Chapter 9: Microbursts; Searching For Microbursts - Network Instruments GigaStor User Manual

Searching for microbursts

For a computer network, a microburst is an unusually large amount of data in a short time frame that saturates
your network and adds to latency. These bursts are seen as a spike over normal traffic when viewed on a
graph. They are usually less than one millisecond long (or even shorter), and they typically occur during high
traffic volume, such as after a major news event or announcement when many people are using the network
simultaneously.
Note: Microbursts occur in every network, but are also very environment-specific. What may be a microburst
for one company may be considered acceptable traffic for another. Given that many applications have error
checking and retransmission algorithms, and that microbursts are so short that connectivity for most applications
is not affected, microbursts are not a concern for many network engineers. However, some applications are
more sensitive to microbursts, such as financial, audio, video, or multicast applications. The financial industry is
especially keen about microbursts and reducing the effect of microbursts on their network. This section is written
with a network administrator for a financial company as the primary audience, but any network administrator
interested in microbursts should find the information useful.
You might have microburst issues if your latency is creeping into the tens of milliseconds (or doubling your
previous baseline). Your brokers may know something is awry because revenue is dropping. Revenue is
dropping because your broker's trades are executed just behind others beating them to the market, thereby
getting a better price and more revenue. All of this will occur and neither your brokers nor you may even be
aware the microbursts are occurring.
Almost half of all trades executed globally are initiated and completed by computers, not humans. Since
computers are reacting to price fluctuations, when a microburst occurs, packets may be dropped, which causes
them to be retransmitted and that takes several milliseconds—nearly doubling the time to complete the
transaction. A 1-millisecond advantage in trading applications can be worth $100 million a year to a major
1
brokerage firm.
To prevent data loss because of microbursts, design your network so that its capacity can withstand the highest
possible burst of activity in whatever a time frame you deem important (perhaps millisecond). Adding additional
switches or load-balancers to your network are a couple of possible solutions. This way the link will never be
1)
Information Week, April 21, 2007.
52 | GigaStor™ (pub. 25.Apr.2014)

Chapter 9: Microbursts