SNMP Interface In/Out Counters

[rob.johnson]

I'm trying to get a total data transmitted throughout our WAN using SNMP to poll the ifInOctets and ifOutOctets. We've written a script to do this but the results are semingly erratic ie. We poll once at the 'zero' point to get a baseline and then poll every 12 hours and use the difference. The trouble is that the amount are sometimes LESS than the baseline figure. I've checked on the routers to see if the counters had been reset but they hadn't.

The only thing I could think of was that the counters zero themselves when they hit a certain point, can anyone confrim this? If so, at what point do they zero, as you can imagine this is a bit of a disability when you're trying to do what I'm doing...

Cheers

[mbasinsk]

SNMP counters are 32 bit unsigned interger values (0 to 4.2 billion a.k.a 2**32 - 1).

They work like the odometer on your car: when they get to the limit, they roll over to zero again. so if you monitor continuously, you have to do 2 things

1) poll often enough to be sure that the counter cannot roll over TWICE

2) if you poll and get a number that is lower, then you know the counter rolled over, so you can

take that into account when computing the delta value

in general, 12 hours is probably way too long a polling interval, even for slow links. Most folks who

do network traffic monitoring poll every 15 minutes (unless you have really fast/high-bandwidth links, in which case you may need to poll more frequently or use the newer 64-bit counters if

those are available on the device you are monitoring). A T-1 counter (if running at full speed) will

wrap in something like 6 hours, if I recall (too lazy to do the math myself at the moment -you

can compute that if you are interested).

[jegrimm]

Yes they can reset (wrap around) and that depends on the counter type of the device you are using. You will need to check but I think it is a 32-bit Integer counter...You might want to build in your script to account for when the number gets extremely large to expect a wrap around and let it go at that point. There is also a ifXEntry object (without checking) that specifies a "clear counter" affect.

If you get even fancier try to account for sysUptime.