Upgrade to Pro — share decks privately, control downloads, hide ads and more …

自宅フロー解析

 自宅フロー解析

NISOC(新潟インターネット研究会)の勉強会で発表した際の資料です。

Ff1cf99c7a71928f886c3b6c7c95b1da?s=128

Masakazu Asama

June 02, 2022
Tweet

More Decks by Masakazu Asama

Other Decks in Technology

Transcript

  1. ࣗ୐ϑϩʔղੳ ઙؒਖ਼࿨!/*40$ 

  2. ࣗ୐ϑϩʔղੳʁ w ͜͜Ͱ͸ʰϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़Λ༻͍ͯݱࡏωοτϫʔ ΫʹԿ͕ى͖͍ͯΔͷ͔ʁ͋Δ͍͸աڈʹԿ͕ى͖͍ͯͨͷ͔ʁΛղੳ͢ Δ͜ͱʱΛʰϑϩʔղੳʱͱݺͿ͜ͱʹ͢Δ w Α͘ΠϯλʔωοτΦϖϨʔλͷํ͕͜Μͳ͜ͱΛݴ͍ͬͯΔͷΛݟΔ͕ w ʮ͜͜਺೔"4ͱͷ௨৴͕૿͍͑ͯΔʯ w

    ʮࠓिʹೖ͔ͬͯΒ5$1ͷ௨৴͕ٸ૿͍ͯ͠Δʯ w ϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़Λ༻͍Δ͜ͱͰ͜ͷΑ͏ͳωοτ ϫʔΫͰى͖͍ͯΔࣄ৅Λղੳ͢Δ͜ͱ͕Ͱ͖Δ w ຊൃදͰ͸5FMFHSBG ࣗ࡞ϓϥάΠϯ *O fl VY%#(SBGBOBͱ͍͏Φʔϓϯ ιʔειϑτ΢ΣΞ܈Λ༻͍ͯࣗ୐ͰϑϩʔղੳΛߦ͏ํ๏Λ঺հ͢Δ 2
  3. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ

  4. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ

  5. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ

  6. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ

  7. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ

  8. ϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़ʁ w ͦ΋ͦ΋ϑϩʔ ͋Δ͍τϥϑΟοΫϑϩʔ ͱ͸ʜ ˞  w ωοτϫʔΫ಺ͷ؍ଌ఺ΛҰఆִ࣌ؒؒ಺ʹ௨ա͢Δύέοτͷू߹ w

    ಛఆͷϑϩʔʹଐ͢͢΂ͯͷύέοτ͸ڞ௨ͷϓϩύςΟͷू߹Λ࣋ͭ w ֤ʑͷϓϩύςΟ͸ʜ w ͻͱͭҎ্ͷϔομ஋ ྫѼઌ*1ΞυϨεɺѼઌ5$1ϙʔτ൪߸  w ͻͱͭҎ্ͷύέοτͦͷ΋ͷͷಛ௃ ྫ.1-4ϥϕϧͷ਺  w ύέοτͷऔΓѻ͍͔ΒಘΒΕͨͻͱͭҎ্ͷϑΟʔϧυ ྫωΫε τϗοϓΞυϨεɺૹ৴ΠϯλʔϑΣʔε  w ͜͜Ͱ͸ϑϩʔ৘ใΛऩूͦ͠ΕΛ΋ͱʹωοτϫʔΫΛ؅ཧ͢Δٕज़Λ ʰϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़ ϑϩʔٕज़ ʱͱݺͿ͜ͱʹ͢Δ 8 ˞ 3'$ʰ"SDIJUFDUVSFGPS*1'MPX*OGPSNBUJPO&YQPSUʱʹΑΔ
  9. Ұൠతͳϑϩʔٕज़ 9 ਐ౻ࢿ܇ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱΑΓҾ༻

