自宅フロー解析

NISOC(新潟インターネット研究会)の勉強会で発表した際の資料です。

Transcript

1. ࣗ୐ϑϩʔղੳ ઙؒਖ਼࿨
   !
   /*40$
   
2. ࣗ୐ϑϩʔղੳʁ w ͜͜Ͱ͸ʰϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़Λ༻͍ͯݱࡏωοτϫʔ ΫʹԿ͕ى͖͍ͯΔͷ͔ʁ͋Δ͍͸աڈʹԿ͕ى͖͍ͯͨͷ͔ʁΛղੳ͢ Δ͜ͱʱΛʰϑϩʔղੳʱͱݺͿ͜ͱʹ͢Δ
   w Α͘ΠϯλʔωοτΦϖϨʔλͷํ͕͜Μͳ͜ͱΛݴ͍ͬͯΔͷΛݟΔ͕
   w ʮ͜͜਺೔"4ͱͷ௨৴͕૿͍͑ͯΔʯ
   w ʮࠓिʹೖ͔ͬͯΒ5$1ͷ௨৴͕ٸ૿͍ͯ͠Δʯ
   w ϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़Λ༻͍Δ͜ͱͰ͜ͷΑ͏ͳωοτ ϫʔΫͰى͖͍ͯΔࣄ৅Λղੳ͢Δ͜ͱ͕Ͱ͖Δ
   w ຊൃදͰ͸5FMFHSBG ࣗ࡞ϓϥάΠϯ *O fl VY%#(SBGBOBͱ͍͏Φʔϓϯ ιʔειϑτ΢ΣΞ܈Λ༻͍ͯࣗ୐ͰϑϩʔղੳΛߦ͏ํ๏Λ঺հ͢Δ 2
3. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
4. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
5. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
6. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
7. ࢓ࣄΛαϘͬͯ͠͹Β͘μϥμϥͱ5XJUUFSΛݟ͍ͯͨࡍͷάϥϑྫ
8. ϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़ʁ w ͦ΋ͦ΋ϑϩʔ ͋Δ͍τϥϑΟοΫϑϩʔ ͱ͸ʜ ˞
   w ωοτϫʔΫ಺ͷ؍ଌ఺ΛҰఆִ࣌ؒؒ಺ʹ௨ա͢Δύέοτͷू߹
   w ಛఆͷϑϩʔʹଐ͢͢΂ͯͷύέοτ͸ڞ௨ͷϓϩύςΟͷू߹Λ࣋ͭ
   w ֤ʑͷϓϩύςΟ͸ʜ
   w ͻͱͭҎ্ͷϔομ஋ ྫ
   Ѽઌ*1ΞυϨεɺѼઌ5$1ϙʔτ൪߸
   w ͻͱͭҎ্ͷύέοτͦͷ΋ͷͷಛ௃ ྫ
   .1-4ϥϕϧͷ਺
   w ύέοτͷऔΓѻ͍͔ΒಘΒΕͨͻͱͭҎ্ͷϑΟʔϧυ ྫ
   ωΫε τϗοϓΞυϨεɺૹ৴ΠϯλʔϑΣʔε
   w ͜͜Ͱ͸ϑϩʔ৘ใΛऩूͦ͠ΕΛ΋ͱʹωοτϫʔΫΛ؅ཧ͢Δٕज़Λ ʰϑϩʔϕʔεͷωοτϫʔΫ؅ཧٕज़ ϑϩʔٕज़ ʱͱݺͿ͜ͱʹ͢Δ 8 ˞
   3'$
   ʰ"SDIJUFDUVSF
   GPS
   *1
   'MPX
   *OGPSNBUJPO
   &YQPSUʱ
   ʹΑΔ
9. Ұൠతͳϑϩʔٕज़ 9 ਐ౻
   ࢿ܇
   ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱ
   ΑΓҾ༻
10. Ұൠతͳϑϩʔٕज़ ਐ౻
    ࢿ܇
    ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱ
    ΑΓҾ༻ 10
11. w -εΠονͰϧʔλͷ΍ΓͱΓ͢΂ͯΛ 
 ˞ ͕ͭͳ͛ΒΕͨϙʔτʹϛϥʔ͢Δ
    w ˞ ͸ϛϥʔ͞ΕͨύέοτΛ 
 ϑϩʔ৘ใʹ·ͱΊ 5FMFHSBG ࣗ࡞ 
 ϓϥάΠϯ σʔλετΞ *O fl VY%# 
 ʹ֨ೲ͠άϥϑͱͯ͠දࣔ (SBGBOB 
