incorporating such datasources as NetScout’s own nGenius Probes, Cisco’s NetFlow, and SNMP-enabled infrastructure devices. From these broad base of data sources thenGenius Solution constructs enterprise-wide reports of most- and least-utilized segments, circuits, server ports, switch ports, and/or router interfaces.Reviewing the traffic baseline at a particular location identifies whether ornot there is enough capacity to support new business applications.

Information on over- and under-utilized segments is very helpful in makingcritical decisions about whether to downgrade a link, add or restructurecapacity in order to optimize quality of services delivered to end users. Justas with the real-time views, all enterprise-wide historical reports containcontext-sensitive information from which a network engineer can drill-downto more detailed information in areas that warrant further investigation.

RouterServer

RouterSwitch

IP Multicast Source Join 230.100.100.100

Join 230.100.100.100

Stock Market Feed230.100.100.100

Market Traders

Probe

Probe

Munich

Probe

Market Traders

Boston

Router

6

Scenario:

The traffic engineers in a global retail chain were analyzing capacity todetermine needed upgrades for an upcoming budget. Of particular con-cerns in the European region were complaints from the London officeabout slow response from the inventory database, which was updatedperiodically throughout each day via IP Multicast.

Examining the utilization forecast for the European locations showed thatLondon was quickly reaching overcapacity.

Looking further into the details of that segment, they discovered that theirCitrix traffic was traveling over the WAN when it was suppose to be alocal area application. Measures were taken to reconfigure the Citrixenvironment. Afterwards the growth trend for the London location wasonce again stable, putting off the need for an upgrade.

Special Case: Join IP Multicast sessions

NetScout’s nGenius Probe can join one or more IP Multicast groups, justas an end user client does. This capability not only provides visibility intothe IP Multicast applications at that location independent of what the endusers are doing, but also observes all other applications flowing in andout, showing IP Multicast in full context. The join capability is valuable introubleshooting IP Multicast problems on-demand, to isolate network vs.end-user problems without the need to access the users’ desktop.

Custom reports provide job-relevant information

The nGenius Solution gathers and stores a broad and deep collectionof application-level data from physical and logical network segmentsacross the enterprise. While each piece of data may be relevant tovarious individuals in an organization, no one has the time to sortthrough an entire database to find the key pieces of data relevant to his job.

The nGenius Solution provides information from high-level, enterprise-wide summaries down to meticulous details in order to suit individualinformation needs. A user can tailor real-time and historical reportsto display only those graphs and tables that are critical to his job,such as information on a particular business application, location, orservice. Both on-demand and scheduled reports can be deliveredvia the web or email to IT and business managers. Examplesinclude:

• Real-time Workspaces: Any combination of metric, data source,graph, or table can be displayed side-by-side in a dashboard-typepresentation. Views of key information that are required on a regularbasis can be created and saved for later one-click access.Alternatively, an IT operator can easily turn his graphicalWorkspace into an annotated report on-demand to send to colleagues or even schedule it for recurring email delivery.

• Historical NewsPapers: These web-based, newspaper-style historical reports contain sections and articles – just as a standardnewspaper does. Sections include Executive Summary, CapacityPlanning, Response Time, Situations-To-Watch, and Assets, eachwith articles that correspond to those topics. Individually tailoredNewsPapers can be scheduled, containing only sections andarticles that the individual would be interested in viewing. Forexample, a network engineer working as part of a team rollingout a new IP Multicast application may only be interested inseeing three articles: “Most Utilized Segments,” “Most ActiveApplications,” and “Segment Forecasts.”

Scenario:

The IT department at a large US energy cooperative received a call froma newly hired energy broker in the Boston office complaining that shewas not receiving the Multicast-based Commodities data feed – a criti-cal application for her job.

Opening a view of the Boston location in nGenius Performance Manager,they saw that there was no Commodities application flowing.

To isolate the source of the problem to the network or the client, the net-work manager quickly configured the Boston-based nGenius Probe to sub-scribe to the IP Multicast Commodities group.

After joining the session, the nGenius Probe observed IP Multicast trafficin Boston, showing that the Commodities application was operational andthe network was okay.

The trouble ticket was assigned back to the help desk to check the healthof the client’s PC and ascertain whether it had sufficient memory to sup-port the market data application or whether she needed something morepowerful to do her job.

Special Case: IP Multicast in TIBCO environments

IP Multicast applications use the UDP transport protocol which inherentlycomes with reliability issues. IP Multicast over UDP has no acknowledgementmechanism to indicate that the client has received information, and there-fore provides no guarantees for delivery, no protection from duplication,and no provision for error reporting if the packets are not delivered. Whena packet is missed by a receiver, it is not retransmitted, it is simply lost.

For the most time- and mission-critical IP Multicast applications likestreaming market data, reliability is paramount. For example, a brokeragefirm using IP Multicast to deliver stock quotes requires prompt and timelydelivery of price changes. As a result, middleware applications that addreliability to IP Multicast, such as TIBCO, have become increasinglypopular in many enterprise networks. TIBCO uses negative acknowledge-ment techniques to supply reliable IP Multicast to end-users. TIBCOprotocol messages such as retransmissions, bad packets, null packets,and sequence gaps all aid in delivering reliable IP Multicast data.

