workload measurement: in the Internet `core' 


(background only: dag oc48 capture card)
current oc48mon system (prototype at MFN in SJC, subc/collab. w U.Waikato)
captures 1M packets/sec to disk (40% util. link)
provides highly accurate timestamping
.5Mp, 1Gbps (125MB/sec) each direction
avg pkt size 370, 590 bytes (210k, 340k pkts/sec)
64 bytes/record -> 6-9X compression over link load
problems: bursts of small packets cause machine thrash
http://dag.cs.waikato.ac.nz/

upgrading oc48mon this qtr to house (bigger) Dag4.10 cards 
dual-Pentium (Intel) processor on tyan S2510 
1GB of RAM
floppy, cdrom 
IDE/ATA disk drive (40GB min)
6 SCSI Ultra/160 disks, 3/each SCSI channel each 18GB min
4U rack mountable chassis 

this will get us One Hour (and just barely, and ~50GB)
(MFN SJC 76 min @20:00 PDT 5 aug 2001 ==> 32GB)