LITTLEBLACKDOG.COM

Posted: Fri Dec 21, 2007 3:44 pm Post subject: SNMP Bandwidth Formula

I have almost completed my network monitoring application.

Right now I am trying to create a bandwidth monitor.

My problem though is I am unable to figure out how to calculate the usage, and it is driving me crazy.

Here is my data from ifInOctets, and ifOutOctets, polled over a 600 second (10 minutes) time frame, and a speed of 1000000000

Gi0/38 2909125696 3976181553
Gi0/38 2909167473 3976695234

Now Cisco gives the formula as the Delta of InOctets, and OutOctets times 8 times 100, divided by seconds times speed.
http://www.cisco.com/warp/public/477/SNMP/calculate_bandwidth_snmp.html

(InOctets + OutOctets) * 8 * 100 / Seconds * Speed

(41777 + 513681) * 8 * 100 / 600 * 1000000000 = 740610666666670

That cannot be correct. So I looked around and I found a couple more formulas, but they do not appear to be correct either.

Can anyone offer some guidence on this?

Posted: Thu Dec 27, 2007 3:37 pm Post subject:

I think that I figured out the formula for the bandwidth utilization. I am sending this out so someone can check my work, or tell me that it is completely wrong.

Here goes nothing.

Cisco Formula:
(DeltaIn + DeltaOut) * 8 * 100 / Time * Speed
Time is in seconds
Speed is in bits

I ran another poll of the switches for a 5 minute interval as that is what the switch reports when you do a "show interface". I tried to match these 5 minute intervals as closely as I can, but I highly doubt that I was exact.

The output of the switch was
GigabitEthernet0/38 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0018.1900.9ca6 (bia 0018.1900.9ca6)
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters 5w3d
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 3000 bits/sec, 3 packets/sec
5 minute output rate 10000 bits/sec, 10 packets/sec
171730837 packets input, 174144123268 bytes, 0 no buffer
Received 32253 broadcasts (270 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 270 multicast, 0 pause input
0 input packets with dribble condition detected
194995866 packets output, 211291909769 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out

The output from my script was
BOID3560 Gi0/38 2753753930 2117875122 1000000000 2007-12-27 14:50:25.000
BOID3560 Gi0/38 2753829445 2118316925 1000000000 2007-12-27 14:56:05.000

I took the formula from the Cisco website and tried to figure out what I was solving for. SNMP is grabbing an integer that increases with usage. Since the SNMP name is IfInOctet, I decided that the information that is being pulled from SNMP must be in Byte form (Octet), and that is why in the Cisco formula it is multiplying the numbers by 8. So I am solving for Bytes per second (Bps).

Next I was trying to figure out the what the switch was saying it had for it's utilization. After some prodding I determined that the
5 minute input rate 3000 bits/sec, 3 packets/sec
5 minute output rate 10000 bits/sec, 10 packets/sec
where the parts that I wanted. As the Other input and output numbers appear to just be the difference of a poll.
I decided that 3000 bits/sec was the average usage over the 5 minute interval.
So I added the In and the Out together.
3000 bps + 10000 bps = 13000 bps

I then took the deltas of my polling and added them together
In = 75515
Out = 441803
75515 Bytes + 441803 Bytes = 517318 Bytes
To get the bits I muliplied that number by 8
517318 Bytes * 8 = 4138544 bits
Now that 4138544 bits is over a 5 minute interval so I divided that by 300 seconds (5 minutes)
4138544 bits / 300 s = 13795 bps

Which gives me a 6% difference between what the switch had and what I got. Which 6% to me isn't that bad, and that could very well be the difference in the polling and checking of the switches.

To come up with the utilization I just take the 13795 bps and divide it by the port speed (in this case 1 Gbps) then multiply it by 100
(13795 bps / 1000000000 bps) * 100 = .0014 %

Which could be close to being correct as I just sat here for 5 minutes waiting for the script to poll the switches twice.

So my end formula is
(((DeltaIn + DeltaOut) * 8 / Time) / Speed) * 100

Does this all sound correct? I used all the variables in the Cisco formula but I didn't follow the same order of operations that they did.

Let me know what you think.

Posted: Thu Dec 27, 2007 4:20 pm Post subject:

I think you are more or less there. The difference (you did clear counters all before you started measuring?) can be attributed to those damn counters which don't count right, as far as I have ever seen them over the past 10 or so years.

But 6% is pretty good delta.

Posted: Thu Jan 17, 2008 5:34 am Post subject:

EdisonRex wrote:
I think you are more or less there. The difference (you did clear counters all before you started measuring?) can be attributed to those damn counters which don't count right, as far as I have ever seen them over the past 10 or so years.

Nope forgot to clear the counters before I ran this. But I have a new problem, err rather a dirt old problem, that no one has noticed before now.

I think that I may have a problem with under utilization. I keep looking at my traffic trends, and for the most part it NEVER goes above 25% usage. My average usage sits around 1 - 3% during working hours, and below 1% on off hours. So I thought that maybe my formula was incorrect, or I had an off day. So I continued to monitor for about a week, and I still had the same results.
We are running VMWare, so I decided to check the server traffic graphs and compare with mine. And my graphs pretty much match theirs. I get spikes every once in a wile that will go up to 7 - 10% usage but that is not a constant flow, it's just a spike, other wise I am sitting below 1% usage.

So decided to do an experiment. I took a file that was 8 Gigs in size, and I copied from my computer to another server and timed how long it took. I copied this file between several servers, timing each one to see if I could find a bottle neck, either with my physical switches, or my virtual switches.
Well my results were not that compelling, each took around 6 mins and 30 seconds to copy. Some were a little faster, and I had one that was around 10 mins, but that was between my production SQL servers in the middle of the day.
After taking all of those times, and the size of the file, I calculated an average of 17% usage, with gigabit connections.

I am not sure what the average usage should be, but I don't think that I have ever seen usage this low consistently before. And quite frankly I don't know what to do about it. I have been trying to find stuff online, but have had little success.

I checked for broadcast storms, multicast storms, duplex mismatch, packet loss, and CRC errors, but everything appears to be alright with those.

Any suggestions? Books, websites, anything?