Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Polling interface traffic


I have a couple of questions regarding performance measurements of

interfaces on Cisco 7600 router (and other models) and that is the

reason for lengthy message:).

Following OID-s can be used for measurements of inbound traffic (there

are equivalent OID-s for outbound traffic):

1. 32bit counter for number of octets: IF-MIB::ifInOctets.L2

2. 64bit counter for number of octets: IF-MIB::ifHCInOctets.L2

3. 32bit integer for 5min EMA:


4. 32bit counter for number of octets: IF-MIB::ifInOctets.L3

5. 64bit counter for number of octets: IF-MIB::ifHCInOctets.L3

6. 32bit integer for 5min EMA:


7. 32bit counter for number of IP octets:


L2 and L3 represent ifindex numbers of Layer 2 and Layer 3 interfaces.

Layer 3 interface is VLAN interface (for example Vlan10), and Layer 2

is GigabitEthernet interface:

interface GigabitEthernet1/10

description test

load-interval 30


switchport access vlan 10

Both interfaces have load-interval set to 30 seconds, but I think this

doesn't have any influence on SNMP polling.

According to OLD-CISCO-INTERFACES-MIB locIfipInOctets represents "five

minute exponentially-decayed moving average of input bits per second".

I have done tests of polling with very short interval (100 ms) just to

check how often are these counters updated. From my results, they are

updated every 10 seconds, so polling faster than that doesn't makes

sense. Although ifInOctets and locIfipInOctets for Layer 3 interface

have small drift, they change few hundred octets with every reading,

but every 10 seconds they have normal update as other counters.

And now come questions:).

Counters #1 and #2 are very consistent (not even one octet of

difference), while counter #3 gives slightly different readings. Since

it is MA this makes sense. I'm not sure if it is still 5 minute

average, regardless of load-interval setting. Is this counter always

calculated on 5 minute interval or it depends on load-interval?

Counters #4 and #5 are not consistent with #1 and #2, I guess they

don't count L2 overhead, and there is also small difference between

themselves. Difference between Layer 2 and Layer 3 counters is around

5%, which is consistent with Ethernet overhead for packets with size

around 400-500 bytes.

They are also updated on different time points, #1 and #2 are always

updated in same 100 ms point, but #4 and #5 lag or lead few hundred ms

after or before them and they are not updated simultaneously.

What I don't know is why are they not updated on same time points as

Layer 2 counters. Does every interface has it's own internal timer?

Why is there a difference between readings for 32bit and 64bit

counters for same Layer 3 interface? Do they also have different


Counter #7 is updated at same times as counter #4 but with very slight

differences. Counter #7 gives on average around 7 octets less when

compared to counter #4. What is cause of these differences and why do

these two counters have slight drift (see above)?

And finally #6 is updated at his own time points (but every 10

seconds) and again gives different readings from counter #3. This

equals with Layer 2 overhead.

Thanks for any answers and if anybody has other information regarding

these measurements, please share them.

New Member

Re: Polling interface traffic

For interfaces that operate at 20,000,000 (20 million) bits per second or less, you must use 32-bit byte and packet counters. For interfaces that operate faster than 20 million bits per second, and slower than 650,000,000 bits per second, you must use 32-bit packet counters and 64-bit octet counters.Refer URL