[mrtg] MRTG show peaks over what our Cisco 7206 routers CAR Rate-Limitin g is set?

[Mark Urbach]

Does anyone know why the MRTG reports show peaks over what CISCO CAR allows?

====================================================================
I have started to make some notes on how to explain these peaks to my boss,
but am stuck!

MRGT reports.

MRTG using SNMP and UDP which goes out to SNMP devices and polls the MIB
database from the device.
We are polling the interface ifcounters for the MRTG statistics.
It does this every 5 minutes.
The interface counters are always changing, based on the devices own MIB
database collections.
MIBS use: ASN.1 Syntax 

At any "one" instant the counters can show anything from 0 bps to the MAX
bps of the interface.

Interfaces transmit and receive data at the full wire/line speed.
100 Mbps sends and receives at 100 Mbps.
44 Mbps sends and receives at 44 Mbps.  
This is controlled by the clocking of the device/interface.

So if you poll any interface counters at any one instance you can see
anything from 0 to the MAX rate of that interface.
Depending on the the SNMP device (switch/router) MIBs have collected locally
from its MIBs.

Rate-Limiting is done in software on the Cisco Router using something called
CAR=commiited access rate.
(remember the interfaces still transmit and receive at full wire speed)

As data passes through each interface the rate limiting looks at it and it
has to make decisions based on buffer space, rate-limit settings, bucket
size, etc.  to see what it needs to do with the traffic, as well as where to
send it (route it).
It will drop/dump packets if the rate-limiting determins it should.

As you can see you have several things going on within the SNMP/MIB devices.
How often does a device (MIB) poll statistics on its own interfaces to keep
in memory?
The MIB's which are based on standards which describe the timeframes for
data collections and so do the vendors.

MRTG does not know anything about CAR, it just gets MIB stats every 5
minutes from the MIB table of the device.
MRTG looks at the total interface traffic counters, it knows nothing about
packets that are dropped in software!
MRTG reads the traffic counters every 5 minutes. It subtracts the
accumulated traffic between these two points and divides by 300 minutes to
yield bytes per second. The returned value is the average traffic over this
5 minute interval. 


> 	Mark Urbach
> 	Dark Fiber Solutions
> 	NOC Services
> 	600 1/2 Grant Ave.
> 	York, NE  68467
> 	Office: 402-362-3334
> 	Cell: 402-366-2087
> 	murbach at darkfibersolutions.com
> 
> 

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi