1

I am using SNMP in Ubuntu 20.04 to get the network usage info and I am using this formula to calculate the network usage:

InOctets : The difference between two poll cycles of collecting the snmp which represents the count of inbound octets of traffic.

networkUsage = (InOctets x 8 x 100) / ((number of seconds between octets) x speed)

Here is the reference that I found the formula

What is the problem? I sometimes get over %100000 network usage and I could not found an alternative formula for calculation. Is the formula wrong or is there something else that could make the problem?

I am getting the network info from a virtual server (Ubuntu 20.04) which includes the latest SNMP installation. The server has also two ethernet cards, so it has two networks and I am using bond0 to represent them with a single IP address. I am reading SNMP values of the server from a remote computer which is a member of the LAN.

TarabydaVllasıCafcaflıAtArabsı
  • 13
  • 2
  • Which is the speed of interfaces? – J.M. Robles Mar 29 '21 at 17:28
  • @J.M.Robles what do you mean with speed of interfaces? Firstly I am getting all interfaces and after then I am getting their speed with ".1.3.6.1.2.1.2.2.1.5.", afther then I am calculating their usages with the formula above. – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 05:06
  • Yes, I think I understand your scenario. Anyway, let me insist. Please, which is the speed of interfaces? – J.M. Robles Mar 30 '21 at 05:22
  • @J.M.Robles 1Gbit (1.0E9) – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 05:27
  • OK. In http://www.net-snmp.org/docs/mibs/interfaces.html you can see for IfSpeed "If the bandwidth of the interface is greater than the maximum value reportable by this object then this object should report its maximum value (4,294,967,295) and ifHighSpeed must be used to report the interace's speed. For a sub-layer which has no concept of bandwidth, this object should be zero". 1 Gbps < 4 Gbps, so, this could not affect. Anyway I suggest tray ifHighSpeed – J.M. Robles Mar 30 '21 at 05:32
  • @J.M.Robles Sometimes I get the speed as zero(0.0), sometimes I get lower than 1Gbit, (10Mbit 1.0E7 or 100MBit 1.0E8) and these causes the wrong calculation. Should I accept the speed always as 1Gbit and use this at the formula? – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 05:35
  • Yes, If I were you, I would use a constant for the nominal speed – J.M. Robles Mar 30 '21 at 05:36
  • @J.M.Robles there is also an another problem. When I calculate the octets as it is talked at the formula's reference, I get different size of packets. Let me call the octests before and next octet. When I check the packetReceived and packetSend sizes they are as big as with ..E9, for example 4.1243E9, but sometimes one of them comes low like 21234.0. These situations affect the calculation of network usage. What is best to do? Are these situations bugs of SNMP? For example I calculate the InOctets like: inOctets = nextOctet.getPacketReceived() - beforeOctet.getPacketReceived() – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 05:43
  • @J.M.Robles but when I see that when the nextOctet.getPacketReceived() is 4.12314512E9, the beforeOctet.getPacketReceived() is 2334.0. This also causes that the result of the formula comes as %3000+.. What should I do for this situation? – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 05:45
  • In 32 bits arithmetic 4e9 is the maximum value. In this case you should use 64 bits counters as ifHCInOctets (https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html) – J.M. Robles Mar 30 '21 at 05:56
  • @J.M.Robles but the matter is not getting 4e9, the matter is getting a low value as 2334.0, this is the source of the problem – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 06:01
  • When the quantity reachs maximum (4e9) it starts at 0 again. So, 2334 is 4*2^30 + 2334 – J.M. Robles Mar 30 '21 at 06:02
  • Summng it up. You cannot use 32 bits counters if your polling time is enough to have counters that contain values greater than 4e9. – J.M. Robles Mar 30 '21 at 06:04
  • @J.M.Robles It can be a bit silly but how can I check that the value must be summed with 4e9. Is there a way to check that correctly? – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 06:10
  • As you can see in the cisco link (https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html) , 32-bit counters can be filled in 35 s in interfaces 1 GBps. Of course, not ever, but definitely is a posssibility. Your experience suggests that you should make use of 64-bit counters. If you do not want to, you should find a way to find out if the counter has overflown. – J.M. Robles Mar 30 '21 at 06:27
  • @J.M.Robles thank you so much. It helped me a lot. – TarabydaVllasıCafcaflıAtArabsı Mar 30 '21 at 07:24
  • You are welcome. Best regards from Madrid – J.M. Robles Mar 30 '21 at 07:30

0 Answers0