topic Re: CE590 http Saving in Application Networking

CE590 http Saving

m.abdallah — Thu, 31 Oct 2002 14:13:11 GMT

I installed Cisco Content Engine 590 on ISP network

How can I test the performance of the CE590 ??

What is the accepted saving percentage ?

sh ver

Cisco Content Engine

Cisco Content Engine Software Release 3.11 (build FCS May 30 2001)

Version: ce590-cache-3.1.1

Compiled 09:49:25 May 30 2001 by bbalagot

Compile Time Options: PP

System was restarted on Thu Oct 31 11:39:00 2002.

The system has been up for 2 hours, 5 minutes, 42 seconds.

content#

content#sh staticontent#sh statistics htt saving

Statistics - Savings

Requests Bytes

-----------------------------------------------------------

Total: 123145 805553899

Miss: 106612 761272868

Savings: 13.4 % 5.5 %

What is the accepted saving percentage ?

My router show my the following statistics :

Router#show ip wccp web-cache

Global WCCP information:

Router information:

Router Identifier: 62.32.60.254

Protocol Version: 2.0

Service Identifier: web-cache

Number of Cache Engines: 1

Number of routers: 1

Total Packets Redirected: 882029

Redirect access-list: -none-

Total Packets Denied Redirect: 0

Total Packets Unassigned: 0

Group access-list: -none-

Total Messages Denied to Group: 0

Total Authentication failures: 0

Router#show ip wccp web-cache detail

WCCP Cache-Engine information:

IP Address: 62.32.60.250

Protocol Version: 2.0

State: Usable

Initial Hash Info: 00000000000000000000000000000000

00000000000000000000000000000000

Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Hash Allotment: 256 (100.00%)

Packets Redirected: 882673

Connect Time: 02:14:08

I think, the caching performance is not good

What do you suggest ??

Thanks

Mohamed Abdallah

Re: CE590 http Saving

pknoops — Fri, 01 Nov 2002 14:01:43 GMT

Mohamed,

It's hard to say what an acceptable number should be in this senario, but in general I would say something in the 30-40% savings range is normal. This is dependant on the configuration say if you're bypassing certain clients, servers, etc..

In your senario, you should probably take a look at the "show bypass" data and get a sense of why you have misses and bypasses. In many instances, people who do not have PTR records of their CE ip address in their DNS network see problems simply due to the fact that external websites very often do reverse lookups and this can cause alot of bypass instances.

Regards

Pete Knoops

Cisco Systems

Re: CE590 http Saving

pknoops — Fri, 01 Nov 2002 14:03:21 GMT

I should also add to my other comments that you would certainly be better off running 4.1.2 software on the CE as this is much cleaner code with respect to WCCP. I would have to say that this is critical !!

Pete..

