How to Monitor Vlan Traffic?

Question

We have migrated to a new ISP who provide us several services (Internet+VoIP+VoD) and have divided each service in one vlan 100,101,102 respectively. Now I'm looking for a solution to monitor each service and measure the bandwidth on each vlan. I know we don't have counters on L3 SVI interface. I though the port-channel sub-interface have counters operational but don't.

We receive on 4500-X the 3 vlans/services and trunk them to vlan 604 to CMTS. The vlan 260 is for IPTV Multicast.

In summary, I use cacti to monitor bandwidth on interface and I need a similar way to do it on vlans.

Maybe Netflow can solve the problem but before invest on it I would like yours considerations to found a simpler solution as Cacti.

Here the topology

============4500-X==================
!----------ingress - From ISP-----------------
sw-4500-X#sh run int te1/1/15 
Building configuration...

Current configuration : 171 bytes
!
interface TenGigabitEthernet1/1/15
 description Po from ISP 
 switchport trunk allowed vlan 100-102
 switchport mode trunk
 channel-group 5 mode active
end

sw-4500-X#sh run int te2/1/15
Building configuration...

Current configuration : 171 bytes
!
interface TenGigabitEthernet2/1/15
 description Po from ISP 
 switchport trunk allowed vlan 100-102
 switchport mode trunk
 channel-group 5 mode active
end

!----------egress port to CMTS------------------
sw-4500-X#sh run int te1/1/1
Building configuration...

Current configuration : 192 bytes
!
interface TenGigabitEthernet1/1/1
 description link Po1 -> CMTS (te2/0/0)
 switchport trunk allowed vlan 260,706
 switchport mode trunk
 load-interval 30
 channel-group 1 mode on
end

sw-4500-X#sh run int te2/1/1
Building configuration...

Current configuration : 192 bytes
!
interface TenGigabitEthernet2/1/1
 description link Po1 -> CMTS (te1/0/0)
 switchport trunk allowed vlan 260,706
 switchport mode trunk
 load-interval 30
 channel-group 1 mode on
end

EDIT :

Here the output of snmpwalk

[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x> IF-MIB::ifName
....
IF-MIB::ifName.168 = STRING: VLAN-100  
IF-MIB::ifName.169 = STRING: VLAN-101   
IF-MIB::ifName.170 = STRING: Vl100  
IF-MIB::ifName.171 = STRING: VLAN-102  
IF-MIB::ifName.172 = STRING: Vl101  
IF-MIB::ifName.173 = STRING: Vl102  
...

[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x> IF-MIB::ifName.168
IF-MIB::    IFName.168 = STRING: VLAN-100
[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x>     IF-MIB::    IFHCInUcastPkts.168
IF-MIB::    IFHCInUcastPkts.168 = No Such Instance currently exists at this OID
[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x>     IF-MIB::    IFHCOutUcastPkts.168
IF-MIB::    IFHCOutUcastPkts.168 = No Such Instance currently exists at this OID
[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x>     IF-MIB::    IFHCInOctets.168
IF-MIB::    IFHCInOctets.168 = No Such Instance currently exists at this OID
[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x>     IF-MIB::    IFHCOutOctets.168
IF-MIB::    IFHCOutOctets.168 = No Such Instance currently exists at this OID

But if I try with .170 I get

[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x> IF-MIB:ifHCInUcastPkts.170
IF-MIB::ifHCInUcastPkts.170 = Counter64: 0
[root@unix ~]# snmpwalk -v 2c -c rw_community <IP-4500-x> IF-MIB:ifHCOutOctets.170
IF-MIB::ifHCOutOctets.170 = Counter64: 325414481

This get me another question : Why this difference in the same interface (VLAN-100 and Vl100) ??

My main question is still unanswered because the OID I get are for the packets and bytes counters on interface.

What I want to get is the Bandwidth measurement on some vlan. So far I only see Netflow as a probable solution.

EDIT2:

I'm trying to add on Cacti and I'm having some issue.

Graph showed when I add interface vlan100:

How to add such interface and made calculation to show right traffic graph ?? as suggested by Mike Pennington

Answer 1

Try adding the counter command under the SVI (see here for more information, specifically the "Understanding L3 interface counters" section).

For instance:

 Cisco#config t
 Cisco(config)#interface vlan 100
 Cisco(config-if)#counter ?
   ipv4  Enable IPv4 statistic counters
   ipv6  Enable IPv6 statistic counters
   <cr>
 Cisco(config-if)#counter
 Cisco(config-if)#end

Combined with Mike's excellent answers this will probably be what you want.

Answer 2

Poll ifHCInUcastPkts, ifHCOutUcastPkts, ifHCInOctets and ifHCOutOctets on Vlan100, Vlan101, and Vlan102. You can find the ifIndex of these SVIs by walking ifName

This get me another question : Why this difference in the same interface (VLAN-100 and Vl100) ??

• VLAN-100 is a virtual interface for the actual layer2 vlan; there is no IP address associated with it, and thus it can't have the counters you're trying to poll
• Vlan100 is the SVI, which is why you can get IP counters for it

My main question is still unanswered because the OID I get are for the packets and bytes counters on interface.

That's all SNMP will give you with respect to bandwidth; every SNMP monitoring station on the planet (such as cacti, Observium, or Graphite) derives interface bandwidth graphs from these same byte-counters (i.e. ifHCInOctets / ifHCOutOctets).

What I want to get is the Bandwidth measurement on some vlan. So far I only see Netflow as a probable solution.

You're welcome to use any tool you like. However, I'm not sure how simply switching to Netflow helps... NMS systems (regardless of whether they speak SNMP or Netflow) are complicated beasts...

Answer 3

Mike's answer is very valid and I would go with it if that is more suitable for you.

I am basing this answer based on two points on your question 1) You don't have a way of monitoring vlan traffic and you want to monitor them (three vlans - 100, 101 and 102) 2) You do have a way of monitoring interface traffic

I would like to propose using SPAN (Switched Port Analyzer) feature for this. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/span.html#wp1044290 Here is how it goes.

Scenario 1 You keep your span port destination in a different switch and you would like to collect traffic from different switches.

1) Make three new vlans - 200, 201 and 202. This will be used purely for SPAN purpose.

2) In whichever switch you would like to collect the traffic from, configure SPAN source as vlan (100 or 101 or 102) traffic and configure the SPAN destination as corresponding paired vlan (200, 201 or 202)

3) You have to create these vlans 200, 201 and 202 in all the switches from the source switch to the destination switch where your monitoring needs to be done

4) In the destination switch, dedicate three ports and configure them in corresponding vlans 200, 201, 202.

5) Configure RSPAN with source as vlans (200, 201 and 202) and configure the destination as those corresponding interfaces which you just configured.

6) Monitor those interfaces just like you would monitor any other interface with your tool.

Scenario 2 You want to monitor the traffic passing through only one switch (specifically your 4500 switch) In this case, it is much simpler. This solution is specific to 4500. http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc30

The above link tells you how you can monitor specific vlans on a trunk in a 4500.

Hope this was useful.