 ͨ͠Γ௚઀σʔλ 
 ετΞΛࢀরͨ͠Γ 
 ͢Δ 'MVY ຊൃදํࣜͷΠϝʔδ 11 ϙʔτϛϥʔରԠͷ
    -εΠον
    ˣ ϧʔλ
    ˣ ˢ
    ແઢ"1ͱ͔ ˢ
    -εΠον͔ΒਨΕྲྀ͞ΕΔύέοτΛͻͨ͢ Βऩूͯ͠ϑϩʔ৘ใʹ·ͱΊσʔλετΞʹ 
 ֨ೲ͠άϥϑͱͯ͠දࣔͨ͠ΓͳΜ͔͋ͬͨ࣌ʹ σʔλΛूܭͨ͠Γ͢ΔػೳΛ࣋ͭͻͱ ˞ ୺຤ͱ͔
    ˣ Πϥετ
    $
    ͍Β͢ͱ΍
12. ຊൃදํࣜͷ༧ࢉײ 12 ϙʔτϛϥʔ͢ΔεΠον
    '4$0.
    445
    ໿ ԁ ੫ࠐ
    !'4$0.௚ൢαΠτ 5FMFHSBG*O fl VY%#(SBGBOB
    1$&OHJOFT
    "16
    ໿ ԁ ੫ࠐ
    !εΠοναΠΤϯε
13. (SBGBOB w ͳʹ͕͔͠ͷܭଌ஋ .FUJDT Λ໰͍߹Θͤ ͨΓ 2VFSZ ɺՄࢹԽͨ͠Γ 7JTVBMJ[F ɺܯ ࠂͨ͠Γ "MFSU
    PO ɺཧղͨ͠Γ 6OEFSTUBOE ͢ΔͨΊͷιϑτ΢ΣΞ
    w ๮άϥϑɺંΕઢάϥϑɺԁάϥϑɺʜͳͲ ๛෋ͳάϥϑԽϥΠϒϥϦΛ࣋ͭ
    w ରԠ͢Δσʔλιʔε ܭଌ஋ .FUSJDT ͷஔ ͖৔ॴ ͕๛෋ 1PTUHSF42-ɺ.Z42-ɺ *O fl VY%#ɺʜ
    w ແঈͰ࢖͑ΔΦʔϓϯιʔε൛ͱ༗ঈͷΤϯ λʔϓϥΠζ൛ɺΫϥ΢υ্ͷαʔϏεͱ͠ ͯ࢖͏Ϋϥ΢υ൛͕͋Δ 13 (SBGBOB
    TBOECPY
    ΑΓҾ༻
14. *O fl VY%# w ͍ΘΏΔ࣌ܥྻσʔλϕʔε 5JNF
    TFSJFT
    EBUBCBTF 54%# ͷͻͱͭͰ ࣌ܥྻσʔλΛ֨ೲ͠ఏڙ͢ΔͨΊʹ࠷దԽ͞Εͨϛυϧ΢ΣΞ
    w ࣌ܥྻσʔλͷѻ͍ʹಛԽ͢ΔͷͰʜ
    w جຊతʹ$36%ͷ͏ͪ% ࡟আ ΍6 ߋ৽ ͸ൃੜ͠ͳ͍ ͨͩ͠ظؒࢦఆ ࡟আ͸ׂͱ͋Δ ͷͰ$ ࡞੒ ͱ3 ࢀর ʹΨνΨνʹ࠷దԽ
    w ࣌ࠁͷظؒͰߜΓࠐΉ͜ͱ͕ଟ͍ͷͰ࣌ࠁͷظؒͷմͰσʔλΛ֨ೲ
    w ͢ΔͳͲ͍ͯ͠Δ
    w ΋ͷ͘͢͝ࡶʹઆ໌͢ΔͱΠϯσοΫε͞Εͨ࣌ࠁσʔλͷΧϥϜ͕͋ͬ ͯεΩʔϚ͕ΏΔ;ΘͳϦϨʔγϣφϧσʔλϕʔεʁ
    w ΫΤϦݴޠͱͯ͠*O fl VY2- ઌൃ ͱ'MVY ޙൃ Λఏڙ͍ͯ͠Δ
    w (SBGBOBͱಉ༷044൛ɺΤϯλʔϓϥΠζ൛ɺΫϥ΢υ൛͕͋Δ 14
15. 5FMFHSBG w ܭଌ஋ .FUJDT ΍Πϕϯτ৘ใΛγεςϜ΍*P5ηϯαʔͳͲ͔Βऩू͠ ͦΕΛαʔό *O fl VY%#ͳͲ ʹૹΔΤʔδΣϯτιϑτ΢ΣΞ
    w ϓϥάΠϯ͕௒ॆ࣮͍ͯ͠Δ
    w *OQVU
    ʜ
    $16࢖༻཰ɺϝϞϦ࢖༻཰ɺσΟεΫ࢖༻཰ɺσΟεΫ*0ෛ ՙɺϩʔυΞϕϨʔδɺωοτϫʔΫΠϯλʔϑΣʔε౷ܭΧ΢ϯλɺ 4/.1ɺ֤छαʔόϓϩηε )551%ɺ1PTU fi Yɺ%PWFDPUɺʜ ɺʜ
    w 0VUQVU
    ʜ
    $SFBUF%#ɺ&MBTUJDTFBSDIɺ(SBQIJUFɺ.POHP%#ɺ *O fl VY%#ɺʜ
    w 5FMFHSBGࣗମʹ͸ϑϩʔ৘ใΛऩू͢Δػೳ͸ͳ͍ͷͰࠓճ͸ͦͷͨΊʹ EQEL fl PXͱ͍͏ϓϥάΠϯΛ࡞੒ͨ͠ 15
16. EQEL fl PX
    ֓ཁ w ࢦఆͨ͠ωοτϫʔΫΠϯλʔϑΣʔεʹಧ͍ͨύέοτΛ%1%,Ͱͻͨ ͢Βٵ͍ࠐΈϑϩʔ৘ใΛऩू͠σʔλετΞ΁ు͖ग़ͨ͢Ίͷ5FMFHSBG ͷϓϥάΠϯ
