自宅フロー解析

NISOC(新潟インターネット研究会)の勉強会で発表した際の資料です。

Transcript

1. ࣗ୐ϑϩʔղੳ
   ઙؒਖ਼࿨!/*40$
   
   

   View Slide

2. ࣗ୐ϑϩʔղੳʁ
   w ͜͜Ͱ͸ʰϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़Λ༻͍ͯݱࡏωοτϫʔ
   ΫʹԿ͕ى͖͍ͯΔͷ͔ʁ͋Δ͍͸աڈʹԿ͕ى͖͍ͯͨͷ͔ʁΛղੳ͢
   Δ͜ͱʱΛʰϑϩʔղੳʱͱݺͿ͜ͱʹ͢Δ
   w Α͘ΠϯλʔωοτΦϖϨʔλͷํ͕͜Μͳ͜ͱΛݴ͍ͬͯΔͷΛݟΔ͕
   w ʮ͜͜਺೔"4ͱͷ௨৴͕૿͍͑ͯΔʯ
   w ʮࠓिʹೖ͔ͬͯΒ5$1ͷ௨৴͕ٸ૿͍ͯ͠Δʯ
   w ϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़Λ༻͍Δ͜ͱͰ͜ͷΑ͏ͳωοτ
   ϫʔΫͰى͖͍ͯΔࣄ৅Λղੳ͢Δ͜ͱ͕Ͱ͖Δ
   w ຊൃදͰ͸5FMFHSBG ࣗ࡞ϓϥάΠϯ
   *O
   fl
   VY%#(SBGBOBͱ͍͏Φʔϓϯ
   ιʔειϑτ΢ΣΞ܈Λ༻͍ͯࣗ୐ͰϑϩʔղੳΛߦ͏ํ๏Λ঺հ͢Δ
   2
   

   View Slide

3. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
   

   View Slide

4. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
   

   View Slide

5. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
   

   View Slide

6. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
   

   View Slide

7. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
   

   View Slide

8. ϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़ʁ
   w ͦ΋ͦ΋ϑϩʔ ͋Δ͍τϥϑΟοΫϑϩʔ
   ͱ͸ʜ ˞
   
   w ωοτϫʔΫ಺ͷ؍ଌ఺ΛҰఆִ࣌ؒؒ಺ʹ௨ա͢Δύέοτͷू߹
   w ಛఆͷϑϩʔʹଐ͢͢΂ͯͷύέοτ͸ڞ௨ͷϓϩύςΟͷू߹Λ࣋ͭ
   w ֤ʑͷϓϩύςΟ͸ʜ
   w ͻͱͭҎ্ͷϔομ஋ ྫѼઌ*1ΞυϨεɺѼઌ5$1ϙʔτ൪߸
   
   w ͻͱͭҎ্ͷύέοτͦͷ΋ͷͷಛ௃ ྫ.1-4ϥϕϧͷ਺
   
   w ύέοτͷऔΓѻ͍͔ΒಘΒΕͨͻͱͭҎ্ͷϑΟʔϧυ ྫωΫε
   τϗοϓΞυϨεɺૹ৴ΠϯλʔϑΣʔε
   
   w ͜͜Ͱ͸ϑϩʔ৘ใΛऩूͦ͠ΕΛ΋ͱʹωοτϫʔΫΛ؅ཧ͢Δٕज़Λ
   ʰϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़ ϑϩʔٕज़
   ʱͱݺͿ͜ͱʹ͢Δ
   8
   ˞
   3'$ʰ"SDIJUFDUVSFGPS*1'MPX*OGPSNBUJPO&YQPSUʱʹΑΔ
   

   View Slide

9. Ұൠతͳϑϩʔٕज़
   9 ਐ౻ࢿ܇ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱΑΓҾ༻
   

   View Slide

10. Ұൠతͳϑϩʔٕज़
    ਐ౻ࢿ܇ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱΑΓҾ༻
    10
    

    View Slide

11. w -εΠονͰϧʔλͷ΍ΓͱΓ͢΂ͯΛ
    

    ˞
    ͕ͭͳ͛ΒΕͨϙʔτʹϛϥʔ͢Δ
    w ˞
    ͸ϛϥʔ͞ΕͨύέοτΛ
    

    ϑϩʔ৘ใʹ·ͱΊ 5FMFHSBGࣗ࡞
    

    ϓϥάΠϯ
    σʔλετΞ *O
    fl
    VY%#
    
    