  10. Ұൠతͳϑϩʔٕज़ ਐ౻ࢿ܇ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱΑΓҾ༻ 10

  11. w -εΠονͰϧʔλͷ΍ΓͱΓ͢΂ͯΛ 
 ˞ ͕ͭͳ͛ΒΕͨϙʔτʹϛϥʔ͢Δ w ˞ ͸ϛϥʔ͞ΕͨύέοτΛ 
 ϑϩʔ৘ใʹ·ͱΊ

    5FMFHSBG ࣗ࡞ 
 ϓϥάΠϯ σʔλετΞ *O fl VY%# 
 ʹ֨ೲ͠άϥϑͱͯ͠දࣔ (SBGBOB 
 ͨ͠Γ௚઀σʔλ 
 ετΞΛࢀরͨ͠Γ 
 ͢Δ 'MVY ຊൃදํࣜͷΠϝʔδ 11 ϙʔτϛϥʔରԠͷ -εΠον ˣ ϧʔλ ˣ ˢ ແઢ"1ͱ͔ ˢ -εΠον͔ΒਨΕྲྀ͞ΕΔύέοτΛͻͨ͢ Βऩूͯ͠ϑϩʔ৘ใʹ·ͱΊσʔλετΞʹ 
 ֨ೲ͠άϥϑͱͯ͠දࣔͨ͠ΓͳΜ͔͋ͬͨ࣌ʹ σʔλΛूܭͨ͠Γ͢ΔػೳΛ࣋ͭͻͱ ˞ ୺຤ͱ͔ ˣ Πϥετ $ ͍Β͢ͱ΍
  12. ຊൃදํࣜͷ༧ࢉײ 12 ϙʔτϛϥʔ͢ΔεΠον '4$0.445 ໿ ԁ ੫ࠐ  !'4$0.௚ൢαΠτ 5FMFHSBG*O

    fl VY%#(SBGBOB 1$&OHJOFT"16 ໿ ԁ ੫ࠐ  !εΠοναΠΤϯε
  13. (SBGBOB w ͳʹ͕͔͠ͷܭଌ஋ .FUJDT Λ໰͍߹Θͤ ͨΓ 2VFSZ ɺՄࢹԽͨ͠Γ 7JTVBMJ[F ɺܯ

    ࠂͨ͠Γ "MFSUPO ɺཧղͨ͠Γ 6OEFSTUBOE ͢ΔͨΊͷιϑτ΢ΣΞ w ๮άϥϑɺંΕઢάϥϑɺԁάϥϑɺʜͳͲ ๛෋ͳάϥϑԽϥΠϒϥϦΛ࣋ͭ w ରԠ͢Δσʔλιʔε ܭଌ஋ .FUSJDT ͷஔ ͖৔ॴ ͕๛෋ 1PTUHSF42-ɺ.Z42-ɺ *O fl VY%#ɺʜ  w ແঈͰ࢖͑ΔΦʔϓϯιʔε൛ͱ༗ঈͷΤϯ λʔϓϥΠζ൛ɺΫϥ΢υ্ͷαʔϏεͱ͠ ͯ࢖͏Ϋϥ΢υ൛͕͋Δ 13 (SBGBOBTBOECPYΑΓҾ༻
  14. *O fl VY%# w ͍ΘΏΔ࣌ܥྻσʔλϕʔε 5JNFTFSJFTEBUBCBTF 54%# ͷͻͱͭͰ ࣌ܥྻσʔλΛ֨ೲ͠ఏڙ͢ΔͨΊʹ࠷దԽ͞Εͨϛυϧ΢ΣΞ w

    ࣌ܥྻσʔλͷѻ͍ʹಛԽ͢ΔͷͰʜ w جຊతʹ$36%ͷ͏ͪ% ࡟আ ΍6 ߋ৽ ͸ൃੜ͠ͳ͍ ͨͩ͠ظؒࢦఆ ࡟আ͸ׂͱ͋Δ ͷͰ$ ࡞੒ ͱ3 ࢀর ʹΨνΨνʹ࠷దԽ w ࣌ࠁͷظؒͰߜΓࠐΉ͜ͱ͕ଟ͍ͷͰ࣌ࠁͷظؒͷմͰσʔλΛ֨ೲ w ͢ΔͳͲ͍ͯ͠Δ w ΋ͷ͘͢͝ࡶʹઆ໌͢ΔͱΠϯσοΫε͞Εͨ࣌ࠁσʔλͷΧϥϜ͕͋ͬ ͯεΩʔϚ͕ΏΔ;ΘͳϦϨʔγϣφϧσʔλϕʔεʁ w ΫΤϦݴޠͱͯ͠*O fl VY2- ઌൃ ͱ'MVY ޙൃ Λఏڙ͍ͯ͠Δ w (SBGBOBͱಉ༷044൛ɺΤϯλʔϓϥΠζ൛ɺΫϥ΢υ൛͕͋Δ 14
  15. 5FMFHSBG w ܭଌ஋ .FUJDT ΍Πϕϯτ৘ใΛγεςϜ΍*P5ηϯαʔͳͲ͔Βऩू͠ ͦΕΛαʔό *O fl VY%#ͳͲ ʹૹΔΤʔδΣϯτιϑτ΢ΣΞ