    w .35μϯϓ ͋Δ࣌఺ͷ#(1ܦ࿏৘ใΛు͖ग़ͨ͠ϑΝΠϧ ͷ"4@1"5) ଐੑΛ༻͍Δ͜ͱͰѼઌ΍ૹ৴ݩͷ*1ΞυϨε͔Β"4৘ใΛௐ΂ͯه࿥ ͢Δ͜ͱ͕Մೳ
    w .35μϯϓ͸3PVUF7JFXTϓϩδΣΫτͳͲͰೖख͢Δ͜ͱ͕Ͱ͖Δ
    w ϩʔΧϧωοτϫʔΫͷϓϨϑΟΫεΛఆٛ͢Δ͜ͱͰํ޲ JODPNJOHɺ PVUHPJOHɺJOUFSOBMɺFYUFSOBM ຖʹ෼ྨ͢Δ
    w ͲͷϓϩύςΟͰू໿͢Δ͔Λํ޲ຖʹࢦఆ͢Δ͜ͱ͕Մೳ 16
17. EQEL fl PX
    ઃఆྫ 17 [[inputs.dpdkflow]] main_core_index = 2 interval = 60 local_nets_ipv4 = ["192.168.1.0/24"] local_nets_ipv6 = ["2001:db8:0:1::/64"] aggregate_incoming = ["iface", "vlan", "af", "proto", "dst_host", "src_as", "app"] aggregate_outgoing = ["iface", "vlan", "af", "proto", "src_host", "dst_as", "app"] mrt_rib_path = "path/to/mrt_rib_file" [[inputs.dpdkflow.core]] index = 3 [[inputs.dpdkflow.core.port]] index = 0 description = "Port1" port_vlan_id = 1 tag_vlan_ids = [11, 12] ˞ JOQVUTEQEL fl PXDPSF
    ͸ෳ਺ׂΓ౰ͯΔ ͜ͱ͕Մೳ
    ˞ ͻͱͭͷ
    JOQVUTEQEL fl PXDPSF
    ʹෳ਺ͷ
    JOQVUTEQEL fl PXDPSFQPSU
    ΛׂΓ౰ͯΔ ͜ͱ΋
    JOQVUTEQEL fl PXDPSFQPSU
    ͝ͱ ʹ
    JOQVUTEQEL fl PXDPSF
    ΛׂΓ౰ͯΔ͜ ͱ΋Ͱ͖Δ
18. EQEL fl PX
    σʔλͷྫ 18 @NFBTVSF NFOU @ fi FME @WBMVF @UJNF EJSFDUJPO TSD@IPTU TSD@BT ETU@IPTU ETU@BT BQQ@EFTD EQEL fl PX CZUFT   JODPNJOH   UDQ  IUUQT  EQEL fl PX CZUFT   JODPNJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   JODPNJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   JODPNJOH   UDQ  IUUQT  EQEL fl PX CZUFT   PVUHPJOH   UDQ  IUUQT  EQEL fl PX CZUFT   PVUHPJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   PVUHPJOH   UDQ  IUUQT  EQEL fl PX QBDLFUT   PVUHPJOH   UDQ  IUUQT  εϖʔεͷ౎߹Ͱ
    JGBDFɺ
    WMBOɺ
    BGɺ
    QSPUP
    ͸লུ
19. EQEL fl PX
    ࣮૷ 19 ઃఆ৘ใ ྫ 
    Πϯλʔόϧ
    
    ඵ
    ϩʔΧϧωοτ
    
    
    JODPNJOHू໿
    
    <
    Ѽઌ*1ΞυϨεɺૹ৴ݩ"4ɺΞϓϦ
    >
    PVUHPJOHू໿
    
    <
    Ѽઌ"4ɺૹ৴ݩ*1ΞυϨεɺΞϓϦ
    > ᶃ ωοτϫʔΫΠϯλʔϑΣʔε͔ΒύέοτΛड৴ ᶄ Ѽઌ*1ΞυϨεͱૹ৴ݩ*1ΞυϨεΛϩʔΧϧωοτઃఆͱ ൺֱ͠ํ޲ΛٻΊΔ 
 ্هͷྫͰ͸Ѽઌ͕ϩʔΧϧωοτͰૹ৴ݩ͕ϩʔΧϧ ωοτͰ͸ͳ͍ͷͰ
    JODPNJOH ᶅ ํ޲ʹԠͨ͡ू໿ઃఆΛௐ΂ඞཁͳ৘ใΛٻΊΔ 
 ্هͷྫͰ͸JODPNJOHू໿ʹૹ৴ݩ"4͕͋ΔͷͰૹ৴ݩ *1ΞυϨε͔Βͦͷ"4൪߸Λௐ΂ϙʔτ൪߸ͷখ͍͞ํ͕ ͳͷͰΞϓϦΛUDQ  IUUQ  ͱ͢Δ ᶆ ᶅͰٻΊͨू໿ઃఆΛΩʔʹϑϩʔ৘ใςʔϒϧ͔Βϑϩʔ ৘ใΛ୳͢ 
 ˠ
    ΩʔʹҰக͢Δϑϩʔ৘ใ͕ͳ͚Ε͹৽͘͠ొ࿥ 
 ˠ
    ͋Ε͹ͦͷϑϩʔ৘ใͷύέοτ਺ͱόΠτ਺Λ૿΍͢ ᶇ ࠷ॳʹड৴ͨ࣌͠ࠁ͕ΠϯλʔόϧඵҎ্ܦա͍ͯ͠Δ΋ͷ ΛऔΓग़͠αʔό *O fl VY%# ʹૹ৴͢Δ Ѽઌ*1ΞυϨε
    
