I have a server connected to Cisco WS-C3560G-24TS switch GigE port. I need to check if the server creates few seconds >500Mbps traffic bursts. The server is not under my management.

At first, I made a simple script which stores the interface ingress bytes into a variable (bps1), sleeps one second, stores the ingress bytes into another variable (bps2), calculates the amount of bits received, stores it in variable named delta, and prints a log message if delta is larger than 500Mbps:

while :; do
  for i in {1..2}; do
    declare bps"$i"=$(snmpwalk -Ov -v 2c -c public switch ifHCInOctets.10101 | sed 's/^.* //');
    sleep 1;
  delta=$(( (bps2 - bps1)*8 ));
  echo "$bps1" "$bps2" "$delta";
  (( delta > 500000000 )) && printf '%s\n' "$(date -u "+%d.%m.%y %H:%M:%S") UTC ingress traffic from customer was "$delta" bps";
done | tee -a bps.log

The echo "$bps1" "$bps2" "$delta"; line above is just for troubleshooting purposes. Cisco IOS updates the ifHCInOctets counter with 1ts interval.

However, as one while loop takes longer to complete than exactly one second, then occasionally the script reports bps of two intervals. For example:

155268562689729 155268611695817 392048704
155268714010296 155268764441853 403452456
155268862787657 155268910277237 379916640
155269008492724 155269103039983 756378072
14.05.15 14:59:19 UTC ingress traffic from customer was 756378072
155269148645940 155269195558201 375298088
155269295068336 155269395399778 802651536
14.05.15 14:59:26 UTC ingress traffic from customer was 802651536
155269492138530 155269538915854 374218592
155269631823265 155269679591240 382143800

I guess such a method works only for longer polling periods? What are the other possibilities to detect short traffic bursts? Policer with counters in switch/router? Some other clever method?

  • 1
    Do you have a server that can monitor netflow?
    – HAL
    Jan 11, 2016 at 17:05
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10, 2017 at 2:45

3 Answers 3


Depending on how accurate you want all this to be, and assuming you want to stay with the SNMP polling approach, you might want to recalculate the bps value yourself, by taking the system timestamp each time you poll, and the calculating the resulting average bandwidth use between two timestamps :

BW = (InOctets2 - InOctets1) / (timestamp2 - timestamp1)

It's not entirely accurate because the timestamp is taken on your machine rather than on the switch at the point when it calculates InOctets, but at least you'll remove the implicit dependency on the while loop's duration.


Cisco IOS Embedded Event Manager (EEM) might be of help to you. Seems like a traffic policer, for example, could detect the burst event you describe and the EEM could then email you?


Do you have the option to collect NetFlow from this device? NetFlow timestamping is accurate so you will be able to pickup the spikes with ease using any number of flow collectors/analyzers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.