Medianet Reference Guide - Cisco

Chapter 4
Medianet QoS Design Considerations
Enterprise Medianet Strategic QoS Recommendations
Figure 4-30
Data Plane Policing/Scavenger-class QoS Components
Access-edge policers
remark “abnormal” flows
(BUT DO NOT DROP!)
Campus queuing
polices include a
Scavenger-class
WAN/VPN queuing
polices include a
Scavenger-class
226622
Most endpoint devices have fairly predictable traffic patterns and, as such, can have metering policers to
identify “normal” flows (the volume of traffic that represents 95% of the typically-generated traffic rates
for the endpoint device) vs. “abnormal” flows (the remainder). For instance, it would be “abnormal” for
a port that supposedly connects to an IP phone to receive traffic in excess of 128 kbps. Similarly, it would
be “abnormal” for a port that supposedly connects to a Cisco TelePresence system to receive traffic in
excess of 20 Mbps. Both scenarios would be indicative of network abuse—either intentional or
inadvertent. Endpoint PCs also have traffic patterns that can be fairly accurately baselined with statistical
analysis.
For example, for users of Windows-based systems, the Windows Task Manager (which can be selected
by simultaneously pressing CTRL-ALT-DEL) can graphically display networking statistics (available
from the networking tab). Most users are generally surprised at how low the average network utilization
rates of PCs are during everyday use, as compared to their link speed capacities. Such a graphical display
of network utilization is shown in Figure 4-31, where the radical and distinctive difference in network
utilization rates after worm-infection is highlighted.
Figure 4-31
Sample PC Network Utilization Rates—Before and After Infection by a Worm
100 %
Legitimate traffic bursts above Normal/Abnormal Threshold
Worm-generated traffic
Link Capacity
50 %
0 %
Normal/Abnormal Threshold
Time
226623
These access edge metering policers are relatively unintelligent. They do not match specific network
characteristics of specific types of attacks, but simply meter traffic volumes and respond to abnormally
high volumes as close to the source as possible. The simplicity of this approach negates the need for the
policers to be programmed with knowledge of the specific details of how the attack is being generated
or propagated. It is precisely this unintelligence of such access layer metering policers that allow them
OL-22201-01
Medianet Reference Guide
4-43