    
    ૹ৴ݩ*1ΞυϨε
    
    
    Ѽઌ5$1ϙʔτ൪߸
    
    
    ૹ৴ݩ5$1ϙʔτ൪߸
    
    
    όΠτ਺
    
     ड৴ύέοτ ྫ  ϑϩʔ৘ใςʔϒϧ ํ޲
    
    JODPNJOH
    Ѽઌ*1ΞυϨε
    
    
    ૹ৴ݩ"4
    
    
    ΞϓϦ
    UDQ  IUUQ 
    ύέοτ਺
    
    
    όΠτ਺
    
    
    ࠷ॳʹड৴ͨ࣌͠ࠁ
    
     ํ޲
    
    JODPNJOH
    Ѽઌ*1ΞυϨε
    
    
    ૹ৴ݩ"4
    
    
    ΞϓϦ
    UDQ  IUUQ 
    ύέοτ਺
    
    
    όΠτ਺
    
    
    ࠷ॳʹड৴ͨ࣌͠ࠁ
    
     ํ޲
    
    JODPNJOH
    Ѽઌ*1ΞυϨε
    
    
    ૹ৴ݩ"4
    
    
    ΞϓϦ
    UDQ  IUUQ 
    ύέοτ਺
    
    
    όΠτ਺
    
    
    ࠷ॳʹड৴ͨ࣌͠ࠁ
    
    
20. 'MVY
    ֓ཁ w 'MVY͸Φʔϓϯιʔεͷؔ਺ܕσʔλεΫϦϓτݴޠ 'VODUJPOBM
    EBUB
    TDSJQUJOH
    MBOHVBHF
    w σʔλΛ໰͍߹ΘͤͨΓ 2VFSZJOH ɺ෼ੳͨ͠Γ "OBMZ[JOH ɺૢ࡞ͨ͠ Γ "DUJOH ͢ΔͨΊʹઃܭ͞Ε͍ͯΔ
    w ҎԼͷෳ਺ͷσʔλιʔεʹରԠ͍ͯ͠Δ
    w ࣌ܥྻσʔλϕʔε 5JNF
    TFSJFT
    EBUBCBTFT ྫ
    *O fl VY%#
    w ϦϨʔγϣφϧ42-σʔλϕʔε 3FMBUJPOBM
    42-
    EBUBCBTFT ྫ
    .Z42-ɺ1PTUHSF42-
    w $47 20
21. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢ 'MVY
    ͜Μͳײ͡ 21 from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
22. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢ 'MVY
    ͜Μͳײ͡ 22 from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
23. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢ 'MVY
    ͜Μͳײ͡ 23 from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
24. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢ 'MVY
    ͜Μͳײ͡ 24 from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
25. w σʔλιʔε͔Βࢦఆ͞ΕͨσʔλΛऔಘ
    w ࣌ؒ·ͨ͸ྻͷ஋ʹج͍ͮͯσʔλΛϑΟϧλ
    w σʔλΛظ଴͞ΕΔΑ͏ʹॲཧˍ੔ܗ
    w ݁ՌΛฦ͢ 'MVY
    ͜Μͳײ͡ 25 from(bucket: "example-bucket") |> range(start: -1d) |> filter(fn: (r) => r._measurement == "example-measurement") |> mean() |> yield(name: "_results")
26. 'MVY
    σʔλϞσϧ w ςʔϒϧετϦʔϜ 4USFBN
    PG
    UBCMFT
    w θϩݸҎ্ͷςʔϒϧͷू·Γ
    w σʔλιʔε͔Β͸ςʔϒϧετϦʔϜ͕ ݁Ռͱͯ͠ฦ͞ΕΔ
    w ςʔϒϧ 5BCMF
    w άϧʔϓΩʔͰ෼཭͞Εͨྻͱߦͷू·Γ
    w ྻ $PMVNO
    w ಉ͡ܕͷ஋ͷू·Γ
    w ߦ 3PX
    w ؔ࿈͢Δྻͷ஋ͷू·Γ
    w άϧʔϓΩʔ (SPVQ
    LFZ
    w ςʔϒϧͷதͰڞ௨͢Δྻͱͦͷ஋ͷ૊Έ ߹Θͤ 26 ʰ'MVY
    EBUB
    NPEFM
    c
    'MVY
    Y
    %PDVNFOUBUJPOʱ
    ΑΓҾ༻
27. 'MVY
    άϧʔϓΩʔ 27 @UJNF @WBMVF @ fi FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD   CZUFT JODPNJOH   UDQ  IUUQT    CZUFT JODPNJOH   UDQ  IUUQT    CZUFT JODPNJOH   UDQ  IUUQT  @UJNF @WBMVF @ fi FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD   CZUFT JODPNJOH   VEQ  RVJD    CZUFT JODPNJOH   VEQ  RVJD    CZUFT JODPNJOH   VEQ  RVJD  @UJNF @WBMVF @ fi FME EJSFDUJPO TSD@BT ETU@IPTU BQQ@EFTD   CZUFT JODPNJOH   UDQ  IUUQ    CZUFT JODPNJOH   UDQ  IUUQ    CZUFT JODPNJOH   UDQ  IUUQ  άϧʔϓΩʔ
    
    <@ fi FME
    CZUFT
    EJSFDUJPO
    JODPNJOH
    TSD@BT
    
    ETU@IPTU
    
    BQQ@EFTD
    UDQ  IUUQT  > άϧʔϓΩʔ
    
    <@ fi FME
    CZUFT
    EJSFDUJPO
    JODPNJOH
    TSD@BT
    
    ETU@IPTU
    
    BQQ@EFTD
    VEQ  RVJD  > άϧʔϓΩʔ
    
    <@ fi FME
    CZUFT
    EJSFDUJPO
    JODPNJOH
    TSD@BT
    
    ETU@IPTU
    
    BQQ@EFTD
    UDQ  IUUQ  >
28. 'MVY
    ू໿ "HHSFHBUFT ͱબ୒ 4FMFDUPST 28 @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQT   CZUFT UDQ  IUUQT   CZUFT UDQ  IUUQT  @WBMVF @ fi FME BQQ@EFTD  CZUFT VEQ  RVJD   CZUFT VEQ  RVJD   CZUFT VEQ  RVJD  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQ   CZUFT UDQ  IUUQ   CZUFT UDQ  IUUQ  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQT  @WBMVF @ fi FME BQQ@EFTD  CZUFT VEQ  RVJD  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQ  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQ  @WBMVF @ fi FME BQQ@EFTD  CZUFT VEQ  RVJD  @WBMVF @ fi FME BQQ@EFTD  CZUFT UDQ  IUUQT  ू໿ؔ਺NFBO ฏۉ Λ࣮ߦͨ͠৔߹ʜ બ୒ؔ਺NBY ࠷େ Λ࣮ߦͨ͠৔߹ʜ
29. 'MVY
    XJOEPX ࣌ؒ࣠ํ޲ͷૢ࡞ 29 @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT     CZUFT @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT @WBMVF @UJNF @TUBSU @TUPQ @ fi FME     CZUFT     CZUFT     CZUFT XJOEPX FWFSZ
    N
    Λ࣮ߦ͢Δͱʜ w ͜ͷޙʹू໿ؔ਺΍બ୒ؔ਺Λ࣮ߦ͢Ε͹ظؒ͝ͱʹूܭ͢Δ͜ͱ͕Ͱ͖Δ
    w ͨͩ͜ͷΑ͏ͳॲཧ͸Α͘ߦΘΕΔͷͰBHHSFHBUF8JOEPXͱ͍͏΋ͬͱศརͳؔ਺͕༻ҙ͞Ε͍ͯΔ ޙड़
30. 'MVY
    ཁ͢Δʹʜ w ςʔϒϧετϦʔϜʹؚ·ΕΔςʔϒϧͻͱ͕ͭંΕઢάϥϑͷઢͻͱͭ ʹରԠ͢Δ
