Path: utzoo!censor!geac!torsqnt!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!elroy.jpl.nasa.gov!ncar!boulder!daemon
From: forster@cisco.com (Jim Forster)
Newsgroups: comp.dcom.sys.cisco
Subject: Re: Cisco IP accounting
Message-ID: <29409@boulder.Colorado.EDU>
Date: 8 Nov 90 10:40:38 GMT
Sender: daemon@boulder.Colorado.EDU
Lines: 26

I thought I'd add a bit of background to the discussion:

When we did the IP accounting, we envisioned the need for two crucial
pieces -- lots of memory dedicated to the accounting function, and a fairly
sophisticated "back end" data base application to crunch the raw data into
useful form.  If you dedicate 1 Mbyte of memory to IP accounting, then
there is enough room to hold over 30,000 accounting entries.  We guessed
that this would be enough entries for at least 15 minutes of traffic for a
busy hub (anyone care to contribute some data confirming or disproving
this?).  We also knew that 30,000 raw accounting entries is useless unless
digested into a convenient form.  That's where the sophisticated DB
application comes in -- it can massage the data into per-subnet, or any
other arbitrary billing grouping desired.  

The advantage of collecting the raw data as per-host is that it's less
effort for the router, and you don't throw away information that may be
useful.  The disadvantage is that you need a lot of memory, and you
probably don't want to use SNMP Get-next's to read 30,000 entries.
Unfortunately, no one has done the type of application that we envisioned.


Our 8.2 release will add accounting access lists, to specify what
packets should be counted, and an option to only count packets sourced
from or destined to a connected network.

  -- Jim