Packets bigger than 1522 bytes (as counted by Spirent Test Center) are being forwarded (bridged) but not counted in the following hardware counters on an Open Network Linux device:

  • ifHCInUcastPkts
  • ifHCInMcastPkts
  • ifHCInBcastPkts

I can't find anything in any of the following documents that excludes large frames from these counters in the following documents:

  • 802.3.1 - Management Information Base (MIB) Definitions for Ethernet
  • rfc-1643 - Definitions of Managed Objects for the Ethernet-like Interface Types
  • rfc-2233 - The Interfaces Group MIB using SMIv2
  • rfc-2863 - The Interfaces Group MIB

The following counters are incremented for these frames:

  • snmpDot1dTpPortInFrames
  • snmpEtherStatsOversizePkts
  • etherStatsPkts
  • snmpDot1dTpPortOutFrames

There are also some nonstandard counters capturing the above per direction, but none that separate bcast/ucast/mcast.

Am I missing something, or are the counters not working as we'd normally expect?

  • 1
    My experience suggests that behavior is different from traditional standalone routers & switches e.g. Cisco/Juniper. I agree with you, the counters are most likely incorrect. What happens with the IfHcInOctets counter; does that also ignore jumbos? Nov 23 '20 at 13:57
  • 1
    You say it is a Linux device, but that is off-topic here. What a host OS implementation does or does not do is off-topic here. You could try to ask on Super User, Unix & Linux, Server Fault, etc. that deal with host OSes.
    – Ron Maupin
    Dec 17 '20 at 17:35
  • 1
    No, it's an SNMP question. What do the standards mean? Furthermore, the OS software is not involved in any way. Not in any way. It was just my way of saying "a commercial grade whitebox device and I don't want to identify the specific implementation." Would the question have been relevant were it a Cisco router? Dec 17 '20 at 20:36
  • 1
    The question was about the standards. Dec 17 '20 at 20:41
  • 1
    802.3.1 rfc-1643 rfc-2233 rfc-2863 Dec 17 '20 at 20:45

Browse other questions tagged or ask your own question.