The nGenius System can identify the TIBCO protocol messages and trackthem as unique, networked applications. As such, they are treated likeany other application, with the collection of volume, utilization, hosts, andconversation statistics, which can be aggregated and displayed in real-time and historical reports. This distinctive capability provides a strongtroubleshooting tool, with insight into who is generating errors and whomthey affect. In addition, as with any networked application, the nGeniusSolution can be configured to generate an alarm on TIBCO traffic – a par-ticularly useful tool to identify the appearance of TIBCO errors.

This screen displays TIBCO Retransmissions tracked as a unique applica-tion in nGenius Performance Manager. The conversation details pinpointthe originator of the retransmissions.

7

Managing the Performance of Critical Applications: IP Multicast

8

NetScout Systems, Inc.Corporate Headquarters310 Littleton RoadWestford, MA 01886 USATelephone (978) 614-4000Fax (978) 614-4004Web: www.netscout.com

EuropeRegus House268 Bath RoadSlough, Berkshire, SL1 4DX UKPhone: +44 1753 725561Fax: +44 1753 725562

Asia/PacificRoom 105, 17F/B, No. 167Tun Hua N. RoadTaipei, TaiwanTelephone +886 2 2717 1999Fax +886 2 2547 7010

The nGenius® Solution is comprisedof nGenius® Performance Manager,nGenius® Probes and for specializedsituations, additional appliancesincluding nGenius® Flow Collectorand nGenius® Flow Recorder.

nGenius Performance Manager is a software application that analyzesthe information collected by nGeniusProbes as well as other network devices,and delivers the features and functionsof multiple performance managementdisciplines in a single product.

nGenius Probes are hardware monitoringdevices that are the industry’s mostadvanced sources for identifying, collecting and analyzing application-level traffic data across the enterprise.

nGenius Flow Collectors are dedicatedhardware devices optimized for collectingapplication conversation data viaNetFlow records produced by leadingnetwork infrastructure devices.

nGenius Flow Recorder is an appliancethat couples storage for large packettrace captures and graphics-based datamining software. It continuously recordsall traffic and produces a network audittrail for post-event forensics requiringfull packet payload details.

©2005 NetScout Systems, Inc. All rights reserved.NetScout and the NetScout logo, nGenius and Quantivaare registered trademarks of NetScout Systems, Inc. TheCDM logo, MasterCare and the MasterCare logo aretrademarks of NetScout Systems, Inc. Other brands,product names and trademarks are property of theirrespective owners. NetScout reserves the right, at itssole discretion, to make changes at any time in its tech-nical information and specifications, and service andsupport programs.

CC-0190-05 Rev A

Conclusion

IP Multicast has become an increasingly important technology for the cost-effective, bandwidth-conservingdelivery of simultaneous-user and media-rich applications. The nGenius Performance Management Solutionincorporates real-time and historical reporting of all applications, including those delivered via IP Multicast,which eliminates the need for separate products to manage each individual application. Displaying IPMulticast and unicast applications side by side as they compete for bandwidth and resources provides totalvisibility and context into the network. Therefore, IT professionals gain the knowledge and insight they needto ensure service levels, detect and more quickly troubleshoot degradations, support intelligent capacityplanning and report performance results to the enterprise.

The solution is distinguished in the market by the following:

Detailed visibility into IP Multicast applications

The nGenius Solution tracks IP Multicast groups (e.g., Tech Stocks, Derivatives, Commodities) and TIBCO protocolmessages (e.g., Retransmissions, Out-of-Sequence) as unique applications, collecting volume, utilization, user,and conversation statistics. The data is made available for multiple purposes, including troubleshooting,capacity planning, forensic analysis, application and network monitoring through the nGenius Solution, andmodeling, usage-based billing, expert analysis, and intrusion detection through 3rd-party software.

Special IP Multicast diagnostic tools

NetScout has developed distinctive troubleshooting functionality specifically to identify and diagnoseproblems with IP Multicast applications. These include the capability to join IP Multicast sessions to isolatenetwork vs. end-user problems and the ability to alarm on TIBCO retransmissions and other error types touncover who is generating them and whom they effect.

Network forensics for microburst analysis

Traffic microbursts can severely disrupt the flow of critical streaming IP Multicast applications and becausethey happen in such a short span of time, they are often hard to isolate. For investigating this type ofintermittent performance issue, the nGenius Solution can continuously capture and store a complete pack-et-by-packet audit trail to support at-a-glance identification and quick resolution of difficult, subtle, and inter-mittent network problems.

Optimizing IP Multicast traffic flows

To aid in application design and deployment, the nGenius Solution aggregates and reports upon traffic flowsfrom groups of IP Multicast servers in order to ascertain how much volume is traversing the enterprise, acrossbusiness units, locations, and departments. This invaluable information can be used to optimize the delivery ofkey financial applications across the globe.

Breadth of support

Its ability to provide flexible configuration options. Where IP Multicast is supported by the full range ofnGenius Probes (WAN, ATM, LAN, POS, etc.), IT staff can deploy any of them at the best vantage point in thenetwork based on server concentration, practical usage, or budgets.