    w ϓϥάΠϯ͕௒ॆ࣮͍ͯ͠Δ w *OQVUʜ$16࢖༻཰ɺϝϞϦ࢖༻཰ɺσΟεΫ࢖༻཰ɺσΟεΫ*0ෛ ՙɺϩʔυΞϕϨʔδɺωοτϫʔΫΠϯλʔϑΣʔε౷ܭΧ΢ϯλɺ 4/.1ɺ֤छαʔόϓϩηε )551%ɺ1PTU fi Yɺ%PWFDPUɺʜ ɺʜ w 0VUQVUʜ$SFBUF%#ɺ&MBTUJDTFBSDIɺ(SBQIJUFɺ.POHP%#ɺ *O fl VY%#ɺʜ w 5FMFHSBGࣗମʹ͸ϑϩʔ৘ใΛऩू͢Δػೳ͸ͳ͍ͷͰࠓճ͸ͦͷͨΊʹ EQEL fl PXͱ͍͏ϓϥάΠϯΛ࡞੒ͨ͠ 15
  16. EQEL fl PX֓ཁ w ࢦఆͨ͠ωοτϫʔΫΠϯλʔϑΣʔεʹಧ͍ͨύέοτΛ%1%,Ͱͻͨ ͢Βٵ͍ࠐΈϑϩʔ৘ใΛऩू͠σʔλετΞ΁ు͖ग़ͨ͢Ίͷ5FMFHSBG ͷϓϥάΠϯ w .35μϯϓ ͋Δ࣌఺ͷ#(1ܦ࿏৘ใΛు͖ग़ͨ͠ϑΝΠϧ

    ͷ"4@1"5) ଐੑΛ༻͍Δ͜ͱͰѼઌ΍ૹ৴ݩͷ*1ΞυϨε͔Β"4৘ใΛௐ΂ͯه࿥ ͢Δ͜ͱ͕Մೳ w .35μϯϓ͸3PVUF7JFXTϓϩδΣΫτͳͲͰೖख͢Δ͜ͱ͕Ͱ͖Δ w ϩʔΧϧωοτϫʔΫͷϓϨϑΟΫεΛఆٛ͢Δ͜ͱͰํ޲ JODPNJOHɺ PVUHPJOHɺJOUFSOBMɺFYUFSOBM ຖʹ෼ྨ͢Δ w ͲͷϓϩύςΟͰू໿͢Δ͔Λํ޲ຖʹࢦఆ͢Δ͜ͱ͕Մೳ 16
  17. EQEL fl PXઃఆྫ 17 [[inputs.dpdkflow]] main_core_index = 2 interval =

    60 local_nets_ipv4 = ["192.168.1.0/24"] local_nets_ipv6 = ["2001:db8:0:1::/64"] aggregate_incoming = ["iface", "vlan", "af", "proto", "dst_host", "src_as", "app"] aggregate_outgoing = ["iface", "vlan", "af", "proto", "src_host", "dst_as", "app"] mrt_rib_path = "path/to/mrt_rib_file" [[inputs.dpdkflow.core]] index = 3 [[inputs.dpdkflow.core.port]] index = 0 description = "Port1" port_vlan_id = 1 tag_vlan_ids = [11, 12] ˞ JOQVUTEQEL fl PXDPSF͸ෳ਺ׂΓ౰ͯΔ ͜ͱ͕Մೳ ˞ ͻͱͭͷJOQVUTEQEL fl PXDPSFʹෳ਺ͷ JOQVUTEQEL fl PXDPSFQPSUΛׂΓ౰ͯΔ ͜ͱ΋JOQVUTEQEL fl PXDPSFQPSU͝ͱ ʹJOQVUTEQEL fl PXDPSFΛׂΓ౰ͯΔ͜ ͱ΋Ͱ͖Δ
  18. EQEL fl PXσʔλͷྫ 18 @NFBTVSF NFOU @ fi FME @WBMVF

