[c-nsp] Fun with interface counters.

[Jay Hennigan]

Drew Weaver wrote:
> I assume this is either a bug, or something else equally enjoyable.
> 
> Today, I noticed that one of our switches was acting up, so I logged into it and did the usual show interfaces, sh proc cpu sort, etc etc.
> 
> I noticed that the switch's uplink interface indicated that it was doing 700Mbps to the router it is connected to, the router indicated that it was only getting 200Mbps from the switch.
> 
> So either there is a counter bug, or the switch was sending traffic that was being dropped by the router or dropped later by the switch (after it was counted?), or something else equally amusing?
> 
> Does anyone have any thoughts on this/seen this before?

The default interval for updating the counters is five minutes.  If the 
traffic is bursty it isn't unusual for the interface counters to 
disagree, sometimes substantially.  I believe that the load interval 
timer starts on boot or when counters are cleared on the interface so 
don't expect them to line up with NTP.

For faster response and better granularity you can use the 
"load-interval [seconds]" interface-level command.  Minimum supported 
value is 30 seconds.

--
Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV