Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SNMP ifInOctets = 2145342796 - about 2GB.

ifconfig: RX bytes:174302710687 (174.3 GB)


Interestingly, the sent bytes agree almost perfectly:

ifOutOctets: 1002415050 - about 1GB

ifconfig: TX bytes:1002418728 (1.0 GB)


It's not an SNMP discontinuity:

snmpwalk -v2c -c public localhost 1.3.6.1.2.1.31.1.1.1.19    
iso.3.6.1.2.1.31.1.1.1.19.1 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.31.1.1.1.19.2 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.31.1.1.1.19.3 = Timeticks: (0) 0:00:00.00

Anyone have an idea for this discontinuity in the sent data numbers? Thanks so much!

(net-snmp, Ubuntu Linux, 12.04 LTS)

share|improve this question
5  
My first bet is that SNMP is using a 32-bit counter that has rolled over several times, where the kernel uses a 64-bit counter. 174302710687 % 2^32 = 2504018847, which isn't too far off what SNMP is reporting. Also SNMP may restart counters on ifup/ifdown events, or if the daemon is ever restarted, where the kernel counts don't - you can ifconfig an interface down, then back up and the counters just resume, unless you also unload the driver module as well... –  twalberg Nov 9 '12 at 15:02
    
@twalberg saw that myself any number of times over the years. –  Magellan Nov 10 '12 at 23:14
add comment

migrated from stackoverflow.com Nov 10 '12 at 8:34

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 8 down vote accepted

As twalberg suggests, this is probably a 32-bit overflow problem.

SNMP Interface Counters in are 32-bit (unsigned) by default. If your SNMP daemon and server OS support 64-bit counters they can be found in the ifXtable MIB (.1.3.6.1.2.1.31.1.1)

share|improve this answer
    
You were quicker than me. By the time I found the ifXtable reference you had already posted the same. –  Tonny Nov 10 '12 at 21:44
    
@Tonny my google-fu is strong today (snmp 64 bit interface counters turned up that Cisco MIB browser link as the #2 result :) –  voretaq7 Nov 10 '12 at 21:50
    
I left out "interface", which muddied the waters a bit. –  Tonny Nov 11 '12 at 10:23
    
I did not consider that! I knew I was overlooking something. Thanks. Incidentally, I noticed that my question had a -1 in front of it for a time - did I break some rule of some sort? Thanks! –  NightFalcon Nov 12 '12 at 13:45
    
@NightFalcon None that I'm aware of -- I think your question just got caught up in StackOverflow hate. For better or worse questions that come from Stack Overflow are treated more harshly than ones that originate on Server Fault because of the historical avalanche of bad migrations (of the 955 questions migrated here from SO in the last 90 days, over 40% were kicked back for being off topic, insufficiently detailed/unanswerable, etc. -- yours is one of the good ones though :) –  voretaq7 Nov 12 '12 at 16:31
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.