5

SNMP ifInOctets = 2145342796 - about 2GB.

ifconfig: RX bytes:174302710687 (174.3 GB)


Interestingly, the sent bytes agree almost perfectly:

ifOutOctets: 1002415050 - about 1GB

ifconfig: TX bytes:1002418728 (1.0 GB)


It's not an SNMP discontinuity:

snmpwalk -v2c -c public localhost 1.3.6.1.2.1.31.1.1.1.19    
iso.3.6.1.2.1.31.1.1.1.19.1 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.31.1.1.1.19.2 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.31.1.1.1.19.3 = Timeticks: (0) 0:00:00.00

Anyone have an idea for this discontinuity in the sent data numbers? Thanks so much!

(net-snmp, Ubuntu Linux, 12.04 LTS)

2
  • 5
    My first bet is that SNMP is using a 32-bit counter that has rolled over several times, where the kernel uses a 64-bit counter. 174302710687 % 2^32 = 2504018847, which isn't too far off what SNMP is reporting. Also SNMP may restart counters on ifup/ifdown events, or if the daemon is ever restarted, where the kernel counts don't - you can ifconfig an interface down, then back up and the counters just resume, unless you also unload the driver module as well...
    – twalberg
    Nov 9, 2012 at 15:02
  • @twalberg saw that myself any number of times over the years.
    – Magellan
    Nov 10, 2012 at 23:14

1 Answer 1

8

As twalberg suggests, this is probably a 32-bit overflow problem.

SNMP Interface Counters in are 32-bit (unsigned) by default. If your SNMP daemon and server OS support 64-bit counters they can be found in the ifXtable MIB (.1.3.6.1.2.1.31.1.1)

5
  • You were quicker than me. By the time I found the ifXtable reference you had already posted the same.
    – Tonny
    Nov 10, 2012 at 21:44
  • @Tonny my google-fu is strong today (snmp 64 bit interface counters turned up that Cisco MIB browser link as the #2 result :)
    – voretaq7
    Nov 10, 2012 at 21:50
  • I left out "interface", which muddied the waters a bit.
    – Tonny
    Nov 11, 2012 at 10:23
  • I did not consider that! I knew I was overlooking something. Thanks. Incidentally, I noticed that my question had a -1 in front of it for a time - did I break some rule of some sort? Thanks! Nov 12, 2012 at 13:45
  • @NightFalcon None that I'm aware of -- I think your question just got caught up in StackOverflow hate. For better or worse questions that come from Stack Overflow are treated more harshly than ones that originate on Server Fault because of the historical avalanche of bad migrations (of the 955 questions migrated here from SO in the last 90 days, over 40% were kicked back for being off topic, insufficiently detailed/unanswerable, etc. -- yours is one of the good ones though :)
    – voretaq7
    Nov 12, 2012 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .