Counter Roll-Over?

[mhoppes]

I'm seeing this on a 12 port switch when traffic gets above 100megabits/second. Traffic didn't die, and was still flowing, but the SNMP values appear to be resetting. The switch supports 64 bit counters, doesn't it?

Screen Shot 2015-02-22 at 7.32.31 AM.png (45.9 KiB) Viewed 16895 times

[JustJoe]

Is there a chance the tool you are using has the port defined as "100Mb" max by default? I know for example that MRTG can be set up this way, mostly with a max limit to keep from skewing the graph and blocking out the view of actual traffic after there actually is a reboot.

[mhoppes]

Hmmm. I'll check that but I don't think so. Just had an idea though. Will report back.

[JustJoe]

Also, I am remembering, weren't there a second set of counters defined in SNMP as higher speed links evolved so that there was a different set of OIDs for counters that were a larger size?

-Edit- I guess what I was remembering were the ifHC* counters that were discussed in the MRTG reference..

http://oss.oetiker.ch/mrtg/doc/mrtg-reference.en.html

On that page do a find on counters

[mhoppes]

Actually looks like the MRTG graph default is 100 for the upper limit -- odd, this was on a fairly new MRTG install. Anyway, I looked at the yearly graph and it was pegged at 80meg, so that very well could be what it was. I upped it to 1,000 and we'll see what happens tonight.

Thanks, been having the same issue with an EdgeRouter... I never even thought to check this.

[JustJoe]

Actually looks like the MRTG graph default is 100 for the upper limit -- odd, this was on a fairly new MRTG install. Anyway, I looked at the yearly graph and it was pegged at 80meg, so that very well could be what it was. I upped it to 1,000 and we'll see what happens tonight.

Thanks, been having the same issue with an EdgeRouter... I never even thought to check this.

Matt, I am not sure if you caught in my second post the link and the mention of the ifHC set of counters, because I did that with an edit.

What made me wonder about the 100Mb limit is that your graph did show a max number of 112Mb, and I believe that would not have gotten through either.

[mhoppes]

Thanks. Just saw that now. Odd thing is I see that 112, but the other graphs seem to be throttled around 80... at any rate I upped that value in Cacti, we shall see what happens, but I'll look at the ifHC link.

[mhoppes]

Ahhhh yes... ifHC... yes that's what I was originally going to look at. And in fact it's polling version 1. I'm going to see what happens with the change to 1000 from 100 and then will switch to SNMPv2 tomorrow.

[mhoppes]

Ok... so neither changing to v2, nor increasing to 1000 fixed it. It's like as soon as it goes over 100 it rolls.... =\

[mhoppes]

Apparently in Cacti using "Total Bandwidth" as a graph template does not have 64 bit values as default... arg.