5

First, do 'Octets' in ifInOctets and ifOutOctets actually refer to packets? Can someone explain in detail? Also, if I want to measure the traffic flowing between certain set of nodes, how do I achieve it using SNMP? I saw a few links leading to MIB II and RMON. Is there some other way too? Can I measure the traffic delay, number of dropped packets, bandwidth of the network, load balancing parameters and related parameters using SNMP MIBs?

2

1 Answer 1

6

First, do 'Octets' in ifInOctets and ifOutOctets actually refer to packets? Can someone explain in detail?

ifInOctets and ifOutOctets refer to bytes received and transmitted (respectively) by the interfaces indexed to ifIndex / ifName; ifInOctets and ifOutOctets use 32 bit wide values.

Unless you're polling interfaces at 100Mbps or lower, I'd strongly recommending using ifHCInOctets and ifHCOutOctets, which are 64-bit values. The difference is important... for instance a 1GE interface at full TX rate will wrap the 32-bit ifOutOctets counters in 34 seconds; that's faster than most people will poll them.

  • 32 bit counters @ 10Mbps wrap in 57 minutes
  • 32 bit counters @ 100Mbps wrap in 5 minutes, 42 seconds
  • 32 bit counters @ 1000Mbps wrap in 34 seconds

If you want to count packets, use ifHCInUcastPkts and ifHCOutUcastPkts. HC means they are 64-bits wide... not all SNMP objects need this much space, but high-speed interfaces do.

Also, if I want to measure the traffic flowing between certain set of nodes, how do I achieve it using SNMP? I saw a few links leading to MIB II and RMON. Is there some other way too? Can I measure the traffic delay, number of dropped packets, bandwidth of the network, load balancing parameters and related parameters using SNMP MIBs?

You can't measure traffic between two servers with SNMP unless there is nothing else transmitting to the same servers (i.e. very unlikely). The best options for measuring between endpoints are:

Delay / average packet loss over time is best measured from the hosts with mtr or winmtr. It's pretty hard to measure exact packet loss for individual streams unless you post-process files from wireshark with a script (and you'll have to code that by hand).

When you ask about load-balancing parameters, I'm not sure what you mean.

Passive available bandwidth measurement can be done with yaz. Active measurement isn't a likely use-case given your requests, but use iperf2, or iperf3 for that. As of a year ago when I last tried it, iperf3 was still a bit rough around the edges in my experience... I still like iperf2, but if I don't mention it someone will complain.

4
  • Those SNMP Oids mentioned above worked! And I tried solar winds trial version to find the bandwidth consumption and network top users. Using mrtg, I can plot graphs and do some inference/report genereation. Any idea how I can infer suspicious activities from those graphs/data? Mar 13, 2014 at 2:43
  • I'm afraid the definition of suspicious activities is far too localized for me to answer. Mar 13, 2014 at 2:48
  • On what basis do network administrators deduce that there might have been an intrusion that took place at a specific interface during a certain interval of time? Say for example, there is a self-replicating worm in the network that causes the traffic at few interfaces to reach the peak! Or some intruder trying to bombard the network with packets (an usual activity) . How can these traces be found out? Mar 13, 2014 at 3:16
  • I polled the ifOperStatus and found that few interfaces on a switch were down. And next when I polled the ifHCInUcastPkts/ ifHCOutUcastPkts on the same switch, I found there were packets received or transmitted by those interfaces that were down! How can this be viable? Mar 13, 2014 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.