Discrepancy between router interface traffic and switch traffic?

Question

I am trying to come up with an explanation for why there is a difference between the traffic reported by a router and the traffic reported by the switch connected to that router.

I have a T1 (1.5mbps ppp) going to an AdTran 3305 router. The AdTran connects to a 3Com SuperStack switch. I am using 'Whats Up Gold' to view the SNMP interface utilization for the ethernet port in the 3Com switch. I am telnet in to the AdTran and using 'show interfaces' to view the '5 minute' average for the T1/PPP port (and eth1 port which is the same number).

At night when no one is in the building, from a machine connected to the SuperStack I can get full T1 speed reported through SNMP/WhatsUpGold.

However, during the day when everyone is in, the SNMP traffic through the switch will only display 200k-400k (or less), yet the AdTran router is showing an average 5 minute of 1.4m+!

My first thought was maybe something else is plugged in to the AdTran (like a voip phone system - vcx unit), but the telnet interface shows nothing connected to the other ethernet port or T1 port on the AdTran.

Could the SNMP interface utilization be reporting only certain kinds of traffic? For example, maybe it does not report VOIP type traffic?

Any other thoughts/suggestions?

score 0 · Answer 1 · answered Mar 31 '11 at 13:26

0

Did you set up the SNMP using SNMPWaLk or manually ? You might simply be getting the wrong stats off the device.

Here's an MRTG snippet for reference:

SnmpWalk: It may be that you want to monitor an snmp object that is only reachable by 'walking'. You can get mrtg to walk by prepending the OID with the string WaLK or if you want a particular entry from the table returned by the walk you can use WaLKx where x is a number starting from 0 (!).

answered Mar 31 '11 at 13:26

Jonathan Ross

2,173
11
14

Also - if the switch port that you are on is not promiscuous or is vlan'd out, you might not be seeing all of the traffic on the switch – tsykoduk Mar 31 '11 at 15:50
the switch has an snmp configuration screen, basically there is an option to enable/disable and I left everything default. In WhatsUpGold, I give the IP of the switch and it recognizes that the switch has snmp and reads all the ethernet ports, etc. I tell whatsupgold to view the port the router is connected to - interface utilization and I see traffic charted. It appears to be accurate SOMETIMES - for example right now. I might try setting up a sniffer to see whats happening that way. – Scott Szretter Apr 01 '11 at 12:03

Scott Szretter · Accepted Answer · 2011-05-10T19:20:53.047

I think I know what MAY be happening - it looks like a possible issue with WhatsUpGold - when watching the real time traffic (a web based interface), if I totally refresh the page, the traffic shows higher numbers - T1 type speeds instead of the low 300k or less speeds. So it seems like something is going flakey with the graph and refreshing fixes it. I will mark this as the answer if that turns out to be the issue.

Also, the other thing that can be confusing is the graph can 'focus' on incoming or outgoing and I have seen the graph load up set as for example outgoing when I want to see it as incoming - which usually it loads that way by default.

Discrepancy between router interface traffic and switch traffic?

2 Answers2