    ˠ ॻ͖͍ͨάϥϑͷઢͷڞ௨߲͕άϧʔϓΩʔʹͳΔΑ͏ʹάϧʔϓΛ ߟ͑ΫΤϦΛॻ͘
    w ͡Ό͋άϧʔϓ͸Ͳ͏΍ͬͯૢ࡞͢Δͷ͔ʁ
    ˠ HSPVQؔ਺ ۩ମྫޙड़ ΍XJOEPXؔ਺ લड़ ͳͲͰߦ͏ 30
31. 'MVY
    ࣄྫ 
    "4ผτοϓ w ૹ৴ݩ"4ຖͷμ΢ϯϩʔυ௨৴ྔΛάϥϑ Խ͍ͨ͠
    w ୠ͠"4ͷ਺͕ଟ͘ͳΔͱάϥϑ͕ද͖ࣔ͠ Εͳ͘ͳΔͷͰಛʹ௨৴ྔͷଟ͍"4τοϓ ͷΈද͍ࣔͨ͠
    w HSPVQؔ਺Λ࣮ߦ͢Δ͜ͱͰҾ਺ʹࢦఆ͠ ͨྻΛάϧʔϓΩʔͷྻʹࢦఆ͢Δ Ҿ਺ͳ ͩ͠ͱͻͱͭͷςʔϒϧͰฦ͞ΕΔ
    w TVNؔ਺Ͱάϧʔϓຖͷ߹ܭ஋ΛٻΊUPQO ؔ਺Ͱ্ҐߦΛऔಘ͠ fi OE$PMVNOؔ਺ Ͱૹ৴ݩ"4ͷ഑ྻΛಘΔ
    w BHHSFHBUF8JOEPXؔ਺Ͱ෼ࠁΈͰ߹ܭ
    w όΠτͰ͸ͳ͘Ϗοτʹ͍ͨ͠ͷͰNBQؔ ਺Ͱඍमਖ਼ 31 data = from(bucket: "dpdkflow") |> range(start: v.timeRangeStart, stop: v.timeRangeStop) |> filter(fn: (r) => r["_measurement"] == "dpdkflow") |> filter(fn: (r) => r["_field"] == "bytes") |> filter(fn: (r) => r["direction"] == "incoming") |> filter(fn: (r) => exists r["src_as"]) |> group(columns: ["src_as"]) topn = data |> sum() |> group() |> top(n: 10) |> findColumn(fn: (key) => true, column: "src_as") data |> filter(fn: (r) => contains(value: r["src_as"], 
 set: topn)) |> aggregateWindow(every: 1m, fn: sum, 
 createEmpty: true) |> map(fn: (r) => ({ r with _value: float(v: r._value) 
 * 8.0 / 60.0 })) |> yield(name: "topn")
32. 'MVY
    ࣄྫ 
    ύʔηϯλΠϧ w Ոఉ಺ͷ୺຤୆ʹ͖ͭύʔηϯλΠϧ ͷଳҬίϛοτΛઃఆͦ͠ΕΛ௒͑ͨ෼͸ ͦͷ෼ʹԠ͓ͯ͡খݣ͍͔ΒఱҾ͖͍ͨ͠
    w ࢖༻ଳҬ͸෼ฏۉͰܭࢉ͢Δ
    w SBOHFؔ਺ͷTUBSUͱTUPQʹ͸࣌ࠁϦςϥϧ Ͱϲ݄෼Λࢦఆ͢Δ͕࣌ࠁϦςϥϧ͸65$ Ͱ͔͠ࢦఆͰ͖ͳ͍ͷͰ+45ͱͷࠩ෼࣌ؒ Λݮࢉ͢Δ
    w RVBOUJMFؔ਺ͰύʔηϯλΠϧ஋ΛٻΊ Δ RVBOUJMFؔ਺͸͔Β·ͰͰ͸ͳ͘ ͔Β·Ͱͷුಈখ਺఺਺ΛҾ਺ʹͱΔ
    w BHHSFHBUF8JOEPXؔ਺Ͱ͸෼ຖͷ߹ܭ௨ ৴όΠτ਺͕ಘΒΕΔͷͰNBQؔ਺ͰϏο τʹม׵͠෼ ඵ ͰׂΔ 32 from(bucket: "dpdkflow") |> range(start: time(v: uint(v: 