    @UJNF EJSFDUJPO TSD@IPTU TSD@BT ETU@IPTU ETU@BT BQQ@EFTD EQEL fl PX CZUFT   JODPNJOH   UDQ  IUUQT  EQEL fl PX CZUFT   JODPNJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   JODPNJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   JODPNJOH   UDQ  IUUQT  EQEL fl PX CZUFT   PVUHPJOH   UDQ  IUUQT  EQEL fl PX CZUFT   PVUHPJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   PVUHPJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   PVUHPJOH   UDQ  IUUQT  εϖʔεͷ౎߹ͰJGBDFɺWMBOɺBGɺQSPUP͸লུ
  19. EQEL fl PX࣮૷ 19 ઃఆ৘ใ ྫ  Πϯλʔόϧඵ ϩʔΧϧωοτ JODPNJOHू໿<Ѽઌ*1ΞυϨεɺૹ৴ݩ"4ɺΞϓϦ>

    PVUHPJOHू໿<Ѽઌ"4ɺૹ৴ݩ*1ΞυϨεɺΞϓϦ> ᶃ ωοτϫʔΫΠϯλʔϑΣʔε͔ΒύέοτΛड৴ ᶄ Ѽઌ*1ΞυϨεͱૹ৴ݩ*1ΞυϨεΛϩʔΧϧωοτઃఆͱ ൺֱ͠ํ޲ΛٻΊΔ 
 ্هͷྫͰ͸Ѽઌ͕ϩʔΧϧωοτͰૹ৴ݩ͕ϩʔΧϧ ωοτͰ͸ͳ͍ͷͰJODPNJOH ᶅ ํ޲ʹԠͨ͡ू໿ઃఆΛௐ΂ඞཁͳ৘ใΛٻΊΔ 
 ্هͷྫͰ͸JODPNJOHू໿ʹૹ৴ݩ"4͕͋ΔͷͰૹ৴ݩ *1ΞυϨε͔Βͦͷ"4൪߸Λௐ΂ϙʔτ൪߸ͷখ͍͞ํ͕ ͳͷͰΞϓϦΛUDQ  IUUQ  ͱ͢Δ ᶆ ᶅͰٻΊͨू໿ઃఆΛΩʔʹϑϩʔ৘ใςʔϒϧ͔Βϑϩʔ ৘ใΛ୳͢ 
 ˠΩʔʹҰக͢Δϑϩʔ৘ใ͕ͳ͚Ε͹৽͘͠ొ࿥ 
 ˠ͋Ε͹ͦͷϑϩʔ৘ใͷύέοτ਺ͱόΠτ਺Λ૿΍͢ ᶇ ࠷ॳʹड৴ͨ࣌͠ࠁ͕ΠϯλʔόϧඵҎ্ܦա͍ͯ͠Δ΋ͷ ΛऔΓग़͠αʔό *O fl VY%# ʹૹ৴͢Δ Ѽઌ*1ΞυϨε ૹ৴ݩ*1ΞυϨε Ѽઌ5$1ϙʔτ൪߸ ૹ৴ݩ5$1ϙʔτ൪߸ όΠτ਺ ड৴ύέοτ ྫ  ϑϩʔ৘ใςʔϒϧ ํ޲JODPNJOH Ѽઌ*1ΞυϨε ૹ৴ݩ"4 ΞϓϦUDQ  IUUQ   ύέοτ਺ όΠτ਺ ࠷ॳʹड৴ͨ࣌͠ࠁ ํ޲JODPNJOH Ѽઌ*1ΞυϨε ૹ৴ݩ"4 ΞϓϦUDQ  IUUQ   ύέοτ਺ όΠτ਺ ࠷ॳʹड৴ͨ࣌͠ࠁ ํ޲JODPNJOH Ѽઌ*1ΞυϨε ૹ৴ݩ"4 ΞϓϦUDQ  IUUQ   ύέοτ਺ όΠτ਺ ࠷ॳʹड৴ͨ࣌͠ࠁ
  20. 'MVY֓ཁ w 'MVY͸Φʔϓϯιʔεͷؔ਺ܕσʔλεΫϦϓτݴޠ 'VODUJPOBMEBUB TDSJQUJOHMBOHVBHF  w σʔλΛ໰͍߹ΘͤͨΓ 2VFSZJOH ɺ෼ੳͨ͠Γ

