bandwidth spikes

Folks,

Some of our Cobalt CacheRaQ customers running various Squid 2 versions
are seeing some strange bandwidth spikes. I'm wondering if anyone
else has seen these problems and if there's a solution (or if not
where to start hacking for a solution). Below are some links to
MRTG graphs that illustrate the phenomenon.

These graphs are from the point of view of an Ethernet switch. Two
switch ports are relevent, one port connected to the customer's router
to the net (he has a T1) and the other port connected to the cache,
which is operating transparently.

On the graphs, blue indicates traffic out of the switch port
(i.e. into the device in question) and green indicates traffic into
the switch port (out of the device in question).

Normal traffic levels:

on the router port: http://www.cobaltnet.com/users/gid/router-port.NORMAL.gif

on the cache port: http://www.cobaltnet.com/users/gid/cache-port.NORMAL.gif

During a spike:

router port: http://www.cobaltnet.com/users/gid/router-port.SPIKE.gif

cache port: http://www.cobaltnet.com/users/gid/cache-port.SPIKE.gif

During a spike, what seems to be happening is that Squid downloads one
or more large HTTP objects very rapidly. In one ~2 second interval,
tcpdump showed ~380KB on one TCP connection from a remote server to
squid. In the same interval a single dialin client got ~15KB on its
connection from the cache.

The conclustion from the last couple graphs is that the cache is
moving a lot of data through the router. This result of this is a lot
of dropped packets on the WAN link and (as a result) noticeably
degraded performance from the point of users (who complain about it).
So, I'm wondering if this problem has been observed by others. The
graphs above were from a system running 2.0.PATCH2 but we've seen
similar results from systems running 2.1.PATCH2. If this is a known
problem/issue, pointers to where to start hacking would be
appreciated.

Gideon Glass

Cobalt Networks, Inc
Received on Thu Jan 28 1999 - 22:22:57 MST