    ʹ֨ೲ͠άϥϑͱͯ͠දࣔ (SBGBOB
    
    

    ͨ͠Γ௚઀σʔλ
    

    ετΞΛࢀরͨ͠Γ
    

    ͢Δ 'MVY
    
    ຊൃදํࣜͷΠϝʔδ
    11
    ϙʔτϛϥʔରԠͷ
    -εΠον
    ˣ
    ϧʔλ
    ˣ
    ˢ
    ແઢ"1ͱ͔
    ˢ
    -εΠον͔ΒਨΕྲྀ͞ΕΔύέοτΛͻͨ͢
    Βऩूͯ͠ϑϩʔ৘ใʹ·ͱΊσʔλετΞʹ
    

    ֨ೲ͠άϥϑͱͯ͠දࣔͨ͠ΓͳΜ͔͋ͬͨ࣌ʹ
    σʔλΛूܭͨ͠Γ͢ΔػೳΛ࣋ͭͻͱ ˞
    
    ୺຤ͱ͔
    ˣ
    Πϥετ $
    ͍Β͢ͱ΍
    

    View Slide

12. ຊൃදํࣜͷ༧ࢉײ
    12
    ϙʔτϛϥʔ͢ΔεΠον
    '4$0.445
    ໿ ԁ ੫ࠐ
    
    !'4$0.௚ൢαΠτ
    5FMFHSBG*O
    fl
    VY%#(SBGBOB
    1$&OHJOFT"16
    ໿ ԁ ੫ࠐ
    
    !εΠοναΠΤϯε
    

    View Slide

13. (SBGBOB
    w ͳʹ͕͔͠ͷܭଌ஋ .FUJDT
    Λ໰͍߹Θͤ
    ͨΓ 2VFSZ
    ɺՄࢹԽͨ͠Γ 7JTVBMJ[F
    ɺܯ
    ࠂͨ͠Γ "MFSUPO
    ɺཧղͨ͠Γ
    6OEFSTUBOE
    ͢ΔͨΊͷιϑτ΢ΣΞ
    w ๮άϥϑɺંΕઢάϥϑɺԁάϥϑɺʜͳͲ
    ๛෋ͳάϥϑԽϥΠϒϥϦΛ࣋ͭ
    w ରԠ͢Δσʔλιʔε ܭଌ஋ .FUSJDT
    ͷஔ
    ͖৔ॴ
    ͕๛෋ 1PTUHSF42-ɺ.Z42-ɺ
    *O
    fl
    VY%#ɺʜ
    
    w ແঈͰ࢖͑ΔΦʔϓϯιʔε൛ͱ༗ঈͷΤϯ
    λʔϓϥΠζ൛ɺΫϥ΢υ্ͷαʔϏεͱ͠
    ͯ࢖͏Ϋϥ΢υ൛͕͋Δ
    13 (SBGBOBTBOECPYΑΓҾ༻
    

    View Slide

14. *O
    fl
    VY%#
    w ͍ΘΏΔ࣌ܥྻσʔλϕʔε 5JNFTFSJFTEBUBCBTF 54%#
    
    ͷͻͱͭͰ
    ࣌ܥྻσʔλΛ֨ೲ͠ఏڙ͢ΔͨΊʹ࠷దԽ͞Εͨϛυϧ΢ΣΞ
    w ࣌ܥྻσʔλͷѻ͍ʹಛԽ͢ΔͷͰʜ
    w جຊతʹ$36%ͷ͏ͪ% ࡟আ
    ΍6 ߋ৽
    ͸ൃੜ͠ͳ͍ ͨͩ͠ظؒࢦఆ
    ࡟আ͸ׂͱ͋Δ
    ͷͰ$ ࡞੒
    ͱ3 ࢀর
    ʹΨνΨνʹ࠷దԽ
    w ࣌ࠁͷظؒͰߜΓࠐΉ͜ͱ͕ଟ͍ͷͰ࣌ࠁͷظؒͷմͰσʔλΛ֨ೲ
    w ͢ΔͳͲ͍ͯ͠Δ
    w ΋ͷ͘͢͝ࡶʹઆ໌͢ΔͱΠϯσοΫε͞Εͨ࣌ࠁσʔλͷΧϥϜ͕͋ͬ
    ͯεΩʔϚ͕ΏΔ;ΘͳϦϨʔγϣφϧσʔλϕʔεʁ
    w ΫΤϦݴޠͱͯ͠*O
    fl
    VY2- ઌൃ
    ͱ'MVY ޙൃ
    Λఏڙ͍ͯ͠Δ
    w (SBGBOBͱಉ༷044൛ɺΤϯλʔϓϥΠζ൛ɺΫϥ΢υ൛͕͋Δ
    14
    

    View Slide

15. 5FMFHSBG
    w ܭଌ஋ .FUJDT
    ΍Πϕϯτ৘ใΛγεςϜ΍*P5ηϯαʔͳͲ͔Βऩू͠
    ͦΕΛαʔό *O
    fl
    VY%#ͳͲ
    ʹૹΔΤʔδΣϯτιϑτ΢ΣΞ
    w ϓϥάΠϯ͕௒ॆ࣮͍ͯ͠Δ
    w *OQVUʜ$16࢖༻཰ɺϝϞϦ࢖༻཰ɺσΟεΫ࢖༻཰ɺσΟεΫ*0ෛ
    ՙɺϩʔυΞϕϨʔδɺωοτϫʔΫΠϯλʔϑΣʔε౷ܭΧ΢ϯλɺ
    4/.1ɺ֤छαʔόϓϩηε )551%ɺ1PTU
    fi
    Yɺ%PWFDPUɺʜ
    ɺʜ
    w 0VUQVUʜ$SFBUF%#ɺ&MBTUJDTFBSDIɺ(SBQIJUFɺ.POHP%#ɺ
    *O
    fl
    VY%#ɺʜ
    w 5FMFHSBGࣗମʹ͸ϑϩʔ৘ใΛऩू͢Δػೳ͸ͳ͍ͷͰࠓճ͸ͦͷͨΊʹ
    EQEL
    fl
    PXͱ͍͏ϓϥάΠϯΛ࡞੒ͨ͠
    15
    

    View Slide

16. EQEL
    fl
    PX֓ཁ
    w ࢦఆͨ͠ωοτϫʔΫΠϯλʔϑΣʔεʹಧ͍ͨύέοτΛ%1%,Ͱͻͨ
    ͢Βٵ͍ࠐΈϑϩʔ৘ใΛऩू͠σʔλετΞ΁ు͖ग़ͨ͢Ίͷ5FMFHSBG
    ͷϓϥάΠϯ
    w .35μϯϓ ͋Δ࣌఺ͷ#(1ܦ࿏৘ใΛు͖ग़ͨ͠ϑΝΠϧ
    ͷ"4@1"5)
    ଐੑΛ༻͍Δ͜ͱͰѼઌ΍ૹ৴ݩͷ*1ΞυϨε͔Β"4৘ใΛௐ΂ͯه࿥
    ͢Δ͜ͱ͕Մೳ
    w .35μϯϓ͸3PVUF7JFXTϓϩδΣΫτͳͲͰೖख͢Δ͜ͱ͕Ͱ͖Δ
    w ϩʔΧϧωοτϫʔΫͷϓϨϑΟΫεΛఆٛ͢Δ͜ͱͰํ޲ JODPNJOHɺ
    PVUHPJOHɺJOUFSOBMɺFYUFSOBM
    ຖʹ෼ྨ͢Δ
    w ͲͷϓϩύςΟͰू໿͢Δ͔Λํ޲ຖʹࢦఆ͢Δ͜ͱ͕Մೳ
    16
    

    View Slide

17. EQEL
    fl
    PXઃఆྫ
    17
    [[inputs.dpdkflow]]
    
    
    main_core_index = 2
    
    
    interval = 60
    
    
    local_nets_ipv4 = ["192.168.1.0/24"]
    
    
    local_nets_ipv6 = ["2001:db8:0:1::/64"]
    
    
    aggregate_incoming = ["iface", "vlan", "af", "proto", "dst_host", "src_as", "app"]
    
    
    aggregate_outgoing = ["iface", "vlan", "af", "proto", "src_host", "dst_as", "app"]
    
    
    mrt_rib_path = "path/to/mrt_rib_file"
    
    
    [[inputs.dpdkflow.core]]
    
    
    index = 3
    
    
    [[inputs.dpdkflow.core.port]]
    
    
    index = 0
    
    
    description = "Port1"
    
    
    port_vlan_id = 1
    
    
    tag_vlan_ids = [11, 12]
    ˞ JOQVUTEQEL
    fl
    PXDPSF͸ෳ਺ׂΓ౰ͯΔ
    ͜ͱ͕Մೳ
    ˞ ͻͱͭͷJOQVUTEQEL
    fl
    PXDPSFʹෳ਺ͷ
    JOQVUTEQEL
    fl
    PXDPSFQPSUΛׂΓ౰ͯΔ
    ͜ͱ΋JOQVUTEQEL
    fl
    PXDPSFQPSU͝ͱ
    ʹJOQVUTEQEL
    fl
    PXDPSFΛׂΓ౰ͯΔ͜
    ͱ΋Ͱ͖Δ
    

    View Slide

18. EQEL
    fl
    PXσʔλͷྫ
    18
    @NFBTVSF
    NFOU @
    fi
    FME @WBMVF @UJNF EJSFDUJPO TSD@IPTU TSD@BT ETU@IPTU ETU@BT BQQ@EFTD
    EQEL
    fl
    PX CZUFT JODPNJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX CZUFT JODPNJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX QBDLFUT JODPNJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX QBDLFUT JODPNJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX CZUFT PVUHPJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX CZUFT PVUHPJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX QBDLFUT PVUHPJOH UDQ
    IUUQT
    
    EQEL
    fl
    PX QBDLFUT PVUHPJOH UDQ
    IUUQT
    
    εϖʔεͷ౎߹ͰJGBDFɺWMBOɺBGɺQSPUP͸লུ
    

    View Slide

19. EQEL
    fl
    PX࣮૷
    19
    ઃఆ৘ใ ྫ
    
    Πϯλʔόϧඵ
    ϩʔΧϧωοτ
    JODPNJOHू໿<Ѽઌ*1ΞυϨεɺૹ৴ݩ"4ɺΞϓϦ>
    PVUHPJOHू໿<Ѽઌ"4ɺૹ৴ݩ*1ΞυϨεɺΞϓϦ>
    ᶃ ωοτϫʔΫΠϯλʔϑΣʔε͔ΒύέοτΛड৴
    ᶄ Ѽઌ*1ΞυϨεͱૹ৴ݩ*1ΞυϨεΛϩʔΧϧωοτઃఆͱ
    ൺֱ͠ํ޲ΛٻΊΔ
    

    ্هͷྫͰ͸Ѽઌ͕ϩʔΧϧωοτͰૹ৴ݩ͕ϩʔΧϧ
    ωοτͰ͸ͳ͍ͷͰJODPNJOH
    
    ᶅ ํ޲ʹԠͨ͡ू໿ઃఆΛௐ΂ඞཁͳ৘ใΛٻΊΔ
    

    ্هͷྫͰ͸JODPNJOHू໿ʹૹ৴ݩ"4͕͋ΔͷͰૹ৴ݩ
    *1ΞυϨε͔Βͦͷ"4൪߸Λௐ΂ϙʔτ൪߸ͷখ͍͞ํ͕
    ͳͷͰΞϓϦΛUDQ
    IUUQ
    ͱ͢Δ
    
    ᶆ ᶅͰٻΊͨू໿ઃఆΛΩʔʹϑϩʔ৘ใςʔϒϧ͔Βϑϩʔ
    ৘ใΛ୳͢
    

    ˠΩʔʹҰக͢Δϑϩʔ৘ใ͕ͳ͚Ε͹৽͘͠ొ࿥
    

    ˠ͋Ε͹ͦͷϑϩʔ৘ใͷύέοτ਺ͱόΠτ਺Λ૿΍͢
    ᶇ ࠷ॳʹड৴ͨ࣌͠ࠁ͕ΠϯλʔόϧඵҎ্ܦա͍ͯ͠Δ΋ͷ
    ΛऔΓग़͠αʔό *O
    fl
    VY%#
    ʹૹ৴͢Δ
    Ѽઌ*1ΞυϨε
    ૹ৴ݩ*1ΞυϨε
    Ѽઌ5$1ϙʔτ൪߸
    ૹ৴ݩ5$1ϙʔτ൪߸
    όΠτ਺
    ड৴ύέοτ ྫ
    
    ϑϩʔ৘ใςʔϒϧ
    ํ޲JODPNJOH
    Ѽઌ*1ΞυϨε
    ૹ৴ݩ"4
    ΞϓϦUDQ
    IUUQ
    
    ύέοτ਺
    όΠτ਺
    ࠷ॳʹड৴ͨ࣌͠ࠁ
    ํ޲JODPNJOH
    Ѽઌ*1ΞυϨε
    ૹ৴ݩ"4
    ΞϓϦUDQ
    IUUQ
    
    ύέοτ਺
    όΠτ਺
    ࠷ॳʹड৴ͨ࣌͠ࠁ
    ํ޲JODPNJOH
    Ѽઌ*1ΞυϨε
    ૹ৴ݩ"4
    ΞϓϦUDQ
    IUUQ
    
    ύέοτ਺
    όΠτ਺
    ࠷ॳʹड৴ͨ࣌͠ࠁ
    

    View Slide

20. 'MVY֓ཁ
    w 'MVY͸Φʔϓϯιʔεͷؔ਺ܕσʔλεΫϦϓτݴޠ 'VODUJPOBMEBUB
    TDSJQUJOHMBOHVBHF
    
    w σʔλΛ໰͍߹ΘͤͨΓ 2VFSZJOH
    ɺ෼ੳͨ͠Γ "OBMZ[JOH
    ɺૢ࡞ͨ͠
    Γ "DUJOH
    ͢ΔͨΊʹઃܭ͞Ε͍ͯΔ
    w ҎԼͷෳ਺ͷσʔλιʔεʹରԠ͍ͯ͠Δ
    w ࣌ܥྻσʔλϕʔε 5JNFTFSJFTEBUBCBTFT
    ྫ*O
    fl
    VY%#
    
    w ϦϨʔγϣφϧ42-σʔλϕʔε 3FMBUJPOBM42-EBUBCBTFT
    ྫ
    .Z42-ɺ1PTUHSF42-
    
    w $47
    20
    

    View Slide

21. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢
    'MVY͜Μͳײ͡
    21
    from(bucket: "example-bucket")
    
    
    |> range(start: -1d)
    
    
    |> filter(fn: (r) => r._measurement == "example-measurement")
    
    
    |> mean()
    
    
    |> yield(name: "_results")
    

    View Slide

22. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢
    'MVY͜Μͳײ͡
    22
    from(bucket: "example-bucket")
    
    
    |> range(start: -1d)
    
    
    |> filter(fn: (r) => r._measurement == "example-measurement")
    
    
    |> mean()
    
    
    |> yield(name: "_results")
    

    View Slide

23. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢
    'MVY͜Μͳײ͡
    23
    from(bucket: "example-bucket")
    
    
    |> range(start: -1d)
    
    
    |> filter(fn: (r) => r._measurement == "example-measurement")
    
    
    |> mean()
    
    
    |> yield(name: "_results")
    

    View Slide

24. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢
    'MVY͜Μͳײ͡
    24
    from(bucket: "example-bucket")
    
    
    |> range(start: -1d)
    
    
    |> filter(fn: (r) => r._measurement == "example-measurement")
    
    
    |> mean()
    
    
    |> yield(name: "_results")
    

    View Slide

25. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢
    'MVY͜Μͳײ͡
    25
    from(bucket: "example-bucket")
    
    
    |> range(start: -1d)
    
    
    |> filter(fn: (r) => r._measurement == "example-measurement")
    
    
    |> mean()
    
    
    |> yield(name: "_results")
    

    View Slide

26. 'MVYσʔλϞσϧ
    w ςʔϒϧετϦʔϜ 4USFBNPGUBCMFT
    
    w θϩݸҎ্ͷςʔϒϧͷू·Γ
    w σʔλιʔε͔Β͸ςʔϒϧετϦʔϜ͕
    ݁Ռͱͯ͠ฦ͞ΕΔ
    w ςʔϒϧ 5BCMF
    
    w άϧʔϓΩʔͰ෼཭͞Εͨྻͱߦͷू·Γ
    w ྻ $PMVNO
    
    w ಉ͡ܕͷ஋ͷू·Γ
    w ߦ 3PX
    
    w ؔ࿈͢Δྻͷ஋ͷू·Γ
    w άϧʔϓΩʔ (SPVQLFZ
    
    w ςʔϒϧͷதͰڞ௨͢Δྻͱͦͷ஋ͷ૊Έ
    ߹Θͤ
    26
    ʰ'MVYEBUBNPEFMc'MVYY%PDVNFOUBUJPOʱΑΓҾ༻
    

    View Slide

27. 'MVYάϧʔϓΩʔ
    27
    @UJNF @WBMVF @
    fi
    FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD
    CZUFT JODPNJOH UDQ
    IUUQT
    