    "OBMZ[JOH ɺૢ࡞ͨ͠ Γ "DUJOH ͢ΔͨΊʹઃܭ͞Ε͍ͯΔ w ҎԼͷෳ਺ͷσʔλιʔεʹରԠ͍ͯ͠Δ w ࣌ܥྻσʔλϕʔε 5JNFTFSJFTEBUBCBTFT ྫ*O fl VY%#  w ϦϨʔγϣφϧ42-σʔλϕʔε 3FMBUJPOBM42-EBUBCBTFT ྫ .Z42-ɺ1PTUHSF42-  w $47 20
  21. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ w ݁ՌΛฦ͢ 'MVY͜Μͳײ͡ 21

    from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
  22. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ w ݁ՌΛฦ͢ 'MVY͜Μͳײ͡ 22

    from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
  23. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ w ݁ՌΛฦ͢ 'MVY͜Μͳײ͡ 23

    from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
  24. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ w ݁ՌΛฦ͢ 'MVY͜Μͳײ͡ 24

    from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
  25. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ w ݁ՌΛฦ͢ 'MVY͜Μͳײ͡ 25

    from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
  26. 'MVYσʔλϞσϧ w ςʔϒϧετϦʔϜ 4USFBNPGUBCMFT  w θϩݸҎ্ͷςʔϒϧͷू·Γ w σʔλιʔε͔Β͸ςʔϒϧετϦʔϜ͕ ݁Ռͱͯ͠ฦ͞ΕΔ

    w ςʔϒϧ 5BCMF  w άϧʔϓΩʔͰ෼཭͞Εͨྻͱߦͷू·Γ w ྻ $PMVNO  w ಉ͡ܕͷ஋ͷू·Γ w ߦ 3PX  w ؔ࿈͢Δྻͷ஋ͷू·Γ w άϧʔϓΩʔ (SPVQLFZ  w ςʔϒϧͷதͰڞ௨͢Δྻͱͦͷ஋ͷ૊Έ ߹Θͤ 26 ʰ'MVYEBUBNPEFMc'MVYY%PDVNFOUBUJPOʱΑΓҾ༻
  27. 'MVYάϧʔϓΩʔ 27 @UJNF @WBMVF @ fi FME EJSFDUJPO TSD@BT ETU@IPTU

    BQQ@EFTD   CZUFT JODPNJOH   UDQ  IUUQT    CZUFT JODPNJOH   UDQ  IUUQT    CZUFT JODPNJOH   UDQ  IUUQT  @UJNF @WBMVF @ fi FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD   CZUFT JODPNJOH   VEQ  RVJD    CZUFT JODPNJOH   VEQ  RVJD    CZUFT JODPNJOH   VEQ  RVJD  @UJNF @WBMVF @ fi FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD   CZUFT JODPNJOH   UDQ  IUUQ    CZUFT JODPNJOH   UDQ  IUUQ    CZUFT JODPNJOH   UDQ  IUUQ  άϧʔϓΩʔ<@ fi FMECZUFT EJSFDUJPOJODPNJOH TSD@BT ETU@IPTU BQQ@EFTDUDQ  IUUQT  > άϧʔϓΩʔ<@ fi FMECZUFT EJSFDUJPOJODPNJOH TSD@BT ETU@IPTU BQQ@EFTDVEQ  RVJD  > άϧʔϓΩʔ<@ fi FMECZUFT EJSFDUJPOJODPNJOH TSD@BT ETU@IPTU BQQ@EFTDUDQ  IUUQ  >
  28. 'MVYू໿ "HHSFHBUFT ͱબ୒ 4FMFDUPST 28 @WBMVF @ fi FME BQQ@EFTD

     CZUFT UDQ  IUUQT   CZUFT UDQ  IUUQT   CZUFT UDQ  IUUQT  @WBMVF @ fi FME BQQ@EFTD  CZUFT VEQ  RVJD   CZUFT VEQ  RVJD   CZUFT VEQ  RVJD  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQ   CZUFT UDQ  IUUQ   CZUFT UDQ  IUUQ  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQT  @WBMVF @ fi FME BQQ@EFTD  CZUFT VEQ  RVJD  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQ  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQ  @WBMVF @ fi FME BQQ@EFTD  CZUFT VEQ  RVJD  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQT  ू໿ؔ਺NFBO ฏۉ Λ࣮ߦͨ͠৔߹ʜ બ୒ؔ਺NBY ࠷େ Λ࣮ߦͨ͠৔߹ʜ
  29. 'MVYXJOEPX ࣌ؒ࣠ํ޲ͷૢ࡞ 29 @WBMVF @UJNF @TUBSU @TUPQ @ fi FME

        CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT XJOEPX FWFSZN  Λ࣮ߦ͢Δͱʜ w ͜ͷޙʹू໿ؔ਺΍બ୒ؔ਺Λ࣮ߦ͢Ε͹ظؒ͝ͱʹूܭ͢Δ͜ͱ͕Ͱ͖Δ w ͨͩ͜ͷΑ͏ͳॲཧ͸Α͘ߦΘΕΔͷͰBHHSFHBUF8JOEPXͱ͍͏΋ͬͱศརͳؔ਺͕༻ҙ͞Ε͍ͯΔ ޙड़
  30. 'MVYཁ͢Δʹʜ w ςʔϒϧετϦʔϜʹؚ·ΕΔςʔϒϧͻͱ͕ͭંΕઢάϥϑͷઢͻͱͭ ʹରԠ͢Δ ˠ ॻ͖͍ͨάϥϑͷઢͷڞ௨߲͕άϧʔϓΩʔʹͳΔΑ͏ʹάϧʔϓΛ ߟ͑ΫΤϦΛॻ͘ w ͡Ό͋άϧʔϓ͸Ͳ͏΍ͬͯૢ࡞͢Δͷ͔ʁ ˠ

    HSPVQؔ਺ ۩ମྫޙड़ ΍XJOEPXؔ਺ લड़ ͳͲͰߦ͏ 30
  31. 'MVYࣄྫ  "4ผτοϓ w ૹ৴ݩ"4ຖͷμ΢ϯϩʔυ௨৴ྔΛάϥϑ Խ͍ͨ͠ w ୠ͠"4ͷ਺͕ଟ͘ͳΔͱάϥϑ͕ද͖ࣔ͠ Εͳ͘ͳΔͷͰಛʹ௨৴ྔͷଟ͍"4τοϓ ͷΈද͍ࣔͨ͠

    w HSPVQؔ਺Λ࣮ߦ͢Δ͜ͱͰҾ਺ʹࢦఆ͠ ͨྻΛάϧʔϓΩʔͷྻʹࢦఆ͢Δ Ҿ਺ͳ ͩ͠ͱͻͱͭͷςʔϒϧͰฦ͞ΕΔ  w TVNؔ਺Ͱάϧʔϓຖͷ߹ܭ஋ΛٻΊUPQO ؔ਺Ͱ্ҐߦΛऔಘ͠ fi OE$PMVNOؔ਺ Ͱૹ৴ݩ"4ͷ഑ྻΛಘΔ w BHHSFHBUF8JOEPXؔ਺Ͱ෼ࠁΈͰ߹ܭ w όΠτͰ͸ͳ͘Ϗοτʹ͍ͨ͠ͷͰNBQؔ ਺Ͱඍमਖ਼ 31 data = from(bucket: "dpdkflow") |> range(start: v.timeRangeStart, stop: v.timeRangeStop) |> filter(fn: (r) => r["_measurement"] == "dpdkflow") |> filter(fn: (r) => r["_field"] == "bytes") |> filter(fn: (r) => r["direction"] == "incoming") |> filter(fn: (r) => exists r["src_as"]) |> group(columns: ["src_as"]) topn = data |> sum() |> group() |> top(n: 10) |> findColumn(fn: (key) => true, column: "src_as") data |> filter(fn: (r) => contains(value: r["src_as"], 
 set: topn)) |> aggregateWindow(every: 1m, fn: sum, 
 createEmpty: true) |> map(fn: (r) => ({ r with _value: float(v: r._value) 
 * 8.0 / 60.0 })) |> yield(name: "topn")
  32. 'MVYࣄྫ  ύʔηϯλΠϧ w Ոఉ಺ͷ୺຤୆ʹ͖ͭύʔηϯλΠϧ ͷଳҬίϛοτΛઃఆͦ͠ΕΛ௒͑ͨ෼͸ ͦͷ෼ʹԠ͓ͯ͡খݣ͍͔ΒఱҾ͖͍ͨ͠ w ࢖༻ଳҬ͸෼ฏۉͰܭࢉ͢Δ w