 2022-05-01T00:00:00.000Z) - uint(v: 9h)), stop: time(v: uint(v: 
 2022-06-01T00:00:00.000Z) - uint(v: 9h))) |> filter(fn: (r) => r["_measurement"] == "dpdkflow") |> filter(fn: (r) => r["_field"] == "bytes") |> filter(fn: (r) => r["direction"] == "incoming") |> filter(fn: (r) => exists r["dst_host"]) |> group(columns: ["dst_host"]) |> aggregateWindow(every: 5m, fn: sum, 
 createEmpty: true) |> quantile(q: 0.95) |> map(fn: (r) => ({ r with _value: float(v: r._value) 
 * 8.0 / 300.0 })) |> yield(name: "quantile")
33. ·ͱΊ w 5FMFHSBG ࣗ࡞ϓϥάΠϯ *O fl VY%#(SBGBOBͱ͍͏Φʔϓϯιʔειϑ τ΢ΣΞ܈Λ༻͍Δ͜ͱͰࣗ୐ͰϑϩʔղੳΛߦ͏͜ͱ͕Ͱ͖Δ
    w ͱΓ͋͑ͣdສԁఔ౓ͷॳظ౤ࢿ ϙʔτϛϥʔͰ͖ΔεΠονͱϑϩʔ ৘ใΛऩू͢Δαʔό Ͱ࣮ݱͰ͖Δ
    w ϑϩʔ৘ใΛऩू͠஝ੵ͓ͯ͘͜͠ͱͰωοτϫʔΫͰԿ͕ى͖͍ͯΔͷ ͔ ͋Δ͍͸Կ͕ى͖͍ͯͨͷ͔ Λৄ͘͠஌Δ͜ͱ͕Ͱ͖Δ
    w ؾʹͳΔϓϩύςΟ "4ɺ*1ΞυϨεɺΞϓϦɺ౳ ͕͋Ε͹ͦΕͰू໿͠ ͨάϥϑΛࣄલʹ༻ҙ͓ͯ͘͜͠ͱͰԿ͔͋ͬͨ࣌ʹҟมʹؾ෇͚Δ
    w ҟมʹؾ෇͍ͨΒ'MVYͰΫΤϦΛॻ͘͜ͱͰৄ͘͠ௐ΂Δ͜ͱ͕Ͱ͖Δ
    w ஌ΒΜ͚Ͳ ͞·͟·ͳ౷ܭؔ਺΋͋ΔͬΆ͍ 33
34. ࢀߟจݙ w HJO[BEPUFMFHSBG
    5IF
    QMVHJOESJWFO
    TFSWFS
    BHFOU
    GPS
    DPMMFDUJOH
    
    SFQPSUJOH
    NFUSJDT
    w IUUQTHJUIVCDPNHJO[BEPUFMFHSBG
    w ਐ౻
    ࢿ܇
    ʰϑϩʔٕज़ʹΑΔωοτϫʔΫ؅ཧʱ
    w IUUQTXXXTMJEFTIBSFOFUNPUPOPSJTIJOEPTT
    w 'MVY
    Y
    %PDVNFOUBUJPO
    w IUUQTEPDTJO fl VYEBUBDPN fl VYWY
    w *O fl VY%#
    044
    
    %PDVNFOUBUJPO
    w IUUQTEPDTJO fl VYEBUBDPNJO fl VYECW
    w 5FMFHSBG
    
    %PDVNFOUBUJPO
    w IUUQTEPDTJO fl VYEBUBDPNUFMFHSBGW
    w (SBGBOB
    EPDVNFOUBUJPO
    w IUUQTHSBGBOBDPNEPDTHSBGBOBMBUFTU 34