Heavy Traffic Situations

Impact

High traffic segments, especially segments with large frame sizes (> 1500 bytes) can cause congestion conditions at the tracing workstation. This congestion is due to the inability of the LAN adapter hardware to process the volume of frames fast enough. If the arrival rate of new frames is higher than the rate at which the LAN hardware can process the frames, then frames will be dropped.

This will manifest itself in the trace as lost frames.

High Utilization

Traffic volume has two dimensions:

volume = number of frames * average frame size

LAN utilization is the ratio of this volume to the maximum volume (bandwidth) of the LAN media:

utilization = actual volume / maximum volume

Volume and the corresponding utilization should be measured to obtain a profile of the LAN segment in question. By understanding the peak traffic volumes which exist on a LAN segment, a strategy can be designed to most effectively trace and monitor this environment. Network Trace provides these statistics when it is tracing. These can be gathered over a representative period of time to build a performance profile for the LAN segment.

Identifying Heavy Traffic Situations

To identify heavy traffic situations, look for the following conditions:

Large numbers of nodes per segment.

Segments which have a large number of machines will usually have a steady flow of heavy traffic.
Utilization will be high and will stay at these high levels during peak usage hours.

Systems which transfer large amounts of data in batch mode or in bursts.

WSOD/RIPL client boot is an example of a "burst" of large data transfer.
Nightly change control or file transfer is an example of batch.
In both cases, the network impact may be significant, in terms of utilization.

Large frame sizes.

Large file transfers will often maximize the size of frames being sent.
This is done to optimize the use of the network while minimizing the overhead associated with sending and receiving frames.
The generated frames may be larger than average, leading to longer latency in the copying of frames from the network (and thus, greater chances of lost frames).
The existence of such frames will bias traditional NDIS frame copying routines such that it is more likely that small frames are dropped, because a great amount of time is spent copying large frames.
On some media types (Token-Ring) this problem can be more significant as the maximum frame size can be very large (approximately 18000 bytes).

Resolution

The most important possible resolution is to leverage the capabilities of the Service mode of NTRACE. Service mode has significant design and implementation advantages over the protocol mode and will handle much heavier traffic volumes than the Protocol mode.

When the LAN hardware receives a frame, it notifies the MAC driver and allows this driver and the NDIS protocols an opportunity to copy this frame. However, while this frame is being copied, the LAN hardware's ability to receive new frames is disabled to serialize the process of frame reception. The hardware might buffer new frames, but they cannot be copied into the memory under the control of the NDIS protocols, until the current frame has been received. To do otherwise might cause sequencing problems for protocols that are session oriented. In addition, any other approach would cause the NDIS environment to be unstable or overly complex. This would lead to other performance problems. Unfortunately, if the incoming traffic exceeds the LAN hardware's buffers AND the ability of the NDIS environment to maintain an adequate rate of copying, then frames will get dropped.

In particular, the Service mode is designed to minimize the time spent processing frames while the LAN hardware has reception of new frames disabled. Due to its presence as a layer in the NDIS environment, the Service mode NTRACE can avoid copying the entire frame at this crucial time and maximize the amount of work done on a "post processing" basis, when frame reception has been re-enabled. The Protocol mode NTRACE cannot provide this same feature because it resides at a different location in the NDIS hierarchy. In heavy traffic situations it is imperative that Service mode be used.

Please see the section on lost frames for more details on possible resolutions.

In particular, segments with large numbers of nodes or high traffic are strong candidates for redundant installations, since this provides the flexibility to use the most appropriate machine for a particular trace.