Table of Contents

Monitoring traffic distribution by class

SSG allows traffic distribution by class to be monitored.

1. Enable traffic prioritization. For the example, we will use the following prioritization rules: 

dns cs0
http cs0
https cs0
Bittorrent cs7
ICMP cs0
TCP Unknown cs7
GOOGLEVIDEO cs1
default cs2

2. In the /etc/dpi/fastdpi.conf configuration, set the parameter: 

dbg_log_mask=0x4

3. Enable common channel polysync (the example shown is polysync with full channel width restriction): 

htb_inbound_root=rate 1300mbit 
htb_inbound_class0=rate 8bit ceil 1300mbit
htb_inbound_class1=rate 8bit ceil 1300mbit
htb_inbound_class2=rate 8bit ceil 1300mbit
htb_inbound_class3=rate 8bit ceil 1300mbit
htb_inbound_class4=rate 8bit ceil 1300mbit
htb_inbound_class5=rate 8bit ceil 1300mbit
htb_inbound_class6=rate 8bit  ceil 1300mbit
htb_inbound_class7=rate 8bit  ceil 1300mbit
htb_root=rate 1300mbit 
htb_class0=rate 8bit ceil 1300mbit
htb_class1=rate 8bit ceil 1300mbit
htb_class2=rate 8bit ceil 1300mbit
htb_class3=rate 8bit ceil 1300mbit
htb_class4=rate 8bit ceil 1300mbit
htb_class5=rate 8bit ceil 1300mbit
htb_class6=rate 8bit  ceil 1300mbit
htb_class7=rate 8bit  ceil 1300mbit

4. Update the configuration: 

service fastdpi reload
If polyscing for a shared channel is applied for the first time, you must restart the service: 
service fastdpi restart

5. Use the following custom settings for the zabbix agent installed on the SSG: ssg_userparams.conf

6. Import the template to the Zabbix server as described in the section "Monitoring via SNMP agent": zbx_export_templates.xml

If necessary, change the interface names in the template and in the custom parameter file

View flow and protocol statistics

By flow

  1. IPv4/IPv6
  2. protocol type: 0 - IPv4, 1 - IPv6
  3. total allocated records
  4. a queue with a short lifespan:
    1. occupied records
    2. reusable
    3. difference 3.1 - 3.2 (number of active flows)
  5. also for the long line
  6. also total

Example:

fdpi_ctrl stat --flow
IPv4 0 6784000 834 814 20 0 0 0 834 814 20

By protocols

  1. internal index of protocol statistics
  2. protocol name
  3. protocol port number
    direction subs -→ inet
  4. number of packages
  5. volume in bytes ip total
  6. dropped packages
  7. dropped byte
    direction inet -→ subs number of packages etc.

Example:

fdpi_ctrl stat --proto
Autodetected fastdpi params : dev='em1', port=29001
connecting 94.140.198.68:29001 ...
 
================================
94 'ntp' 123 0 0 0 0 91 23569 0 0
4081 'sip' 5060 0 0 0 0 2479 1170579 0 0
5812 'Bittorrent' 49165 0 0 0 0 0 0 3 495
5866 'ICMP' 65025 0 0 0 0 225 18900 0 0
5871 'TCP Unknown' 65030 0 0 0 0 41034 3448836 0 0
5880 'UDP Unknown' 65041 3900 4227600 0 0 277 24825 0 0
6000 'ARP' 65282 30 2520 0 0 30 2520 0 0
6056 'CHAMELEON' 49236 0 0 0 0 589 72475 0 0