How does the Core Controller manage traffic flow?

Summary

The Core Controller manages traffic flow by distributing traffic from a 10GbE segment to its associated iLinks. The flow manager guarantees traffic flow affinity, so that all traffic associated with a flow of packets is routed to the same IPS segment. For example, traffic that enters the Core Controller on Port A of 10GbE Segment 1 is sent out on Port B of 10GbE Segment 1 after it has been processed by the IPS. The flow manager applies one of four algorithms to incoming traffic. These algorithms examine IP protocol, source IP addresses, and destination IP addresses and use this information to route the traffic to iLinks. The most suitable algorithm will vary depending on your network traffic.

The flow manager statistics track performance for all four algorithms on each segment at all times, so that by viewing the statistics, you can see which algorithms are the best-performing. The Core Controller retains the last 24 hours of performance statistics. The best way to view these statistics is through the TippingPoint SMS. Refer to the TippingPoint Security Management System User's Guide for more information.

Note: The flow manager does not dynamically adjust algorithm usage to your traffic flow. To select the most appropriate algorithm, you should use the flow manager learning mode to analyze traffic, or view the flow manager statistics with the show flow-manager stats command or with the SMS.

Details

Packet Processing

The Core Controller flow manager supports both IPv4 and IPv6 traffic. The following tunnel types are load balanced by the flow manager:

-802.1q (VLAN), ethType==0x8100
-802.1ad, ethType==0x88a8
-ethType==0x9100

Packet frames larger than 1548 bytes are "shunted". They are not sent through the flow manager or to the IPS devices, and are sent back out onto the network.

Variance and Deviation

Variance: The variance of an iLink measures its evenness relative to the average traffic distribution across iLinks, and a low variance indicates that each iLink is receiving an even traffic distribution. A perfect algorithm would have a completely even traffic distribution.

Deviation: The deviation of an iLink reflects the extent to which the iLink's traffic deviates from the mean traffic distribution. iLinks with a high level of deviation can cause congestion. When this happens, you should review the algorithm statistics and select load balancing algorithms that reduce the deviation.

Flow Manager Learning Mode

The Core Controller includes a learning mode for the flow manager, which you can enable with the conf t flow-manager learn start command.

In learning mode, the Core Controller behaves as if it were in Layer-2 Fallback mode. Traffic is not sent through the iLinks and is sent back out through the 10GbE segment. However, in learning mode, the traffic is also sent through the flow manager so that you can view the performance of the flow manager algorithms. After you view the algorithm statistics, you can use this information to specify the algorithms that you want to use on particular segments or across all Core Controller segments.

Configuring Flow Manager Algorithms

Use the conf t flow-manager algorithm command to assign flow manager (load-balancing) algorithms to 10GbE segments. Algorithms not assigned to specific segments are applied to all three 10GbE segments. To view the current flow manager configuration and information, use the show flow-manager command.

Configuring Flow Management Rules

Flow management rules direct traffic to iLinks based on various parameter values. The config t flow-mgmt rule command enables, disables, or removes a flow management rule, and includes or excludes an iLink from the default flow management rule. Flow management rules are identified by a <rule_name> that is assigned when the rule is created. Use the show flow-mgmt-rule command to view flow management rule information.