    CZUFT JODPNJOH UDQ
    IUUQT
    
    CZUFT JODPNJOH UDQ
    IUUQT
    
    @UJNF @WBMVF @
    fi
    FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD
    CZUFT JODPNJOH VEQ
    RVJD
    
    CZUFT JODPNJOH VEQ
    RVJD
    
    CZUFT JODPNJOH VEQ
    RVJD
    
    @UJNF @WBMVF @
    fi
    FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD
    CZUFT JODPNJOH UDQ
    IUUQ
    
    CZUFT JODPNJOH UDQ
    IUUQ
    
    CZUFT JODPNJOH UDQ
    IUUQ
    
    άϧʔϓΩʔ<@
    fi
    FMECZUFT EJSFDUJPOJODPNJOH TSD@BT ETU@IPTU BQQ@EFTDUDQ
    IUUQT
    >
    άϧʔϓΩʔ<@
    fi
    FMECZUFT EJSFDUJPOJODPNJOH TSD@BT ETU@IPTU BQQ@EFTDVEQ
    RVJD
    >
    άϧʔϓΩʔ<@
    fi
    FMECZUFT EJSFDUJPOJODPNJOH TSD@BT ETU@IPTU BQQ@EFTDUDQ
    IUUQ
    >
    

    View Slide

28. 'MVYू໿ "HHSFHBUFT
    ͱબ୒ 4FMFDUPST
    
    28
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT UDQ
    IUUQT
    
    CZUFT UDQ
    IUUQT
    
    CZUFT UDQ
    IUUQT
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT VEQ
    RVJD
    
    CZUFT VEQ
    RVJD
    
    CZUFT VEQ
    RVJD
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT UDQ
    IUUQ
    
    CZUFT UDQ
    IUUQ
    
    CZUFT UDQ
    IUUQ
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT UDQ
    IUUQT
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT VEQ
    RVJD
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT UDQ
    IUUQ
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT UDQ
    IUUQ
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT VEQ
    RVJD
    
    @WBMVF @
    fi
    FME BQQ@EFTD
    CZUFT UDQ
    IUUQT
    
    ू໿ؔ਺NFBO ฏۉ
    Λ࣮ߦͨ͠৔߹ʜ
    બ୒ؔ਺NBY ࠷େ
    Λ࣮ߦͨ͠৔߹ʜ
    

    View Slide

29. 'MVYXJOEPX ࣌ؒ࣠ํ޲ͷૢ࡞
    
    29
    @WBMVF @UJNF @TUBSU @TUPQ @
    fi
    FME
    CZUFT
    CZUFT
    CZUFT
    CZUFT
    CZUFT
    CZUFT
    CZUFT
    CZUFT
    CZUFT
    @WBMVF @UJNF @TUBSU @TUPQ @
    fi
    FME
    CZUFT
    CZUFT
    CZUFT
    @WBMVF @UJNF @TUBSU @TUPQ @
    fi
    FME
    CZUFT
    CZUFT
    CZUFT
    @WBMVF @UJNF @TUBSU @TUPQ @
    fi
    FME
    CZUFT
    CZUFT
    CZUFT
    XJOEPX FWFSZN
    
    Λ࣮ߦ͢Δͱʜ
    w ͜ͷޙʹू໿ؔ਺΍બ୒ؔ਺Λ࣮ߦ͢Ε͹ظؒ͝ͱʹूܭ͢Δ͜ͱ͕Ͱ͖Δ
    w ͨͩ͜ͷΑ͏ͳॲཧ͸Α͘ߦΘΕΔͷͰBHHSFHBUF8JOEPXͱ͍͏΋ͬͱศརͳؔ਺͕༻ҙ͞Ε͍ͯΔ ޙड़
    
    

