I am trying to come up with an explanation for why there is a difference between the traffic reported by a router and the traffic reported by the switch connected to that router.
I have a T1 (1.5mbps ppp) going to an AdTran 3305 router. The AdTran connects to a 3Com SuperStack switch. I am using 'Whats Up Gold' to view the SNMP interface utilization for the ethernet port in the 3Com switch. I am telnet in to the AdTran and using 'show interfaces' to view the '5 minute' average for the T1/PPP port (and eth1 port which is the same number).
At night when no one is in the building, from a machine connected to the SuperStack I can get full T1 speed reported through SNMP/WhatsUpGold.
However, during the day when everyone is in, the SNMP traffic through the switch will only display 200k-400k (or less), yet the AdTran router is showing an average 5 minute of 1.4m+!
My first thought was maybe something else is plugged in to the AdTran (like a voip phone system - vcx unit), but the telnet interface shows nothing connected to the other ethernet port or T1 port on the AdTran.
Could the SNMP interface utilization be reporting only certain kinds of traffic? For example, maybe it does not report VOIP type traffic?
Any other thoughts/suggestions?