5

SNMP ifInOctets = 2145342796 - about 2GB.

ifconfig: RX bytes:174302710687 (174.3 GB)

Interestingly, the sent bytes agree almost perfectly:

ifOutOctets: 1002415050 - about 1GB

ifconfig: TX bytes:1002418728 (1.0 GB)

It's not an SNMP discontinuity:

snmpwalk -v2c -c public localhost 1.3.6.1.2.1.31.1.1.1.19    
iso.3.6.1.2.1.31.1.1.1.19.1 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.31.1.1.1.19.2 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.31.1.1.1.19.3 = Timeticks: (0) 0:00:00.00

Anyone have an idea for this discontinuity in the sent data numbers? Thanks so much!

(net-snmp, Ubuntu Linux, 12.04 LTS)

NightFalcon
  • 63
  • 4
  • 5
    My first bet is that SNMP is using a 32-bit counter that has rolled over several times, where the kernel uses a 64-bit counter. 174302710687 % 2^32 = 2504018847, which isn't too far off what SNMP is reporting. Also SNMP may restart counters on ifup/ifdown events, or if the daemon is ever restarted, where the kernel counts don't - you can ifconfig an interface down, then back up and the counters just resume, unless you also unload the driver module as well... –  Nov 09 '12 at 15:02
  • @twalberg saw that myself any number of times over the years. – Magellan Nov 10 '12 at 23:14

1 Answers1

8

As twalberg suggests, this is probably a 32-bit overflow problem.

SNMP Interface Counters in are 32-bit (unsigned) by default. If your SNMP daemon and server OS support 64-bit counters they can be found in the ifXtable MIB (.1.3.6.1.2.1.31.1.1)

voretaq7
  • 79,345
  • 17
  • 128
  • 213
  • You were quicker than me. By the time I found the ifXtable reference you had already posted the same. – Tonny Nov 10 '12 at 21:44
  • @Tonny my google-fu is strong today (`snmp 64 bit interface counters` turned up that Cisco MIB browser link as the #2 result :) – voretaq7 Nov 10 '12 at 21:50
  • I left out "interface", which muddied the waters a bit. – Tonny Nov 11 '12 at 10:23
  • I did not consider that! I knew I was overlooking something. Thanks. Incidentally, I noticed that my question had a -1 in front of it for a time - did I break some rule of some sort? Thanks! – NightFalcon Nov 12 '12 at 13:45
  • @NightFalcon None that I'm aware of -- I think your question just got caught up in StackOverflow hate. For better or worse questions that come from Stack Overflow are treated more harshly than ones that originate on Server Fault because of the historical avalanche of bad migrations (of the 955 questions migrated here from SO in the last 90 days, over 40% were kicked back for being off topic, insufficiently detailed/unanswerable, etc. -- yours is one of the good ones though :) – voretaq7 Nov 12 '12 at 16:31