    View Slide

30. 'MVYཁ͢Δʹʜ
    w ςʔϒϧετϦʔϜʹؚ·ΕΔςʔϒϧͻͱ͕ͭંΕઢάϥϑͷઢͻͱͭ
    ʹରԠ͢Δ
    ˠ ॻ͖͍ͨάϥϑͷઢͷڞ௨߲͕άϧʔϓΩʔʹͳΔΑ͏ʹάϧʔϓΛ
    ߟ͑ΫΤϦΛॻ͘
    w ͡Ό͋άϧʔϓ͸Ͳ͏΍ͬͯૢ࡞͢Δͷ͔ʁ
    ˠ HSPVQؔ਺ ۩ମྫޙड़
    ΍XJOEPXؔ਺ લड़
    ͳͲͰߦ͏
    30
    

    View Slide

31. 'MVYࣄྫ
    "4ผτοϓ
    w ૹ৴ݩ"4ຖͷμ΢ϯϩʔυ௨৴ྔΛάϥϑ
    Խ͍ͨ͠
    w ୠ͠"4ͷ਺͕ଟ͘ͳΔͱάϥϑ͕ද͖ࣔ͠
    Εͳ͘ͳΔͷͰಛʹ௨৴ྔͷଟ͍"4τοϓ
    ͷΈද͍ࣔͨ͠
    w HSPVQؔ਺Λ࣮ߦ͢Δ͜ͱͰҾ਺ʹࢦఆ͠
    ͨྻΛάϧʔϓΩʔͷྻʹࢦఆ͢Δ Ҿ਺ͳ
    ͩ͠ͱͻͱͭͷςʔϒϧͰฦ͞ΕΔ
    
    w TVNؔ਺Ͱάϧʔϓຖͷ߹ܭ஋ΛٻΊUPQO
    ؔ਺Ͱ্ҐߦΛऔಘ͠
    fi
    OE$PMVNOؔ਺
    Ͱૹ৴ݩ"4ͷ഑ྻΛಘΔ
    w BHHSFHBUF8JOEPXؔ਺Ͱ෼ࠁΈͰ߹ܭ
    w όΠτͰ͸ͳ͘Ϗοτʹ͍ͨ͠ͷͰNBQؔ
    ਺Ͱඍमਖ਼
    31
    data = from(bucket: "dpdkflow")
    
    
    |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
    
    
    |> filter(fn: (r) => r["_measurement"] == "dpdkflow")
    
    
    |> filter(fn: (r) => r["_field"] == "bytes")
    
    
    |> filter(fn: (r) => r["direction"] == "incoming")
    
    
    |> filter(fn: (r) => exists r["src_as"])
    
    
    |> group(columns: ["src_as"])
    
    
    topn = data
    
    
    |> sum()
    
    
    |> group()
    
    
    |> top(n: 10)
    
    
    |> findColumn(fn: (key) => true, column: "src_as")
    
    
    data
    
    
    |> filter(fn: (r) => contains(value: r["src_as"],
    

    set: topn))
    
    
    |> aggregateWindow(every: 1m, fn: sum,
    

    createEmpty: true)
    
    
    |> map(fn: (r) => ({ r with _value: float(v: r._value)
    

    * 8.0 / 60.0 }))
    
    
    |> yield(name: "topn")
    
    
    

    View Slide

32. 'MVYࣄྫ
    ύʔηϯλΠϧ
    w Ոఉ಺ͷ୺຤୆ʹ͖ͭύʔηϯλΠϧ
    ͷଳҬίϛοτΛઃఆͦ͠ΕΛ௒͑ͨ෼͸
    ͦͷ෼ʹԠ͓ͯ͡খݣ͍͔ΒఱҾ͖͍ͨ͠
    w ࢖༻ଳҬ͸෼ฏۉͰܭࢉ͢Δ
    w SBOHFؔ਺ͷTUBSUͱTUPQʹ͸࣌ࠁϦςϥϧ
    Ͱϲ݄෼Λࢦఆ͢Δ͕࣌ࠁϦςϥϧ͸65$
    Ͱ͔͠ࢦఆͰ͖ͳ͍ͷͰ+45ͱͷࠩ෼࣌ؒ
    Λݮࢉ͢Δ
    w RVBOUJMFؔ਺ͰύʔηϯλΠϧ஋ΛٻΊ
    Δ RVBOUJMFؔ਺͸͔Β·ͰͰ͸ͳ͘
    ͔Β·Ͱͷුಈখ਺఺਺ΛҾ਺ʹͱΔ
    
    w BHHSFHBUF8JOEPXؔ਺Ͱ͸෼ຖͷ߹ܭ௨
    ৴όΠτ਺͕ಘΒΕΔͷͰNBQؔ਺ͰϏο
    τʹม׵͠෼ ඵ
    ͰׂΔ
    32
    from(bucket: "dpdkflow")
    
    
    |> range(start: time(v: uint(v:
    

    2022-05-01T00:00:00.000Z) - uint(v: 9h)),
    
    
    stop: time(v: uint(v:
    

    2022-06-01T00:00:00.000Z) - uint(v: 9h)))
    
    
    |> filter(fn: (r) => r["_measurement"] == "dpdkflow")
    
    
    |> filter(fn: (r) => r["_field"] == "bytes")
    
    
    |> filter(fn: (r) => r["direction"] == "incoming")
    
    
    |> filter(fn: (r) => exists r["dst_host"])
    
    
    |> group(columns: ["dst_host"])
    
    
    |> aggregateWindow(every: 5m, fn: sum,
    

    createEmpty: true)
    
    
    |> quantile(q: 0.95)
    
    
    |> map(fn: (r) => ({ r with _value: float(v: r._value)
    

    * 8.0 / 300.0 }))
    
    
    |> yield(name: "quantile")
    

    View Slide

33. ·ͱΊ
    w 5FMFHSBG ࣗ࡞ϓϥάΠϯ
    *O
    fl
    VY%#(SBGBOBͱ͍͏Φʔϓϯιʔειϑ
    τ΢ΣΞ܈Λ༻͍Δ͜ͱͰࣗ୐ͰϑϩʔղੳΛߦ͏͜ͱ͕Ͱ͖Δ
    w ͱΓ͋͑ͣdສԁఔ౓ͷॳظ౤ࢿ ϙʔτϛϥʔͰ͖ΔεΠονͱϑϩʔ
    ৘ใΛऩू͢Δαʔό
    Ͱ࣮ݱͰ͖Δ
    w ϑϩʔ৘ใΛऩू͠஝ੵ͓ͯ͘͜͠ͱͰωοτϫʔΫͰԿ͕ى͖͍ͯΔͷ
    ͔ ͋Δ͍͸Կ͕ى͖͍ͯͨͷ͔
    Λৄ͘͠஌Δ͜ͱ͕Ͱ͖Δ
    w ؾʹͳΔϓϩύςΟ "4ɺ*1ΞυϨεɺΞϓϦɺ౳
    ͕͋Ε͹ͦΕͰू໿͠
    ͨάϥϑΛࣄલʹ༻ҙ͓ͯ͘͜͠ͱͰԿ͔͋ͬͨ࣌ʹҟมʹؾ෇͚Δ
    w ҟมʹؾ෇͍ͨΒ'MVYͰΫΤϦΛॻ͘͜ͱͰৄ͘͠ௐ΂Δ͜ͱ͕Ͱ͖Δ
    w ஌ΒΜ͚Ͳ
    ͞·͟·ͳ౷ܭؔ਺΋͋ΔͬΆ͍
    33
    

    View Slide

34. ࢀߟจݙ
    w HJO[BEPUFMFHSBG5IFQMVHJOESJWFOTFSWFSBHFOUGPSDPMMFDUJOHSFQPSUJOHNFUSJDT
    w IUUQTHJUIVCDPNHJO[BEPUFMFHSBG
    w ਐ౻ࢿ܇ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱ
    w IUUQTXXXTMJEFTIBSFOFUNPUPOPSJTIJOEPTT
    w 'MVYY%PDVNFOUBUJPO
    w IUUQTEPDTJO
    fl
    VYEBUBDPN
    fl
    VYWY
    w *O
    fl
    VY%#044%PDVNFOUBUJPO
    w IUUQTEPDTJO
    fl
    VYEBUBDPNJO
    fl
    VYECW
    w 5FMFHSBG%PDVNFOUBUJPO
    w IUUQTEPDTJO
    fl
    VYEBUBDPNUFMFHSBGW
    w (SBGBOBEPDVNFOUBUJPO
    w IUUQTHSBGBOBDPNEPDTHSBGBOBMBUFTU
    34
    

    View Slide