\chapter{Physical Network Management}
\label{ch:physical}



\section{Performance management}

There are quite a few metrics for network performance and therefore analysis must be done. Three parameter groups for signaling network performance are~\cite{b7}:
\begin{itemize}
\item Message delay
\item Signalling traffic load
\item Error rate
\end{itemize}

The most commonly used network performance characteristics are~\cite[page 92]{b4}
\begin{itemize}
\item response time (average, long term variation): indicator of the performance, the lower the better, 
should be predictable
\item transaction time: some transactions may be configured to have priority over other transactions
\item utilization (memory and disk, CPU, network utilization)
\item delay
\item jitter or delay variation, comes from the variation of the delay generated by the transmission equipment 
\item collision rate
\item protocol overhead and efficiency
\item maximum number of concurrent users
\item time to perform a large file transfer
\item time to display a colour image
\item dropped packet rate and retransmissions
\end{itemize}

The operator determines with a help of these metrics, which are the critical segments of the network and whether it is essential to expand recourses. As the mobile and wireless networks become more common, new problems arise: limited bandwidth, and implementing secure and reliable connections handovers~\cite{b28}.

\subsection{Measuring quality of service}

Functionality is measured by the types of services that can be accessed across the network. For example, the time is important metric in copying large files across the network. Internet service providers have used ping and traceroute to detect and diagnose network problems. Application servers, routers and terminal servers in the different post office protocols (POPs) can be targets for  network connectivity and delay measurements. Ping and traceroute give an indication of the changes in the network characteristics, but these tools are not sufficient to quantify the impact of these changes on availability and performance of customer-visible services~\cite{b23}.

There are many components that impact the QoS being delivered. For some network components only limited amounts of data have been available. The measured values can often only indirectly describe the quality of service.

For services that use TCP, useful network performance metrics are for example throughput, defined as the rate of reliable transmission of packets between a source and a destination, response times, transactions in a period of time, availability in mean time between failure (MTBF), hours of downtime and time to restore, CPU uptime and network congestion~\cite{b4}.

There are problems in using IP network with communication applications. IP network was originally planned to the transmission of text data and there were no special needs for real time data communication. That is why there were no variables to quantify real time data transfer. Now the service level management needs to offer to end users availability, performance and accuracy. Managing the quality of service, there is no value in reporting such data as packets dropped, network latency, repair interval for network outages, etc~\cite{b31}.

If perfect service is not possible, then it is necessary to determine what level of service is acceptable. The problem is that service provider lacks some of the necessary information. They do not have adequate information about the value of the service to the client organization~\cite{b31}. The quality of service or class of service can be connected to address, to protocol or to some else property of transmission. The other method is that the application of the workstation tells to the network what level of service it needs. Microsoft will integrate in future Windows versions properties needed in using class of service. In the future application software can request services of the network with Winsock 2.0 interface. Network applications must be changed to use new interface and class of service~\cite{b12}.

\subsection{Analysis}

Analysis becomes more important, when networks increase in size and in complexity. Analyzers are used for traffic monitoring, protocol analysis and statistics collection and interpretation. Analyzers are understood as troubleshooting tools, but they should be used as proactive indicators as well.

The tools available today typically gather and display volumes of detailed data rather than interpret and highlight the meaning of the data. Many of these tools look at a single element rather than the network as a whole. Data becomes information when it is organized, correlated and presented in ways that make clear its meaning, helping the network manager make the best decisions~\cite{b16}. It is important to analyze the network up to date. Managers must also predict future trends based on historical network trends and business information.

Before the expert systems, alarms and events were checked manually by the operators. A stream of detailed data means by itself a little. Effective information is compact. The network management problem thus becomes an information management problem. Now expert systems are tested in the automation of this process. Various expert systems can be used in the network management. There are several artificial techniques that can be used, such as Rule-Based Reasoning (RBR), bayesian networks (BN), neural networks (NN), Case-Based Reasoning (CBR), Qualitative Reasoning (QR) and Model-Based Reasoning (MBR)~\cite{b1}.

\section{Fault management}

Physical network problems account more than half of all network problems. Technicians spend most of their time locating the origins of such problems (fiber cut, the earth is incorrect, adapter is broken or incorrectly joined). This costs network providers time and money. Network management systems have also traditionally focused on the logical connection between the end user and the network destination, since most network problems have been a result of errors created by software applications~\cite{b24}. Finding and repairing failures of software applications is usually difficult, in such a case that the workstation sends but does not receive packets, too many collisions occur or frames are too short or too long.

Fault management is troubleshooting, fault isolation and fault correction. There are two mechanisms of transferring network management information from a managed entity to the manager: polling and sending alerts. Alerts are information delivered to a manager that is not the result of a specific query. Advantages and disadvantages exist within each method. Most network management systems use an optimal combination of alerts and polling. Doing so maintains the advantages of each and eliminates the disadvantages of pure polling~\cite{b26}.

Today, the process of fault management needs to be automated. Rapid and accurate correction of network problems need to be created by the network or by the end user. The root problem is a network fault, which the network manager should investigate and repair. It is important to clearly define the problem so that it describes the root problem, not a symptom~\cite{b22}. Even if the entire network were violated, the network management application should work~\cite{b25}.

Expert systems provide an efficient and cost effective way of automating network fault management. By automating fault management, problems and possible diagnosis can be done faster and more efficiently. Problematic for rule-based expert systems is the real time performance~\cite{b8}. By expert systems bounds on response times are difficult to establish. There are also risks pushing the limits of automation through the introduction of new or only partially proven technologies.

\subsection{Polling}

Most systems poll the managed objects, search for error conditions and illustrate the problem in a graphic format or a textual message. There are two polling disadvantages: response time for problem detection and volume of network management traffic~\cite{b26}.

Having to poll many management information base (MIB) variables per machine on a large number of machines is itself a problem. The ability to monitor such a system is limited. If a system fail shortly after being polled, there may be a significant delay before it is polled again. During this time, the manager must assume that a failing system is acceptable. While improving the mean time to detect failures, it might not greatly improve the time to correct the failure. The problem will generally not be repaired until it is detected.

Polling many objects on many machines increases the amount of network management traffic flowing across the network. It is possible to minimize this through the use of hierarchies (polling a machine for a general status of all the machines it polls). Anyway, the response time will be a problem~\cite{b26}.

\subsection{Sending alerts}

The problems of sending alerts are potential loss of critical information and possibility to over-inform the manager. They may also fail to be delivered, and critical information may be lost. Alerts are usually not to be delivered when the managed entity fails or the network experiences problems. It is important to remember that failing machines and networks can not be trusted to inform a manager that they are failing.

Alerts in a failing system can be generated so rapidly that they impact functioning resources. An "open loop" system in which the flow of alerts to a manager is fully asynchronous can result in an excess of alerts being delivered. There may be a situation where all available network bandwidth into the manager is saturated with incoming alerts and this could prevent the manager from disabling the mechanism generating the alerts. Methods are needed to limit the volume of alert transmission and to assist in delivering a minimum amount of information to a manager.

Alarm correlation makes it possible for network operators to more quickly determine the cause of an immediate problem. It does this by filtering secondary alarms, thereby allowing the network operator to focus on the root cause of the problem (not on the entire network), whether it is a fiber cut, an equipment failure or a bandwidth overload.

An ideal management system will generate alerts to notify its management station of error conditions. These alerts must be self limiting with required positive feedback. The manager should periodically poll to ensure connectivity to remote stations, and to get copies of alerts that were not delivered by the network~\cite{b26}. Expert systems are used in filtering alarms.

\subsection{Log files}

Many management tools log events with different formats and different sources. These events should later be correlated using time stamp to identify the source of the problem. Also topology information is needed to identify the precise location of the problem.

