Interpreting show interfaces output / determining link usage

branfarm1 · ‎09-28-2007

What's the best way to interpret the show interfaces output, specifically the reliability, txload and rxload statistics.

In my situation I'm trying to get an accurate picture of link utilization but I keep getting very disparate results. I've noticed that on the web dashboard on one of my switches, a few of the ports are always showing 100% utilized on either tx or rx. When I look at the 'show interfaces' output I see the txload/rxload hovering in the low percentages, but occasionally spikes to 255/255 for a brief moment. My SNMP management tool never sees the traffic going over 4-8% of the link speed.

vijayasankar · ‎09-30-2007

Hi,

Any SNMP management tools, will have a periodic polling cycle to gather the statistics on the switch. For traffic related statistics, snmp uses a counter value to record the utilisation. The snmp tool will calculate the traffic statistics as follows.

X = Value gathered from the switch, during the previous polling.

Y = Value gathered from the switch for current polling

Z = Polling interval in Seconds.

Traffic Rate/second => (Y - X) / Z.

As you can see from the above formula, the snmp tool will provide only the average rate of the traffic statistics.

This might not give you an idea about the sudden traffic bursts from the snmp tool.

Occasional spikes are OK, if they are really due to any legitimate traffic from the attached devices on those switch ports.

If they are recurring frequently, you might have to examine what kind of traffic is flowing and investigate the details of devices connected on those switch ports.

Establishing a SPAN session for those ports and capturing the traffic using a ethernet packet capture tool ( like sniffer/ ethereal) will assist you to investigate those sudden traffic bursts and nodes which are creating such traffic.

Hope this helps

-VJ