Cheshire Cat Computing

Let's assume that I am already collecting the usage of a particular interface on a particular router as well as the usage of (hopefully) all of the hosts passing traffic through that interface. What is the best way to visualize this information in a single graph? It is likely going to be quite acceptable to have separate graphs for inbound and outbound graphs. Or maybe a mirror graph of input and output with each mirror looking like I describe below...

I think I want a stacked graph, going by it's name, although I'm not sure if it's what I have a picture of in my head.

I'm imagining a graph that looks like a layer cake where each layer represents one of the nodes' usage for the sample period. Ideally that "layer cake" is overlaid on top of the total bandwidth so that any difference between the aggregate of the nodes and the total bandwidth appears as another "layer" on the top. Maybe it's better to plot the total bandwidth as a line on top of the "layer cake" graph so that it's more obvious where the line goes strays below and above the aggregate bandwidth of the nodes. If the measurements are accurate and complete, the line should follow the top of the top layer. But I like checks and balances, hence the line -- to prove the measurements are complete and accurate.

Maybe there's a better visualization model for what I want to see. I'm open to suggestions.

Basically, I am looking at the total usage of a router interface and then trying to show what all is contributing to that use. Eventually, I want to break even the total host usage down into protocols (more accurately, ports). I have not yet decided if I want to do that on the same graph (i.e. where each host "layer" is broken into protocol layers) or maybe have separate graphs for each host. I guess I will see how busy the single graph gets.

Does anyone have a configuration example of this they wish to share? I'm new with routers2.cgi so any help appreciated.

A stacked graph sounds like the way to go - the various components can be graphed as stacking with two separate graphs for Incoming and Outgoing, or else use the stackmirror graph to have a mirrored stacked graph with incoming above the X-axis and outgoing below.

The one thing you cant do (yet) is to have the separate unstacked line on top of the graph -- although you can have an unstacked Total or Average line. Possibly, you could get your data collection to collect the 'all other data' count, so stacking all of these would make the actual total? This is in fact what I do for my home network, graphing network usage by individual machines and then 'all other traffic' so I can render it as a stacked graph with a total line.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hrm. That sounds quite interesting. An unstacked Total line sounds like what I want.
As a remainder of the total for the interface minus the traffic accounted for, or as the actual total for the interface? I suspect you mean the former, and I do intend to have that on my graph, but I wanted to also graph the interface's actual total on top as a "double check" that I am getting everything in stacks. I like checks and balances. If I am doing it all correctly, the total line will follow the top of the top stack and I know I am correctly accounting for everything. If it deviates, then I have to recheck my work.
I don't suppose you have it posted as an example somewhere do you? It does sound like what I am looking for. The "total line" sounds interesting.

For my home network, I collect something like

a: Bytes in/out for laptop A
b: Bytes in/out for laptop B
...etc...
z: All other in/out traffic not previously accounted for

Then, I graph a,b,...z as a stacked userdefined graph, with the 'total' option -- this adds an additional non-stacked line for (a+b+...+z) over the top of the graph.

I don't have the code on hand for this, but it's pretty simple... just add Targets for a, b, ... z and then add the 'routers.cgi*Graph[]:mygraph total' directive to each of them. Finally add 'routers.cgi*GraphStyle[mygraph]:stackmirror' to get the new graph stacked and mirrored (or use options:noo and GraphStyle stack)

My data is collected by having a special logging chain set up in iptables on the linux router with rules for the various source IPs, plus a catch-all rule at the end, and querying the per-rule octet counts.

This is explained in the example in section 6.2 of Chapter 7 in the MRTG/RRD/Routers2 book... http://www.steveshipway.org/book (pp186-189 in the Second Edition)

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Ahhh. So the total (z) is a calculated total of all of stacks, not an independent measurement? I want it to be from an independent measurement to act as a check and balance against what should be the total in all of the stacks.

No, the Total is a + b + c + d + ... + z (a-z are targets).

Steve is getting his traffic accounting from iptables, not from the InOctets/OutOctets MIBs. Thus, he has separate iptables rules to count traffic for each IP behind the firewall. And then another rule at the end to count "everything else". That "everything else" rule is "z" in his example.

That's exactly what I am doing to. And I do understand what is meant by the "z" target, which is just everything not accounted for by the other targets.
He and I are doing the exact same thing.

I just want to add another item to my graph which is the {In,Out}Octets of the interface. If I am accounting for everything in the targets that make up the stacks of the graph my *Octets item on the graph should ride along identical to the top of the stack. Which is good. If I am missing something then there will be a discrepancy. This is my "sanity check" that I am accounting in all of the targets successfully.

I could just "flip" between two graphs, especially if I have totals enabled and compare them, but seeing them all in the same graph makes it so much easier.

If you add the 'total' option to the user defined graph, it will add a new line (along with the avg, max, etc) for a+b+...+z which should be the same as the ifInOctets/ifOutOctets, provided you've set up your iptables rules correctly. You could also set up a separate Target for this and flip between them to check, as you say. There's just no way as yet to have a userdefined graph with some Targets stacked and others superimposed.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Is there a way to get a total for the totals on such a graph? That is, when I view my stacked graph with the "95th percentile and total for the period" enabled, I get period (i.e. daily, weekly, etc.) totals below the graphs for each of the targets in my stacked graph, but not a "period total" for all of that new "total" line.

If I had a period total for that stack total I should be able to look at the period (i.e Daily) total for the interface (using it's InOctets/OutOctets MIBs) and compare.

As it is, even doing the rough math on the totals on my stacked graph, they are waaaay out of whack with what the InOctets MIB says for the interface, so I am missing something somewhere.