Re: CE590 http Saving

m.abdallah — Fri, 01 Nov 2002 20:00:51 GMT

Pete,

Thanks for your help

PTR record is done

The CE is configured as transparent caching

show bypass give me server error

content#show bypass

Total number of HTTP connections bypassed = 216349

Connections bypassed due to system overload = 0

Connections bypassed due to authentication issues = 0

Connections bypassed due to facilitate error transparency = 216349

Connections bypassed due to static configuration = 0

Total number of entries in the bypass list = 43

Number of Authentication bypass entries = 0

Number of Error bypass entries = 43

Number of Static Configuration entries = 0

content#

content#show bypass list

Client Server Entry type

------ ------ ----------

62.32.60.41:0 212.133.68.62:80 server-error

62.32.60.42:0 213.184.179.67:80 server-error

62.32.60.41:0 128.242.201.186:80 server-error

62.32.60.41:0 193.227.13.44:80 server-error

62.32.60.41:0 193.111.198.37:80 server-error

62.32.60.42:0 216.239.53.101:80 server-error

62.32.60.41:0 64.94.89.210:80 server-error

62.32.60.41:0 212.26.27.88:80 server-error

62.32.60.42:0 193.232.242.69:80 server-error

62.32.60.41:0 66.218.77.72:80 server-error

62.32.60.41:0 66.163.173.23:80 server-error

62.32.60.42:0 198.64.138.89:80 server-error

62.32.60.42:0 66.135.192.83:80 server-error

62.32.60.41:0 130.127.28.32:80 server-error

62.32.60.41:0 171.68.4.69:80 server-error

62.32.60.41:0 195.229.240.108:80 server-error

62.32.60.41:0 128.242.237.107:80 server-error

62.32.60.42:0 217.52.21.203:80 server-error

62.32.60.41:0 62.65.186.197:80 server-error

62.32.60.41:0 216.167.51.189:80 server-error

62.32.60.42:0 64.94.89.210:80 server-error

62.32.60.42:0 212.31.2.45:80 server-error

62.32.60.61:0 209.247.228.210:80 server-error

62.32.60.42:0 193.232.242.65:80 server-error

62.32.60.41:0 66.218.77.68:80 server-error

62.32.60.41:0 205.214.64.191:80 server-error

62.32.60.61:0 147.208.175.70:80 server-error

62.32.60.41:0 216.239.33.104:80 server-error

62.32.60.42:0 216.167.51.189:80 server-error

62.32.60.41:0 193.78.46.43:80 server-error

62.32.60.41:0 206.129.95.55:80 server-error

62.32.60.42:0 66.40.9.142:80 server-error

62.32.60.41:0 66.70.83.135:80 server-error

62.32.60.42:0 63.68.55.65:80 server-error

62.32.60.42:0 195.161.119.249:80 server-error

62.32.60.41:0 65.199.10.130:80 server-error

62.32.60.42:0 66.135.192.11:80 server-error

62.32.60.41:0 63.88.212.80:80 server-error

62.32.60.42:0 195.161.113.4:80 server-error

62.32.60.41:0 133.6.152.2:80 server-error

62.32.60.42:0 66.45.5.89:80 server-error

62.32.60.41:0 66.218.77.70:80 server-error

62.32.60.41:0 209.225.53.187:80 server-error

62.32.60.41:0 216.239.53.101:80 server-error

62.32.60.41:0 193.232.242.69:80 server-error

content#

Saving now is 8% , and performance is not good

What do you suggest ?

Regards

Mohamed Abdallah

Re: CE590 http Saving

m.abdallah — Fri, 01 Nov 2002 20:05:03 GMT

Pete,

The latest ver. of CE on Cisco web is 3.11

where can I get the ver. 4.1.2 ???

Regards

Mohamed Abdallah

Re: CE590 http Saving

m.abdallah — Fri, 01 Nov 2002 21:34:16 GMT

Pete,

My setup is :

PIX firewall connected between the internal network and the inernet.

All clients & Servers are on the inside network and there are three ISA proxy servers (insdie of the PIX ) which all clients browseres them it for http internet connection.

CE 590 & main router (3661) connectedd the outside of the PIX

Main router 3661 FastEther connected to ouside network of the PIX ( CE 590 on this network also ), and 3661 Serial is connetced to internet.

CE 590 ip address is public address

PIX is doing NAT translation from internal private addresses ( 10.x.x.x ) to public addresses

PTR record with content.uruklink.net to public ip address of the CE590

My CE configuration is :

-----------------------------------

hostname content

ip domain-name uruklink.net

interface FastEthernet 0/0

ip address 62.32.60.250 255.255.255.0

exit

interface FastEthernet 0/1

shutdown

exit

ip default-gateway 62.32.60.254

ip name-server 62.32.60.1

wccp router-list 1 62.32.60.254

wccp web-cache router-list-num 1

wccp version 2

In the Router configuration :

---------------------------------------

ip wccp web-cache

ip cef

and in the Fastethernet connect to PIX outside and CE 590

ip route-cache same-interface

and in the Serial connect to internet

ip wccp web-cache redirect out

Do I have anything missing or wrong in my CE and router configuration ?

