Page 1 of 1

check_iftraffic64.pl inconsistent data

PostPosted: Mon Sep 16, 2019 6:06 am
by bdario58
hello to all,
my environment:
Nagios Core 4.4.3 on CentOS 7
Pluging check_iftraffic64.pl ver. 77
object to monitor a switch HP5130

when I test the pluging I receive inconsistent data in 64 bit and 32 bit
I.E.
# ./check_iftraffic64.pl -C snmpstring -H 10.10.60.101 -i Ten-GigabitEthernet1/0/49 -d 4
DEBUG ENABLED at level: 4
INTERFACE DESCR: Ten-GigabitEthernet1/0/49
BYTE COUNTER max_value: 1.84467440737096e+19
[...]
RESULTS:
Operational Status: 1
Interface Speed (64bit): 1000 Mbits
Interface Speed (32bit): 1000000000 bits
In Bytes (64bit): 79593553925206 <----- why this difference compared to the 32 bits value?
In Bytes (32bit): 3514963030 <----------- why this difference compared to the 64 bits value?
Out Bytes (64bit): 4060085470804 <---- why this difference compared to the 32 bits value?
Out Bytes (32bit): 1341376084 <-------- why this difference compared to the 64 bits value?
[...]
Can someone teach me how to fix this issue?
Best regards
Dario

Re: check_iftraffic64.pl inconsistent data

PostPosted: Mon Sep 16, 2019 11:46 am
by scottwilkerson
Monitoring of network devices is often done using SNMP. SNMP has 32-bit and 64-bit counters.

The maximum value that can be held in a 32-bit counter is 4,294,967,295. As that is a byte count, that represents 34,359,738,368 bits or 34,359.74 megabits. Divide that by 300 (seconds in 5 minutes) and you get 114.5. Therefore if the average bandwidth is above 114.5Mbit/s for 5 minutes, you will overflow a 32-bit counter. When the counter overflows it wraps back through zero.

Wrapping a counter once is fine. We have to expect that a counter will wrap eventually, and as counters never decrease, if a new value is smaller than the previous one then we know it has wrapped and can still work out what the rate should be.

The problem comes when the counter wraps more than once. There is no way to tell how many times it has wrapped so the monitoring system will have to assume the answer is once. Once traffic reaches ~229Mbit/s the counters will be wrapping at least twice in 5 minutes and the statistics become meaningless.

https://strugglers.net/~andy/blog/2017/09/03/when-is-a-64-bit-counter-not-a-64-bit-counter/