octet ?? 1

[astin]

Hi
Ive been asked to graph network traffic from a particular machine using hp ov 6.1
A bit of a hassle, but it now works - im using the ifinoctet and ifoutoctet snmp mibs.
Can someone please confirm that im monitoring the correct parameters. I just need to monitor the amount of traffic going through to (and from) this PC

thanks
A

 

[nfaber]

astin,

What are you trying to get, are you talking about % Utilization?

 

[astin]

hello

yes I am trying to get a reading of how much bandwidth a particular box needs.

A

 

[nfaber]

astin,

My firdt answer to how much bandwidth a box needs is all it can get ;-). But seriously, if you want to get the badwidth you are talkin Octets, so to get bytes multiply by 16. The formula for % Utilization is:

%Utilization = ifinbytes + ifoutbytes / ifspeed X 100

It also depends on if you are using half or full duplex on the NIC. If you are using full, the formula stands, half multiply by 2.

 

[astin]

thanks

but i note at one stage i have 17000 outbound octets and 4000 inbound ones.,

(17000x16)+(4000x16) /100 x 100 ? is this right ?
the box is running 100mb at full duplex
please forgive if i have misunderstood the formula...
Astin
p.s. on the graph it says ifINOctets.20 (*0.004) and ifOutOctets.20 (*.0.004)

 

[anjida]

Can you explain why do we have to multiply ifinoctet/ifoutoctet by 16?

 

[DavidHalko]

> It also depends on if you are using half or full duplex on the NIC...

Let's help out here...
Serial Links (Frame Relay, Point-to-Point, ATM, etc.)
- These are usually Full Duplex
LAN Links (1 MBit, 10 MBit)
- These are usually Half Duplex
LAN Links (100 MBit, 1 GBit, 10 GBig)
- These are usually Full Duplex

The interface speed is not guaranteed by what the MIB will report, by the way. The MIB is only correct if the device has been configured correctly. (LAN devices are pretty safe.)

Also, the speed at which the interface goes and which MIB you poll will also determine what your polling interval needs to be, so that you do not get trash as your collected values.

One is usually better calculating utilization on a particular direction at a time, instead of both directions simultaneously, since most modern LAN's and WAN's are all full duplex.

Since Full Duplex is the most common on LAN devices today, then you may be seeing bottlenecks only on input traffic to a device (backup storage unit) or on output traffic from a device (web server, database server, etc.)

Keep in mind,
1 ifSpeed is measured in BITS
2 ifInOctets is measured in Octets (8 bits)
3 ifOutOctets is measured in Octets (8 bits)
4 a conversion to all bits or all octets is required

My example below will perform a calculation in all bits
%_In_Utiliz = (ifInOctets*8*100) / (ifSpeed)
%_Out_Utiliz = (ifInOctets*8*100) / (ifSpeed)

If you are measuring utilization on a 100 MBit LAN,
your polling interval will need to be fairly fast.
The standard MIB II Interface Table uses all 32 bit
counters. One needs to poll at a minimum of 2x the
turn over rate of the counter... assuming the counter
is not a signed counter (I have seen this bug in HP
OpenView NNM before, and it rears is ugly head every
so often in the normal release code.)

On a 100 MBit LAN, if you are coming close to full
utilization, you better be polling every 2 minutes
for data. Don't even think you will get good data on
a heavily loaded server if polling on hourly intervals.

A 32 bit counter can hold this many total octets:
(2^32)
and this many bits
(2^32)*8
and this many MegaBits
((2^32)*8)/1000000
a 100 MBit Full Duplex Ethernet 32 bit counter will hold this many bits
(((2^32)*8)/1000000)/100

We want to figure out how often we need to poll in order to get a good reading before the unsigned 32 bit counter flips over. The speeds in MegaBits are actually MegaBits per Second.
343=(((2^32)*8)/1000000)/100
In 343 seconds, this counter will flip over.

To determine flip time in minutes:
5.71=343/60

This counter will flip in 5.71 minutes under a full load.

To calculate a heavily loaded server 100mbit capable server (100% utiliz) with HP OpenView, and using the MIB2 ifInOctet/ifOutOctet counters,
one MUST poll at intervals of 2 minutes to accurately
graph the data.

On a medium loaded server 100mbit capable server (50% utiliz), you can probably get by with 5 minute polling interval.

On a lightly loaded 100mbit capable server (25% utiliz), you can probably get by with a 10 minute polling interval.

(Hope you purchased a UNIX box for your HP OpenView NNM
server with a LOT of hard drive space if you have a lot
of heavily LAN devices to manage. The NT version of NNM has an SNMP polling engine capable of handling 3 outstanding packets while the UNIX version will handle 20 outstanding packets by default.)

If you have any heavily loaded Apple Macintosh's with GBit LAN NIC cards, you will need to poll the MIB 2 Interface Extended Table, which uses high-resolution (64 bit) counters. EMS Architect

 

[vlan52]

Hi there Astin, first, if you want to monitor and report a single pc or host, just make sure to graph the "traffic" metrics of the port of the switch which the host is connected to.

Or, perhaps through SNMP retrieve the values from the OS you are running in the host/PC, but I'd go for monitoring / reporting from the switch port.

Try to generate the reports using "bits per secons" units, bps instead of octets or packets, since any bandwith value is expresed always in bits per second, octets or packets do not belong to network perfomance/traffic measurements...

Actually it is a best-practice for network monitoring / reporting!

Hope this helps,
vlan52
vlan52
The end of wisdom is freedom. The end of culture is perfection. The end of
education is character. The end of knowledge is love.