Thanks

Regards

Mohamed Abdallah

Re: CE590 http Saving

m.abdallah — Mon, 04 Nov 2002 07:13:56 GMT

Pete,

i have notice that there was NO cfs on my disks

so I created cfs by disk manufacture disk01 cfs command

now my disks :

content#show disk-part disk00

Disk size in 512 byte blocks: 35566448

num: type start size status

-----------------------------------------------------

0: SWFS 32 3145728 System Reserved

1: SYSFS 3145760 7113289 mounted at local1

2: NONE

3: NONE

Free disk space: 25307431 blocks (12357 M)

content#show disk-part disk01

Disk size in 512 byte blocks: 35566448

num: type start size status

-----------------------------------------------------

0: CFS 32 35566448 mounted

1: NONE

2: NONE

3: NONE

Free disk space: 0 blocks (0 M)

content#

**** The Saving percentage increase but still have a lot of bypass ****

content#show stat http sav

Statistics - Savings

Requests Bytes

-----------------------------------------------------------

Total: 7055526 52055575500

Miss: 5375178 45450041794

Savings: 23.8 % 12.7 %

content#

content#show bypass

Total number of HTTP connections bypassed = 192678

Connections bypassed due to system overload = 0

Connections bypassed due to authentication issues = 0

Connections bypassed due to facilitate error transparency = 192678

Connections bypassed due to static configuration = 0

Total number of entries in the bypass list = 35

Number of Authentication bypass entries = 0

Number of Error bypass entries = 35

Number of Static Configuration entries = 0

content#

content#show bypass list

Client Server Entry type

------ ------ ----------

62.32.60.40:0 66.180.230.128:80 server-error

62.32.60.41:0 66.180.230.143:80 server-error

62.32.60.41:0 207.68.176.190:80 server-error

62.32.60.40:0 208.184.29.70:80 server-error

62.32.60.41:0 199.104.132.230:80 server-error

62.32.60.41:0 216.136.131.30:80 server-error

62.32.60.41:0 66.180.230.42:80 server-error

62.32.60.40:0 213.253.55.27:80 server-error

62.32.60.41:0 209.157.71.50:80 server-error

62.32.60.41:0 217.66.226.9:80 server-error

62.32.60.41:0 216.239.37.102:80 server-error

62.32.60.40:0 207.46.196.108:80 server-error

62.32.60.40:0 193.232.242.71:80 server-error

62.32.60.41:0 213.219.2.46:80 server-error

62.32.60.41:0 195.188.170.32:80 server-error

62.32.60.40:0 66.180.230.135:80 server-error

62.32.60.41:0 207.46.196.108:80 server-error

62.32.60.40:0 66.179.17.168:80 server-error

62.32.60.41:0 198.65.220.224:80 server-error

62.32.60.40:0 152.163.208.185:80 server-error

62.32.60.41:0 208.184.29.50:80 server-error

62.32.60.40:0 216.27.95.48:80 server-error

62.32.60.40:0 63.88.212.80:80 server-error

62.32.60.40:0 81.9.32.2:80 server-error

62.32.60.41:0 152.163.208.185:80 server-error

62.32.60.40:0 66.180.230.110:80 server-error

62.32.60.40:0 165.193.123.40:80 server-error

62.32.60.41:0 64.55.105.88:80 server-error

62.32.60.41:0 216.239.33.100:80 server-error

62.32.60.41:0 216.244.111.206:80 server-error

62.32.60.40:0 216.32.242.251:80 server-error

62.32.60.41:0 209.54.220.67:80 server-error

62.32.60.41:0 213.171.193.15:80 server-error

62.32.60.41:0 216.239.51.106:80 server-error

62.32.60.41:0 204.71.61.248:80 server-error

62.32.60.41:0 66.180.230.41:80 server-error

62.32.60.41:0 209.71.218.253:80 server-error

Do you have suggestion ??

Thanks for your help

Regards

Mohamed Abdallah

Re: CE590 http Saving

pknoops — Mon, 04 Nov 2002 12:35:58 GMT

Mohamed,

This is a classic case of the nimda virus of something of that nature. You will want to put in the following filters and then do a show rules to see if you are getting hits on them. I would imagine you will definately see hits based on the "error transparency" number listed in your last reply.

Rules:

rule block url-regex .*/default\.ida

rule block url-regex .*/root.exe

rule block url-regex .*\cmd.exe

rule block url-regex ^http://.*www\.worm\.com/default\.ida$

rule block url-regex ^http://.*/default\.ida$

rule no-cache url-regex .*cgi-bin.*

rule no-cache url-regex .*aw-cgi.*

Pete..

Re: CE590 http Saving

m.abdallah — Mon, 04 Nov 2002 15:36:06 GMT

Pete,

why do you think there is a nimda virus ??

how can I get the no. of hits on these applied rules ? show rule all command didnot show any hits !!!!!!

after 30 min. from applying the rules, I got the below output :

What do you suggest ??

Thanks for your help

Regards

Mohamed Abdallah

content#show rule all

Rules Template Configuration

----------------------------

Rule Processing Enabled

rule block url-regex .*\cmd.exe

rule block url-regex .*/root.exe

rule block url-regex .*/default\.ida

rule block url-regex ^http://.*/default\.ida$

rule block url-regex ^http://.*www\.worm\.com/default\.ida$

rule no-cache url-regex .*aw-cgi.*

rule no-cache url-regex .*cgi-bin.*

content#

content#show stat http sav

Statistics - Savings

Requests Bytes

-----------------------------------------------------------

Total: 7814793 57478234325

Miss: 5809413 49596461300

Savings: 25.7 % 13.7 %

content#

content#show bypass

Total number of HTTP connections bypassed = 442687

Connections bypassed due to system overload = 0

Connections bypassed due to authentication issues = 0

Connections bypassed due to facilitate error transparency = 442687

Connections bypassed due to static configuration = 0

Total number of entries in the bypass list = 58

Number of Authentication bypass entries = 0

Number of Error bypass entries = 58

Number of Static Configuration entries = 0

content#

content#show bypass list

Client Server Entry type

------ ------ ----------

62.32.60.41:0 209.132.206.147:80 server-error

62.32.60.41:0 216.203.156.216:80 server-error

62.32.60.40:0 194.8.167.244:80 server-error

62.32.60.41:0 200.199.201.83:80 server-error

62.32.60.40:0 207.25.71.195:80 server-error

62.32.60.40:0 64.94.89.168:80 server-error

62.32.60.41:0 216.136.131.30:80 server-error

62.32.60.41:0 216.39.104.49:80 server-error

62.32.60.41:0 209.61.228.212:80 server-error

62.32.60.41:0 64.94.89.210:80 server-error

62.32.60.40:0 207.46.196.108:80 server-error

62.32.60.41:0 128.242.118.139:80 server-error

62.32.60.40:0 128.121.4.44:80 server-error

62.32.60.41:0 66.163.173.23:80 server-error

62.32.60.40:0 64.41.146.221:80 server-error

62.32.60.41:0 194.8.167.244:80 server-error

62.32.60.41:0 170.97.67.13:80 server-error

62.32.60.41:0 130.127.28.32:80 server-error

62.32.60.41:0 64.156.188.61:80 server-error

62.32.60.41:0 66.218.70.227:80 server-error

62.32.60.41:0 216.94.230.2:80 server-error

62.32.60.41:0 192.41.170.60:80 server-error

62.32.60.41:0 159.18.1.68:80 server-error

62.32.60.41:0 161.58.226.240:80 server-error

