[mrtg] Re: Two copies of MRTG disagree with each other about usage

[Craig Humphrey]

Hi Zach,

At first glance I'd say that your ISP is measuring in MegaBits per
second and you're measuring in MegaBytes per second, the ratio seems
about right.

Are you both polling the same interface on the switch?
If not, (e.g. you're polling the inside of the firewall, they're polling
the outside) then it's quite conceivable that the firewall is filtering
out a huge amount of "noise" traffic that just doesn't belong on your
network.  In which case, you should be trying to find out what it is and
why you're only getting about 10% legit traffic (by volume, let alone #
packets).

Why have the ISP coming in via a switch, can't you plug it straight into
the Firewall? Then you don't have to VLAN off that part of the switch.
If you still need MRTG stats, you/they should be able to get them from
the firewall itself (though of course your side will probably still be
plugged into a switch somewhere...)

Also, I seem to recall people pointing out that Cisco interface stats
for VLANs is fairly unreliable, but that could be just hearsay.

Just my 2c, hope it helps.

Later'ish
Craig


> -----Original Message-----
> From: mrtg-bounce at list.ee.ethz.ch 
> [mailto:mrtg-bounce at list.ee.ethz.ch] On Behalf Of Zach White
> Sent: Thursday, July 21, 2005 11:30 AM
> To: mrtg at list.ee.ethz.ch
> Subject: [mrtg] Two copies of MRTG disagree with each other 
> about usage
> 
> Hi Everyone,
> 
> I have an odd problem that I'm hoping someone can shed some light on.
> 
> I have MRTG 2.10.13 setup on an OpenBSD 3.7 machine. It polls 
> my switch, a catalyst 2924, every 5 minutes. Data coming from 
> my switch seems to be valid and agrees with what iptraf on my 
> firewall says about current usage.
> 
> The ethernet drop from my ISP comes into port 1 on the 
> switch, and port
> 2 goes to the firewall. These ports are in their own vlan so 
> that data from our network doesn't get comingled in.
> 
> My ISP uses MRTG 2.9.29, I don't know what OS. They poll the 
> port that the other end of my ethernet drop uses every 5 minutes.
> 
> The problem is that the data I'm seeing and the data my ISP 
> is seeing don't match up. The usage they're seeing is a lot 
> higher than what I'm seeing, but the curve of the graph 
> matches up pretty well.
> 
> For example, looking at the weekly graph, with a 30 minute 
> average, my copy of MRTG reports a peak of 2800.0k. Their 
> copy of MRTG is reporting a peak in the same period of 
> something around 23.0M. Comparing more data shows about the 
> same ratio between my data and their data.
> 
> I've been working with one of their network engineers and so 
> far neither of us have been able to figure out where the 
> problem lies. I'm currently working on getting them to let me 
> monitor their switch directly and have them monitor my switch 
> directly to make sure each switch is reporting the same data, 
> but it's unclear as to whether they'll go for this.
> 
> So, ignoring that it may an issue with either my switch or 
> theirs, does anyone have any ideas as to where the problem 
> may lie? A small difference I'd understand, but the data 
> they're showing is consistantly 8-16x higher than what I show 
> for the same period.
> 
> I've appended my config and their config (properly sanitized) below.
> 
> Thanks for any light you can shed on this issue.
> 
> -Zach

[snip snip]

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://lists.ee.ethz.ch/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi