Does anyone know why the MRTG reports show peaks over what CISCO CAR allows?
==================================================================== I have started to make some notes on how to explain these peaks to my boss, but am stuck! MRGT reports. MRTG using SNMP and UDP which goes out to SNMP devices and polls the MIB database from the device. We are polling the interface ifcounters for the MRTG statistics. It does this every 5 minutes. The interface counters are always changing, based on the devices own MIB database collections. MIBS use: ASN.1 Syntax At any "one" instant the counters can show anything from 0 bps to the MAX bps of the interface. Interfaces transmit and receive data at the full wire/line speed. 100 Mbps sends and receives at 100 Mbps. 44 Mbps sends and receives at 44 Mbps. This is controlled by the clocking of the device/interface. So if you poll any interface counters at any one instance you can see anything from 0 to the MAX rate of that interface. Depending on the the SNMP device (switch/router) MIBs have collected locally from its MIBs. Rate-Limiting is done in software on the Cisco Router using something called CAR=commiited access rate. (remember the interfaces still transmit and receive at full wire speed) As data passes through each interface the rate limiting looks at it and it has to make decisions based on buffer space, rate-limit settings, bucket size, etc. to see what it needs to do with the traffic, as well as where to send it (route it). It will drop/dump packets if the rate-limiting determins it should. As you can see you have several things going on within the SNMP/MIB devices. How often does a device (MIB) poll statistics on its own interfaces to keep in memory? The MIB's which are based on standards which describe the timeframes for data collections and so do the vendors. MRTG does not know anything about CAR, it just gets MIB stats every 5 minutes from the MIB table of the device. MRTG looks at the total interface traffic counters, it knows nothing about packets that are dropped in software! MRTG reads the traffic counters every 5 minutes. It subtracts the accumulated traffic between these two points and divides by 300 minutes to yield bytes per second. The returned value is the average traffic over this 5 minute interval. > Mark Urbach > Dark Fiber Solutions > NOC Services > 600 1/2 Grant Ave. > York, NE 68467 > Office: 402-362-3334 > Cell: 402-366-2087 > [EMAIL PROTECTED] > > -- Unsubscribe mailto:[EMAIL PROTECTED] Archive http://www.ee.ethz.ch/~slist/mrtg FAQ http://faq.mrtg.org Homepage http://www.mrtg.org WebAdmin http://www.ee.ethz.ch/~slist/lsg2.cgi
