Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to come up with an explanation for why there is a difference between the traffic reported by a router and the traffic reported by the switch connected to that router.

I have a T1 (1.5mbps ppp) going to an AdTran 3305 router. The AdTran connects to a 3Com SuperStack switch. I am using 'Whats Up Gold' to view the SNMP interface utilization for the ethernet port in the 3Com switch. I am telnet in to the AdTran and using 'show interfaces' to view the '5 minute' average for the T1/PPP port (and eth1 port which is the same number).

At night when no one is in the building, from a machine connected to the SuperStack I can get full T1 speed reported through SNMP/WhatsUpGold.

However, during the day when everyone is in, the SNMP traffic through the switch will only display 200k-400k (or less), yet the AdTran router is showing an average 5 minute of 1.4m+!

My first thought was maybe something else is plugged in to the AdTran (like a voip phone system - vcx unit), but the telnet interface shows nothing connected to the other ethernet port or T1 port on the AdTran.

Could the SNMP interface utilization be reporting only certain kinds of traffic? For example, maybe it does not report VOIP type traffic?

Any other thoughts/suggestions?

share|improve this question

2 Answers 2

Did you set up the SNMP using SNMPWaLk or manually ? You might simply be getting the wrong stats off the device.

Here's an MRTG snippet for reference:

SnmpWalk: It may be that you want to monitor an snmp object that is only reachable by 'walking'. You can get mrtg to walk by prepending the OID with the string WaLK or if you want a particular entry from the table returned by the walk you can use WaLKx where x is a number starting from 0 (!).

share|improve this answer
    
Also - if the switch port that you are on is not promiscuous or is vlan'd out, you might not be seeing all of the traffic on the switch –  tsykoduk Mar 31 '11 at 15:50
    
the switch has an snmp configuration screen, basically there is an option to enable/disable and I left everything default. In WhatsUpGold, I give the IP of the switch and it recognizes that the switch has snmp and reads all the ethernet ports, etc. I tell whatsupgold to view the port the router is connected to - interface utilization and I see traffic charted. It appears to be accurate SOMETIMES - for example right now. I might try setting up a sniffer to see whats happening that way. –  Scott Szretter Apr 1 '11 at 12:03
up vote 0 down vote accepted

I think I know what MAY be happening - it looks like a possible issue with WhatsUpGold - when watching the real time traffic (a web based interface), if I totally refresh the page, the traffic shows higher numbers - T1 type speeds instead of the low 300k or less speeds. So it seems like something is going flakey with the graph and refreshing fixes it. I will mark this as the answer if that turns out to be the issue.

Also, the other thing that can be confusing is the graph can 'focus' on incoming or outgoing and I have seen the graph load up set as for example outgoing when I want to see it as incoming - which usually it loads that way by default.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.