    SBOHFؔ਺ͷTUBSUͱTUPQʹ͸࣌ࠁϦςϥϧ Ͱϲ݄෼Λࢦఆ͢Δ͕࣌ࠁϦςϥϧ͸65$ Ͱ͔͠ࢦఆͰ͖ͳ͍ͷͰ+45ͱͷࠩ෼࣌ؒ Λݮࢉ͢Δ w RVBOUJMFؔ਺ͰύʔηϯλΠϧ஋ΛٻΊ Δ RVBOUJMFؔ਺͸͔Β·ͰͰ͸ͳ͘ ͔Β·Ͱͷුಈখ਺఺਺ΛҾ਺ʹͱΔ  w BHHSFHBUF8JOEPXؔ਺Ͱ͸෼ຖͷ߹ܭ௨ ৴όΠτ਺͕ಘΒΕΔͷͰNBQؔ਺ͰϏο τʹม׵͠෼ ඵ ͰׂΔ 32 from(bucket: "dpdkflow") |> range(start: time(v: uint(v: 
 2022-05-01T00:00:00.000Z) - uint(v: 9h)), stop: time(v: uint(v: 
 2022-06-01T00:00:00.000Z) - uint(v: 9h))) |> filter(fn: (r) => r["_measurement"] == "dpdkflow") |> filter(fn: (r) => r["_field"] == "bytes") |> filter(fn: (r) => r["direction"] == "incoming") |> filter(fn: (r) => exists r["dst_host"]) |> group(columns: ["dst_host"]) |> aggregateWindow(every: 5m, fn: sum, 
 createEmpty: true) |> quantile(q: 0.95) |> map(fn: (r) => ({ r with _value: float(v: r._value) 
 * 8.0 / 300.0 })) |> yield(name: "quantile")
  33. ·ͱΊ w 5FMFHSBG ࣗ࡞ϓϥάΠϯ *O fl VY%#(SBGBOBͱ͍͏Φʔϓϯιʔειϑ τ΢ΣΞ܈Λ༻͍Δ͜ͱͰࣗ୐ͰϑϩʔղੳΛߦ͏͜ͱ͕Ͱ͖Δ w ͱΓ͋͑ͣdສԁఔ౓ͷॳظ౤ࢿ

    ϙʔτϛϥʔͰ͖ΔεΠονͱϑϩʔ ৘ใΛऩू͢Δαʔό Ͱ࣮ݱͰ͖Δ w ϑϩʔ৘ใΛऩू͠஝ੵ͓ͯ͘͜͠ͱͰωοτϫʔΫͰԿ͕ى͖͍ͯΔͷ ͔ ͋Δ͍͸Կ͕ى͖͍ͯͨͷ͔ Λৄ͘͠஌Δ͜ͱ͕Ͱ͖Δ w ؾʹͳΔϓϩύςΟ "4ɺ*1ΞυϨεɺΞϓϦɺ౳ ͕͋Ε͹ͦΕͰू໿͠ ͨάϥϑΛࣄલʹ༻ҙ͓ͯ͘͜͠ͱͰԿ͔͋ͬͨ࣌ʹҟมʹؾ෇͚Δ w ҟมʹؾ෇͍ͨΒ'MVYͰΫΤϦΛॻ͘͜ͱͰৄ͘͠ௐ΂Δ͜ͱ͕Ͱ͖Δ w ஌ΒΜ͚Ͳ ͞·͟·ͳ౷ܭؔ਺΋͋ΔͬΆ͍ 33
  34. ࢀߟจݙ w HJO[BEPUFMFHSBG5IFQMVHJOESJWFOTFSWFSBHFOUGPSDPMMFDUJOHSFQPSUJOHNFUSJDT w IUUQTHJUIVCDPNHJO[BEPUFMFHSBG w ਐ౻ࢿ܇ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱ w IUUQTXXXTMJEFTIBSFOFUNPUPOPSJTIJOEPTT w

    'MVYY%PDVNFOUBUJPO w IUUQTEPDTJO fl VYEBUBDPN fl VYWY w *O fl VY%#044%PDVNFOUBUJPO w IUUQTEPDTJO fl VYEBUBDPNJO fl VYECW w 5FMFHSBG%PDVNFOUBUJPO w IUUQTEPDTJO fl VYEBUBDPNUFMFHSBGW w (SBGBOBEPDVNFOUBUJPO w IUUQTHSBGBOBDPNEPDTHSBGBOBMBUFTU 34