[c-nsp] Understanding Out/Input bytes in Interface Counters on 2811

[Peter Subnovic]

Thanks Chuck, Bruce and James for your replys,

I did clear the counters 6 weeks ago (near the beginning of march) while i
was troubleshooting another issue .

The router was not rebooted for 15 weeks.

Thanks for the hint that the counters are (most probably) 32-bit counters,
although the 3 Billion bytes reported as output should fit in the counter.

Guess i'll have to live with it and need to implement a better approach to
track this stuff.

Cheers,
Peter


On Thu, Apr 19, 2012 at 7:05 PM, Chuck Church <chuckchurch at gmail.com> wrote:

> Could be a bunch of reasons.  Were the counters cleared at the time when
> the
> provider's time of measure started?  Did the router reboot or were the
> counters cleared since?  These counters are either a 32 or 64 bit counter.
> They do occasionally wrap and start over at 0, pretty frequent on 32 bit
> counters.
>
> Chuck
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Subnovic
> Sent: Thursday, April 19, 2012 12:43 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Understanding Out/Input bytes in Interface Counters on
> 2811
>
> Dear List,
>
> i am having an Cisco 2811 with IOS (C2800NM-ADVENTERPRISEK9-M), Version
> 12.4(24)T
>
> Our Provider told us that we had a traffic volume of 300GB last month, but
> the interface counters do not reflect these values:
>
> I am curios, if the reported volume should be reflected in the out/input
> bytes
>
> When i am looking on the counters of the interface which is connected to
> the
> Provider Router, the following values are shown:
>
> 1089368953 packets input, 744025984 bytes
>
> 970733443 packets output, 3196131116 bytes
>
> I searched the Open/Resolved Caveats document, but couldnt find anything
> related.
>
> http://www.cisco.com/en/US/docs/ios/12_4t/release/notes/124TCAVS.pdf
>
> So my question is:
>
> Shouldn't they be at least somewhat near the reported volume? or am i
> missing something (maybe very basic) here? or are the counters just broken?
>
> Unfortunately, i do not have any other possibility to verify the volume (i
> know this is bad and will be changed).
>
> Any pointers to documents or something else is highly appreciated.
>
> Thanks for your time.
>
> Kind regards,
> Peter
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>