[nsp] Counting bps...

[Iva Cabric]

On Mon, Mar 17, 2003 at 12:11:07PM +0100, Gert Doering wrote:
> We do not use the "5 minute ... rate" values for accounting anymore, as
> they are just to unreliable (the "show int" and SNMP values for the same
> interface manage to differ up to 30% - how do they do that???).  We get
> the byte count values, and calculate the average values ourselves.
> 
> There are other bugs in the byte counters (counters going backwards,
> counters getting "stuck" and only counting non-IP traffic) but Cisco seems
> to finally get the hang on those - recent 12.0 and 12.1 mainline IOSes
> seem to have fixed that, and even 12.0S seems to get there ("show int"
> counters don't get stuck anymore, but for a change the SNMP counters do).

Regarding bps statistics, there are several ways of collecting
statistics (via SNMP):

- standard In and Out Octets (32bits), which are usually used

 IF-MIB::ifInOctets.XXX
 IF-MIB::ifOutOctets.XXX

- same as above, but with extended range (64bits)

 IF-MIB::ifHCInOctets.XXX
 IF-MIB::ifHCOutOctets.XXX

- bps calculated by router on load-interval (these should correspond
  with "show interface" statistics)

 OLD-CISCO-INTERFACES-MIB::locIfInBitsSec.XXX
 OLD-CISCO-INTERFACES-MIB::locIfOutBitsSec.XXX

- IP Octets without L2 overhead

 OLD-CISCO-INTERFACES-MIB::locIfipInOctets.XXX
 OLD-CISCO-INTERFACES-MIB::locIfipOutOctets.XXX

(also there are equivalent counters for number of packets:
 IF-MIB::ifInUcastPkts.XXX
 IF-MIB::ifInNUcastPkts.XXX
 IF-MIB::ifOutUcastPkts.XXX
 IF-MIB::ifOutNUcastPkts.XXX
 IF-MIB::ifHCInUcastPkts.XXX
 IF-MIB::ifHCOutUcastPkts.XXX
 OLD-CISCO-INTERFACES-MIB::locIfInPktsSec.XXX
 OLD-CISCO-INTERFACES-MIB::locIfOutPktsSec.XXX
 OLD-CISCO-INTERFACES-MIB::locIfipInPkts.XXX
 OLD-CISCO-INTERFACES-MIB::locIfipOutPkts.XXX
)

I have done some measurements, with above counters (load-interval was
set to 30 seconds, values were collected every 60 seconds), and results
were almost identical. Differences between different counter type were
less then 0.3% (sums of all bps values collected in 20 hours).

I suppose that smaller differences were caused by different time points
when statistics are actually updated by router itself (I dont think that
ifInOctets is updated for every byte or every packet and locIfInBitsSec
is updated only on load-interval).

Does anyone have other (or more) experience with bps statistics gathering
and would like to share information about it and ways of doing it?