ACCOUNTING MANAGEMENT

Network Management: Accounting and Performance Strategies - Graphically Rich Book  Network Management: Accounting and Performance Strategiesby Benoit Claise - CCIE No. 2686; Ralf WolterPublisher: Cisco PressPub Date: June 20, 2007Print ISBN-10: 1-58705-198-2Print ISBN-13: 978-1-58705-198-2Pages: 672

Understanding the need for Accounting Management

What is accounting management?

Why do networks require accounting management?

Why is accounting almost a stealth area within network management?

Which problems do accounting management solutions solve?

How can the business use this information for network planning, redesign, and billing?

What aspects make up accounting (data collection, data analysis, reporting, billing, and so on)?

Defining accounting

management

ITU-T definition (M.3400 and X.700, Definitions of the OSI Network Management Responsibilities):

"Accounting management • enables charges to be established for the use of

resources in the OSIE [Open Systems Interconnect Environment], and for

• costs to be identified for the use of those resources”

ITU-T definition (M.3400 and X.700, Definitions of the OSI Network Management Responsibilities):

• "inform users of costs incurred or resources consumed”inform

• "enable accounting limits to be set and tariff schedules to be associated with the use of resources;

limit

• "enable costs to be combined where multiple resources are invoked to achieve a given communication objective."

Cost combi

ne

Accounting management

includes functions to:

Accou

nti

ng

m

an

ag

em

en

t in

clu

des

fun

cti

on

s t

o:

Telecommunication Management Forum (TMF) definition:

ITU M3400 additional details for billing in the enhanced Telecom Operations Map (eTOM)

+TMF

=

The Fulfillment, Assurance, and

Billing (FAB) model of TMF's eTOM

Telecommunication Management Forum (TMF) definition: The TMF refers to the ITU-T accounting definition

(M.3400) and provides additional details for billing in the enhanced Telecom Operations Map (eTOM), The Business Process Framework, Document GB921.

The Fulfillment, Assurance, and Billing (FAB) model of TMF's eTOM positions the "Network Data Management" building block between assurance and billing. "Network Data Management:

this process encompasses the collection of usage data and network and information technology events and data for the purpose of network performance and traffic analysis. This data may also be an input to Billing (Rating and Discounting) processes at the Service Management Layer, depending on the service and its architecture." Chapter 3 explains the FAB model in more detail.

IETF definition: Request For Comment (RFC) 2975, Introduction to Accounting Management

the collection of resource

consumption data for the purposes of capacity and

trend analysis, cost allocation, auditing, and

billing.

Accounting management requires that

resource consumption be

measured, rated, assigned, and communicated

between appropriate

parties."

In this book, we use the term accounting management to describe the following processes:

Collecting usage data records at network devices

Optionally preprocessing data produced by the device (for example, filter, sample, aggregate)

Exporting the data from the device toward a collection server

Processing the data at the collection server (for example, filter, sample, aggregate, de-duplicate)

Converting usage records into a common format to be used by higher-layer applications : the mediation procedure

performance, SLA, fault,

security, billing,

planning, and so on

Figure 1-3. Accounting Management Architecture

Figure 1-3. Accounting Management Architecture

Collecting usage data records at network devices

Figure 1-3. Accounting Management Architecture Optionally

preprocessing data

produced by the

device (for example,

filter, sample,

aggregate)

Figure 1-3. Accounting Management Architecture

Exporting the data from the device

toward a collection

server

Figure 1-3. Accounting Management Architecture Processing

the data at the

collection server (for example,

filter, sample,

aggregate, de-

duplicate)

Figure 1-3. Accounting Management Architecture

Converting usage records into a

common format to be used by higher-layer applications

(for example, performance, SLA,

fault, security, billing, planning, and so on): the

mediation procedure

Figure 1-5. Network Management Building Blocks

the focus of accounting is to track the usage of network resources and traffic characteristics.

The Purposes of Accounting

Various accounting scenarios:

Netw

ork

m

on

itorin

g

Use

r mon

itorin

g

an

d p

rofilin

g

Ap

plica

tion

m

on

itorin

g a

nd

p

rofilin

g

Cap

acity

pla

nn

ing

Traffi

c pro

filin

g a

nd

en

gin

eerin

g

Peerin

g a

nd

tran

sit ag

reem

en

ts

Billin

g

Secu

rity a

naly

sis

Network Monitoring  Class 0 Class 1 Class 2

Time (Hour)

Packets Bytes Packets Bytes Packets Bytes

0 38 2735 1300 59800 3 1002

1 55 3676 400 44700 61 9791

2 41 36661 400 16800 4 240

3 13 1660 200 8400 4 424

4 16 14456 400 44700 4 420

5 19 2721 400 44400 1 48

6 21 24725 600 35600 516 20648

7 19 3064 700 412200 15 677

8 5 925 1200 176000 1 48

9 4 457 1300 104100 1242 1489205

10 5 3004 1900 1091900

1 48

11 4 451 400 39800 545 22641

12 4 456 800 54200 1017 1089699

13 5 510 500 41600 36 3240

14 4 455 400 99300 15 3287

15 5 511 800 36800 685 27578

16 4 454 100 4000 3 144

17 4 457 500 309500 2 322

18 4 455 400 34100 4 192

19 5 3095 1300 104100 4 424

20 4 398 100 15200 4 424

21 5 1126 800 54200 12 936

22 7 782 1300 104100 4 835

23 9 7701 600 35600 1 235

Table 1-2. Example of a Daily Report with Three Servicee Classes

back

User Monitoring and Profiling

next

The trend of running mission-critical applications on the

network is OVERWHELMING

Voice over IP (VoIP), virtual private networking (VPN), and videoconferencing

are increasingly being run over the network.

At the same time, people use (abuse?) the network to download movies, listen to

music online, perform excessive surfing, and so on.

User Monitoring and Profiling

back

This information can be used to:

Bu

ild a

traffi

c m

atrix

p

er s

ub

div

isio

n,

gro

up

, or e

ven

user

Track n

etw

ork

u

sag

e p

er u

ser

Mon

itor a

nd

p

rofi

le u

sers

A traffic matrix illustrates the

patterns between the origin and destination of traffic in the

network

Docu

men

t usag

e

tren

ds b

y u

ser,

gro

up

, an

d

dep

artm

en

t

Iden

tify o

pp

ortu

nitie

s to

sell a

dd

ition

al v

alu

e-

ad

ded

serv

ices to

ta

rgete

d c

usto

mers

.

Application Monitoring and Profiling

Figure 1-7. Characterizing Traffic by Application bac

k

Figure 1-8. IP Protocol Distribution

Figure 1-8. IP Protocol Distribution

Table 1-3. Example of Daily Report (Extended Version)

  Class 0 Class 1 Class 2 

LoadApplication (Bytes) Load

Application (Bytes) Load Application (Bytes)

Time (Hour) Packets Bytes Voice Other Packets Bytes E-mail SAP Packets Bytes HTTP

Peer-to-Peer Other

0 38 2735 264 2471 1300 59800 38870 20930 13 1002 752 100 1501 55 3676 128 3548 400 44700 29055 15645 61 9791 8812 979 02 41 56661 780 55881 400 16800 10920 5880 4 240 216 24 03 13 1660 328 1332 200 8400 5460 2940 4 424 382 42 04 16 14456 128 14328 400 44700 29055 15645 4 420 378 42 05 19 2721 1164 1557 400 44400 28860 15540 10 480 48 48 3846 21 24725 9856 14869 600 35600 23140 12460 516 20648 18583 2065 07 19 3064 2048 1016 700 412200 267930 144270 15 677 609 68 08 5 925 512 413 1200 176000 114400 61600 12 960 48 96 8169 4 457 256 201 1300 104100 67665 36435 1242 1489205 1340285 148921 0

10 5 3004 1684 1320 1900 1091900 709735 382165 3 256 230 26 0

11 4 451 96 355 400 39800 25870 13930 545 22641 20377 2264 012 4 456 64 392 800 54200 35230 18970 1017 1089699 980729 108970 0

13 5 510 128 382 500 41600 27040 14560 36 3240 2916 324 014 4 455 416 39 400 99300 64545 34755 15 3287 2958 329 015 5 511 496 15 800 36800 23920 12880 685 27578 24820 2758 016 4 454 128 326 100 4000 2600 1400 3 144 130 14 017 4 457 256 201 500 309500 201175 108325 2 322 290 32 018 4 455 196 259 400 34100 22165 11935 4 192 173 19 019 5 3095 2048 1047 1300 104100 67665 36435 4 424 382 42 020 4 398 286 112 100 15200 9880 5320 4 424 382 42 021 5 1126 956 170 800 54200 35230 18970 12 936 842 94 022 7 782 612 170 1300 104100 67665 36435 4 835 752 84 023 9 7701 2096 5605 600 35600 23140 12460 2 235 212 24 0

Capacity Planning

A

serv

ice

p

rovi

der

mig

ht

con

sid

er

the

follo

win

g:

next

Capacity Planning

A service

provider

might consider the following:

next

Which point of presence (PoP) generates the most revenue?

POP

Which access points are not profitable and should be consolidated?A

CC

ES

S

Should there be spare capacity for premium users?S

PA

RE

CA

PA

CIT

Y

In which segment is the traffic decreasing? Did we lose customers to the competition? What might be the reason?

SEG

ME

NT

Capacity Planning

An

ente

rp

rise

IT

dep

ar

tment

mig

ht

consi

der

the

follo

win

g

Which departments are growing the fastest? Which links will require an upgrade soon?

GROW

For which department is network connectivity business-critical and therefore should have a high-availability design?

HIG

H

AV

AIL

AB

ILIT

Y

back