Many devices have buffers reserved for logs. The buffer takes disk space from the other operations. When the buffer is full, new logs are overwritten to the oldest ones. If the buffer becomes full quickly, some important logs may disappear before they are noticed.

\subsection{Fault detection}

After detecting a fault, operators should as soon as possible find the root cause of the problem. They must determine what troubles it causes and to whom. At first the operator might try to find the parts of the network, where the fault can not be, by eliminating processes. These parts can be neglected. If there is a very serious and difficult problem, the network can be divided into smaller parts and the parts are inspected one by one~\cite{b2}.

Operators can use connectivity tests to find the violated devices. By the same time can be detected if the fault is local or widespread. They can also test the data integrity to find out whether a part of the packets are lost by transmission. Delays are also tested, because some faults are results of excessive delays.

\subsection{Ping}

The packet inter net groper (Ping) is used for troubleshooting purposes. It sends an internet control message protocol (ICMP) loopback request packet to a target IP address. The receiver accepts the loopback request and issues a loopback response to the initiator of the Ping command. It cannot be determined  with echo-response which one of the possible routes is violated, because loopback request and loopback response may use different routes. Ping can be used only to determine if the target IP-address is available. Ping can be used to measure response time of different packet sizes as well~\cite[page 33]{b4}.

\subsection{Traceroute}

Unlike Ping Traceroute forces every router to send back an ICMP-control message. Most Traceroute applications send a sequence of user datagram protocol (UDP)-package to a UDP-port, which is randomly selected~\cite{b2}. Sometimes firewalls filter these packets from the main traffic, when the tracing has come to an end.

\section{Operation management}

Every device in the network (bridges, routers, hubs, servers, workstations) can be manageable and statistical information (sender, receiver, volume of transported information, time stamps, used resources) can be gathered. All terminal equipment does not need to be manageable~\cite{b19}. For example, workstations would send alerts about violated connections, because they are shutted up and down continuously.

Operators decide what is the essential information to gather periodically and to analyze. Extra data takes CPU capacity from real network operations. Measuring and controlling should not happen at the cost of normal network operations. Sufficient basic measurements are however essential, so that the analysis can be done. For example, measuring accessibility, controlling routing tables and controlling traffic, are methods to get information from the network operations.

\subsection{Accessibility}

Measuring the accessibility of devices helps us to collect information about the status of the network; although it isn't a complete method. In general, some points are selected to measure connections. Measurements are done by a control device. After measurements, the results shall be interpreted correctly. For example, controlling routers is not enough. If the setup of the router has been specified so that it gives the preference to packet switching, it will send packets normally although it is heavily loaded and it perhaps can not answer to messages of controlling device. Another problem is for example that two devices can be reached but they do not have connection with each other.

\subsection{Routing tables}

Another method is to control routing tables. Routing should change only when the topology of the network changes. If there are changes at other times, there is probably something wrong with the network. Routing tables express the topology of the network. The program of finding out the network topology from routing tables is more difficult than the program of controlling accessibility~\cite{b2}. In order to get information from routers to the routing tables, routers must be Simple network management protocol (SNMP) compatible,  dynamic routing tables must support sending request or routing information must be tapped from the routing protocol. These requirements are not necessarily realized although SNMP is common. Analysis of the routing tables can concentrate on the parts of the network which are most susceptible to failures.

\subsection{Controlling traffic}

Third method is to control traffic and analyze statistical distribution of the traffic. Statistical analysis gives also hints of malfunction in the network. It is easier for the operator to plan modifications of the network, when the use of the network is known. Operator finds out which connections and services are used and which are needed.

Traffic control needs resources. Usually a separate control station is needed to collect and analyze traffic statistics. There should be a method to link control station so that traffic information is collected from the network. Controlling traffic is however a reliable and cost effective method to find out problems before they exist. Traffic controlling can be limited to the most important parts of the network~\cite{b2}.

