2

I have a Cisco 3560G switch. Are the interface counters reset automatically, recalculated in a specific interval (5 minutes?), or not at all?

I want to get (hourly, daily, monthly, etc) interface reports for the number of bytes passing through so I can charge a tenant a flat or proportional fee for the bandwidth they've used. I looked at my own interface and there's no way my int passed a paltry 5 GB ((inBytes+outBytes)/2^30) = ((3799659718+1574170392)/2^30). The counters are cleared at the first of the month (now = 2017-09-28 00:26); I regularly download ISOs and transfer many GB from the LAN file server.

Switch#sh int gx/y | i bytes
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     2661138970 packets input, 3799659718 bytes, 0 no buffer
     2963702247 packets output, 1574170392 bytes, 0 underruns

The above "packets input/output" lines are indented under the "5 minute output rate" line, so are the figures measured at 5 minute intervals?

Switch#sh int gx/y
...
  5 minute input rate 32000 bits/sec, 39 packets/sec
  5 minute output rate 39000 bits/sec, 44 packets/sec
     2661155241 packets input, 3801470626 bytes, 0 no buffer
     Received 232531495 broadcasts (0 multicast)
     0 runts, 8 giants, 0 throttles
     128 input errors, 50 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 7202264 multicast, 0 pause input
     0 input packets with dribble condition detected
     2963720601 packets output, 1576436851 bytes, 0 underruns
     0 output errors, 0 collisions, 7 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out
3
  • The packets input and output have nothing to do with the bandwidth. If you are charging for bandwidth, then look at the BW 1000000 Kbit, which tells you what the bandwidth of the link is. You can adjust the bandwidth allowed for a customer by using QoS to shape and police.
    – Ron Maupin
    Sep 28, 2017 at 4:53
  • "bandwidth" is probably the wrong term. "Throughput" is probably more accurate. I need to know how much data the tenant is transmitting. Can I believe the "packets input/output" lines in the output of show int gx/y? If I measure in 1m intervals I can get a very granular histogram together and invoice them like that.
    – user208145
    Sep 28, 2017 at 5:11
  • That would be data usage, and that is very different than bandwidth or throughput. You need to set up something like NetFlow to get what you want, You will not be able to pull that from the show interfaces command for any extended period of time.
    – Ron Maupin
    Sep 28, 2017 at 5:15

2 Answers 2

1

Based on your comments, you are looking for the data usage over different time periods. You will need to use something like NetFlow or some other method to generate your reports.

The show interfaces command uses the interface load-interval <seconds> command to configure its time period. It defaults to 300 seconds 5 minutes, and it can be set from 30 to 600 seconds.


Note:

Bandwidth is how any raw bits you can push across a link in a given time period, usually measured in bps (bits per second). Throughput is how much usable data you can push across a link (basically, the bandwidth minus the protocol overhead), usually measured in Bps (bytes per second).

2
  • So if I changed it to 600s, and captured readings and cleared the counters every 10 minutes to generate a nice histogram report, would that be an accurate means without going the netflow route?
    – user208145
    Sep 29, 2017 at 1:14
  • I would not count on it to back me up to charge someone. You need to think about what could hold up in court if there is a contract dispute. With a proper NetFlow configuration and collection, you can have the proper records, and feel absolutely confident that you are correct about what you are charging.
    – Ron Maupin
    Sep 29, 2017 at 2:04
2

Last clearing of "show interface" counters never

That line is a few above what you provided. Interface counters (in the UI) reset (1) at reload, (2) when explicitly cleared (clear counters), or (3) when they roll over -- with 64bit counters, that's unlikely. (#2 doesn't touch SNMP counters)

To properly do traffic accounting for billing purposes, you need something like netflow to report how many bytes have actually moved across the interface, and what they were. That will give you a great deal of detail and accountability. Just looking at an interface counter in the UI (and even SNMP) is not going to be enough justification for billing purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.