NSM Operation

This chapter covers some aspects related to the service nsm operation <txt> tool, which allows operations to be configured to measure network quality with active traffic probes and feed system alarms.

To measure network quality, different parameter averages are calculated, such as: the Round-Trip-Time (RTT), the jitter and packet loss in exchanges between the device and a remote location. These averages are calculated based on the last N probes sent, which can be configured through the window field (2, by default).

Depending on the protocol through which probes are sent, the type of NSM operation must be configured using one of the following values:

  • icmp: for ICMP packets.

  • udp: for SLA UDP packets.

  • twamp: for TWAMP-test packets (rfc5357).

To easily identify each of the operations created, a short description can be added using the description field.

The probe sending an interval for each NSM operation can also be configured. By default, probes are sent every second.

For each probe sent, there is a timeout after which the probe is considered lost. This time can be changed through the timeout field (by default, 1 second). This value is also used as rtt for the average rtt/jitter calculation when a packet is lost.

The logging field is used to configure the probe statistics logging through syslog messages. It has two subfields: log-interval (defaults to 60 seconds) and log-level (defaults to info). The first one is used to configure the interval in seconds between each log message, and the second one is used to configure the message log level.

Regarding the socket through which probes are sent, different parameters can be configured:

  • local-address: to configure the local socket address.

  • local-port: to configure the local socket port.

  • destination-address: to configure the destination address (mandatory for all types of operations).

  • destination-port: to configure the destination port (mandatory for udp and twamp, not posible for icmp).

  • local-vrf or local-interface: to configure the interface or vrf to which the socket has to be bound. If probes are sent through said interface or vrf, packets received from another interface or socket are discarded.

  • mark or vrf-mark: to configure the mark for each probe sent through the socket. Useful for mark-based routing or packet filtering.

  • tos: to configure the Type-Of-Service (TOS) field of the IP packets sent with each probe (by default 0). Useful for prioritizing packets on the network.

  • ttl: to configure the Time-To-Live (TTL) field of the IP packets sent with each probe (by default, 64).

  • size: to configure the size of packets sent with each probe. Depending on the type of operation used, a minimum size must be indicated:

    • icmp: greater than, or equal to, 12 bytes.

    • udp: greater than, or equal to, 16 bytes.

    • twamp: greater than, or equal to, 41 bytes.

An NSM operation can be configured to feed more than one alarm defined in the system. To do this, the name of the alarm and the threshold value of the measured network parameter that will activate this alarm must be indicated. Several thresholds can be set for an alarm, rtt, jitter, loss, rtt-jitter (the sum of rtt and jitter), so that it activates when any of the configured thresholds is reached.

If the value of the measured network parameter does not reach 70% of the activation threshold, an NSM operation also deactivates the relevant alarms. This default deactivation threshold can be changed by means of the deactivate field.

For both activate and deactivate, a waiting time can be configured before executing the corresponding action through the stabilization-time field (by default, 0 seconds).

It is also possible to configure a specific window for each alarm through the window field. The general window of the NSM operation described above is used by default.

Configuration

This is the syntax to create a service nsm operation <txt>:

set service nsm operation <op_name> [ ... ]

Examples

ICMP operation

Imagine you want to configure an ICMP-type NSM operation to measure network quality every 0.10 seconds and feed two different alarms.

For the first alarm, packet loss is checked and the following thresholds are set:

  • Activation: when the packet loss exceeds 5%.

  • Deactivation: when the packet loss drops to 0%.

For the second alarm, packet rtt delay is checked and the following thresholds are set:

  • Activation: when the rtt delay exceeds 150 milliseconds.

  • Deactivation: default value (70% of the activation threshold).

In OSDx, this can be achieved by setting the following commands:

set service nsm operation TEST_OPER alarm TEST_ALARM_1 activate loss 5
set service nsm operation TEST_OPER alarm TEST_ALARM_1 deactivate loss 0
set service nsm operation TEST_OPER alarm TEST_ALARM_2 activate rtt 0.150
set service nsm operation TEST_OPER destination-address 10.0.0.2
set service nsm operation TEST_OPER interval 0.10
set service nsm operation TEST_OPER type icmp

Here, you can find more examples related to service nsm operation.

Monitoring

Operational commands service nsm operation show and service nsm operation <value> show can be used to display statistics related to NSM operations.

Example:

admin@DUT0$ service nsm operation TEST_OPER show

-----------------------------------------------------------------------------------------------
Operation     Alarm      Status    RTT(s)    Jitter(s)   Loss(%)  Window  Toggled  Prev-toggled
-----------------------------------------------------------------------------------------------
TEST_OPER  TEST_ALARM_2  false   0.000882    0.000323        0.0  2/2
TEST_OPER  TEST_ALARM_1  false   0.000882    0.000323        0.0  2/2

Monitoring Probe Statistics through Syslog

The probe statistics can also be monitored via the syslog messages generated by the NSM operation. This is useful when you want to check network quality from a remote host, as this feature can be activated using the syslog server.

To log probe statistics, the logging field must be configured in NSM operation. The interval and level of the logs generated by the NSM operation can be configured through the log-interval (in seconds) and log-level fields.

Example:

set service nsm operation A destination-address 192.168.122.2
set service nsm operation A destination-port 60000
set service nsm operation A interval 0.05
set service nsm operation A local-address 192.168.122.4
set service nsm operation A local-interface eth0
set service nsm operation A logging log-interval 1
set service nsm operation A logging log-level info
set service nsm operation A type udp
set service nsm operation A window 100

A snippet of the syslog messages generated by the NSM operation can be seen below:

Sep 24 10:06:54 osdx nsmd[1851]: {"Description":"Im Descrption","DstIP":"192.168.122.2","Jitter":0.061851509999999998,"PacketLoss":0.0,"RTT":0.29407995000000076,"SrcIP":"192.168.122.4","SrcIface":"eth0","Timestamp":1727172414}

The syslog message contains a JSON with the following fields:

  • Description: (string) Description of the probe.

  • DstIP: (string) Destination IP address. When the destination is a FQDN, DesHostName is used instead.

  • DstHostName: (string) Destination hostname.

  • Jitter: (float) Jitter value in milliseconds.

  • PacketLoss: (float) Packet loss percentage.

  • RTT: (float) Round-Trip-Time value in milliseconds.

  • SrcIP: (string) Source IP address.

  • SrcIface: (string) Source interface.

  • Timestamp: (unsigned integer) Timestamp of the probe.

Once the NSM operation and syslog configuration are set, probe statistics can be sent and monitored from a remote host.

For more information about the syslog configuration, please refer to Syslog.

Together with some examples, you may find more information about NSM operation Here.

Command Summary

Configuration commands

Operational commands