[nsp] PPS Interface Counters

[Lawrence Wong]

Hi Ryan,

How about packets which are blocked during DoS/DDoS
attacks? Would this break the calculation as well?
Since you could see 10,000 pps on one interface that
doesn't go anywhere but is taken into account when
adding things up.

Does the OID which you mention earlier take into
account all packets that are forwarded (aka work done
by router) or is it also limited to normal & unicast?

Will check out cricket.

Thanks!

--- Ryan O'Connell <ryan at complicity.co.uk> wrote:
> Lawrence Wong wrote:
> 
> >Thanks for explaining how the pps is calculated. I
> >assume this is averaging out all the pps on all
> >interfaces to have a rough guage of the average pps
> >throughput?
> >  
> >
> 
> It's because each (normal, unicast) packet is
> accounted for in the "show 
> interface" statistics twice - once on it's way into
> the router and once 
> on it's way out. If you then sum up all the pps
> counters, every packet 
> is counted twice so you need to divide by two to get
> the right figure. 
> Obviously this breaks if a packet comes in but
> doesn't go out (Broadcast 
> not forwarded by the router or multi/unicast
> destined for the router 
> such as ping, OSPF etc) or is forwarded out multiple
> times (Multicast) 
> so it's not 100% accurate, but should be pretty
> close. (Certainly within 
> 5%, although bear in mind this is just a snapshot
> and peak pps doesn't 
> necessarily coincide with peak bandwidth so graphing
> over time is good 
> if you're using these figures for capacity planning)
> 
> >Speaking of MRTG, do you know of any OID for Cisco
> >which shows say maybe the 5 minute average pps ?
> >
> >I tried to view .1.3.6.1.2.1.4.6.0 and it shows an
> >ever increasing counter.
> >
> >IP-MIB::ipForwDatagrams.0 = Counter32: 3650827250
> >IP-MIB::ipForwDatagrams.0 = Counter32: 3650828792
> >  
> >
> 
> As far as I know, the only way to get the 5 minute
> averages without 
> polling the above every 300 seconds is via "show
> interface". If you put 
> the above in MRTG/Cricket as a counter - the same as
> interfaces - you'll 
> get the right 5min average out however.
> 
> Personally, I use Cricket with genRtrConfig (Google
> will find you a 
> copy) to get all this information both on a
> per-chassis and 
> per-interface basis.
> 
> -- 
>          Ryan O'Connell - CCIE #8174
> 
> I'm not losing my mind, no I'm not changing my
> lines,
> I'm just learning new things with the passage of
> time
> 
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com