I'm trying to graph network usage on my router for a specific interface using data from SNMP. I know that ifInOctets/ifOutOctets is only 32 bit and will overflow for high speeds and make my graphs look dumb, but it looks like the differences in values returned by ifInOctets/ifOutOctets and ifHCInOctets/ifHCOutOctets aren't always identical. I've tested a few times by using snmpwalk | grep InOctets and subtracting the values. Sometimes I see that the change in the 32-bit counter is significantly less (more than 50%) than the change in the 64-bit version, and sometimes I see it go the other way with the 64-bit counter showing a smaller delta.

Am I missing something in the way that the 64-bit counters should be read, or is there just a difference in how their data gets updated? The 32-bit numbers match up with what's in /proc/net/dev, so I'm inclined to believe them more, but the wrapping issue makes them unusable when the speed gets too high:

dumb graphs with rollover

Here are a few examples, each snmpwalk was run about 10 seconds apart:

$ snmpwalk  -c public -v2c | grep -i InOctets.2
IF-MIB::ifInOctets.2 = Counter32: 2291487255
IF-MIB::ifHCInOctets.2 = Counter64: 2901400127083

$ snmpwalk  -c public -v2c | grep -i InOctets.2
IF-MIB::ifInOctets.2 = Counter32: 2297202283
IF-MIB::ifHCInOctets.2 = Counter64: 2901400298056

32-bit change: 5715028

64-bit change: 170973

$ snmpwalk  -c public -v2c | grep -i InOctets.2
IF-MIB::ifInOctets.2 = Counter32: 2297528566
IF-MIB::ifHCInOctets.2 = Counter64: 2901400453366

32-bit change: 326283

64-bit change: 155310

  • Which version of SNMP protocol are you using? SNMP V2C and V3 has 64 bit support. – Mircea Vutcovici Oct 20 '16 at 22:05
  • Currently using v2c – pettazz Oct 20 '16 at 22:08
  • What kind of router are you using? Is it Linux based? Which distribution is it running? – Mircea Vutcovici Oct 20 '16 at 22:10
  • 1
    May be you just hit a bug, like this one: sourceforge.net/p/net-snmp/bugs/2741 – drookie Oct 21 '16 at 3:58
  • 1
    With a gigabit interface running at full speed, the 32-bit counters can roll over in about 40 seconds, so I'm still suspicious that rollover might be biting you. Could you show us the problem? Show us the output from that snmpwalk|grep InOctets at two fairly-close times, so that we can see the difference between the changes in 32-bit and 64-bit stats? – MadHatter Oct 21 '16 at 6:05

I'd say you shouldn't run over whole tree of SNMP OIDs, it takes a significant amount of time. Could you try snmpbulkwalk -c public -v2c InOctets.2 and snmpbulkwalk -c public -v2c ifHCInOctets.2 instead? But anyway, that difference looks weird. Do you have other SNMP devices to compare with?

  • You could also use snmpget on both values at once to get an atomic view. – Simon Richter Mar 10 at 18:44

RFC 2233 adopted expanded 64-bit counters for high capacity interfaces in which 32-bit counters do not provide enough capacity and wrap too fast.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.