62.32.60.41:0 62.161.94.168:80 server-error

62.32.60.41:0 216.167.51.189:80 server-error

62.32.60.41:0 209.15.63.191:80 server-error

62.32.60.41:0 209.10.17.133:80 server-error

62.32.60.41:0 66.218.70.105:80 server-error

62.32.60.41:0 199.231.130.13:80 server-error

62.32.60.41:0 12.129.204.160:80 server-error

62.32.60.41:0 66.218.77.68:80 server-error

62.32.60.40:0 208.170.46.164:80 server-error

62.32.60.41:0 216.239.33.104:80 server-error

62.32.60.41:0 128.121.124.167:80 server-error

62.32.60.41:0 207.46.196.109:80 server-error

62.32.60.41:0 130.54.44.157:80 server-error

62.32.60.41:0 193.233.1.233:80 server-error

62.32.60.40:0 216.239.39.100:80 server-error

62.32.60.41:0 144.226.72.36:80 server-error

62.32.60.41:0 62.4.85.236:80 server-error

62.32.60.41:0 216.239.51.126:80 server-error

62.32.60.40:0 65.89.139.6:80 server-error

62.32.60.41:0 204.71.191.241:80 server-error

62.32.60.41:0 200.199.201.81:80 server-error

62.32.60.41:0 65.199.10.130:80 server-error

62.32.60.41:0 205.158.107.32:80 server-error

62.32.60.41:0 207.182.248.211:80 server-error

62.32.60.41:0 66.28.60.230:80 server-error

62.32.60.40:0 193.111.198.37:80 server-error

62.32.60.40:0 80.94.193.92:80 server-error

62.32.60.41:0 65.214.39.7:80 server-error

62.32.60.41:0 216.239.51.101:80 server-error

62.32.60.40:0 64.94.89.210:80 server-error

62.32.60.40:0 216.120.60.144:80 server-error

62.32.60.41:0 193.232.242.69:80 server-error

62.32.60.40:0 64.83.28.78:80 server-error

62.32.60.61:0 any-server:0 server-error

content#

Re: CE590 http Saving

pknoops — Mon, 04 Nov 2002 15:43:26 GMT

Sorry about the confusion on the exact command.

Please take a look at "show stat rule all"

It should look something like this:

---------------------show stat rule all---------------------

Rules Template Statistics

-------------------------

rule block domain www.test.com

Rule hit count = 0

rule block domain www.test.com

Rule hit count = 0

rule no-cache dst-ip 10.1.1.1 255.255.255.0

Rule hit count = 0

rule no-cache url-regex .*cgi-bin.*

Rule hit count = 0

rule no-cache url-regex .*aw-cgi.*

Rule hit count = 0

rule no-cache domain smartforce.com

Rule hit count = 0

I would imagine you will see hit counts here.

Pete

Re: CE590 http Saving

m.abdallah — Mon, 04 Nov 2002 20:36:08 GMT

Pete,

Thanks for your help

Yes, I find some hits on cmd.exe and root.exe

What does that mean ?

Do I have an infected Server by virus ? Which Server ?

What do you suggest ?

content#show stat rule all

Rules Template Statistics

-------------------------

Rule hit count = 0 Rule: rule block url-regex ^http://.*/default\.ida$

Rule hit count = 0 Rule: rule block url-regex ^http://.*www\.worm\.com/defa

Rule hit count = 28 Rule: rule block url-regex .*\cmd.exe

Rule hit count = 4 Rule: rule block url-regex .*/root.exe

Rule hit count = 0 Rule: rule block url-regex .*/default\.ida

Rule hit count = 0 Rule: rule no-cache url-regex .*aw-cgi.*

Rule hit count = 0 Rule: rule no-cache url-regex .*cgi-bin.*

Regards

Mohamed Abdallah

Re: CE590 http Saving

m.abdallah — Tue, 05 Nov 2002 08:08:12 GMT

Pete,

Today the cmd.exe and root.exe hits increase , and a new hit ( one hit ) appear for http://.*/default\.ida$

Is this a virus ? which server is affected ?

Can the virus affect my CE 590 ?

I noticed also that the CFS ( disk01 ) is full, NO FREE Sapce for CFS !!!!!

content#show stat rule all

Rules Template Statistics

-------------------------

Rule hit count = 1 Rule: rule block url-regex ^http://.*/default\.ida$

Rule hit count = 0 Rule: rule block url-regex ^http://.*www\.worm\.com/default\.ida$

Rule hit count = 71 Rule: rule block url-regex .*\cmd.exe

Rule hit count = 12 Rule: rule block url-regex .*/root.exe

Rule hit count = 0 Rule: rule block url-regex .*/default\.ida

Rule hit count = 0 Rule: rule no-cache url-regex .*aw-cgi.*

Rule hit count = 0 Rule: rule no-cache url-regex .*cgi-bin.*

content#show stat http sav

Statistics - Savings

Requests Bytes

-----------------------------------------------------------

Total: 9138555 66713366028

Miss: 6597236 56776713800

Savings: 27.8 % 14.9 %

content#

content#sho disk-partitions disk00

Disk size in 512 byte blocks: 35566448

num: type start size status

-----------------------------------------------------

0: SWFS 32 3145728 System Reserved

1: SYSFS 3145760 7113289 mounted at local1

2: NONE

3: NONE

Free disk space: 25307431 blocks (12357 M)

content#

content#show disk-partitions disk01

Disk size in 512 byte blocks: 35566448

num: type start size status

-----------------------------------------------------

0: CFS 32 35566448 mounted

1: NONE

2: NONE

3: NONE

Free disk space: 0 blocks (0 M)

content#

Re: CE590 http Saving

pknoops — Tue, 05 Nov 2002 12:49:35 GMT

Mohamed,

So now it appears that you are blocking the nimda virus and maybe some others that are affecting your CE (this is good that you are now blocking them)

I see that the savings has increased (this is good too). I would now verify in your network that you are virus free. Also, you can do a "clear cache" on the CE to clean up the disk and start off fresh now that you are blocking the viruses.

Regards

Pete..

Re: CE590 http Saving

m.abdallah — Tue, 05 Nov 2002 13:35:19 GMT

Pete,

I cleaned the Cache using clear cache command.

The saving percentage is decreased again

content#show stat http saving

Statistics - Savings

Requests Bytes

-----------------------------------------------------------

Total: 25759 178627253

Miss: 22442 169925318

Savings: 12.9 % 4.9 %

Is there is command that can show me the saved web on my CE 590 ?

Thanks

Regards

Mohamed Abdallah

Re: CE590 http Saving

m.abdallah — Tue, 05 Nov 2002 13:45:58 GMT

Pete,

Do you still recommend to upgrade the CE 590 with ACNS 4.2.x ?

Re: CE590 http Saving

pknoops — Tue, 05 Nov 2002 15:42:06 GMT

I would highly recommend you upgrade. There is no other way to put it. ACNS 4.2 is definately the way to go especially when you are runnning a 590 that is a powerful CE.

Pete..

Re: CE590 http Saving

pknoops — Tue, 05 Nov 2002 15:43:37 GMT

Mohamed,

The savings went down now because alot of the information has to be received from the web to the CE now that it has nothing cached. In effect, once it is up for a while, you should see the savings increase and then stabilize

Pete..

Re: CE590 http Saving

m.abdallah — Tue, 05 Nov 2002 18:08:10 GMT

Pete,

I will upgrade to ACNS ver. 4.2.3

After upgrading, Does the CE 590 keep its old configuration ?

OR Should I make some changes in the configuration with the new ACNS 4.2.3 ??

Regards

Mohamed Abdallah

Re: CE590 http Saving

pknoops — Tue, 05 Nov 2002 19:17:31 GMT

Old config should be fine

Pete..

Re: CE590 http Saving

m.abdallah — Wed, 18 Dec 2002 09:11:28 GMT

Pete,

Thanks for your help

The CE590 saving performance is 30% : 40%

i think this is a good performance

I have a question regarding the CE590

If the internet link is down, and the client open its browser

Should he get the web site from the CE ( browse the cached site ) while the internet link is down ?

Thanks

Regards

Mohamed Abdallah