<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<STYLE type=text/css>DIV {
MARGIN: 0px
}
</STYLE>
<META content="MSHTML 6.00.2900.3199" name=GENERATOR></HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>You have a point there.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I replaced the switch in question and am getting
exactly the same results - all interfaces report the same Out bandwidth. To be
more accurate, all the ports connected to servers report the same Out bandwidth.
The uplink ports to the router are reporting different numbers.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I directed a flood of pings to an IP on each port,
I varied the duration of the ping flood between 2-4 minutes, and looked at the
MRTG graph after each flood. In all cases, every port reported the same jump in
the OUT bandwidth despite the fact that I specifically directed a flood of
traffic to an IP behind a single port. Just to test my own sanity, I did this on
other switches and got the expected result of a jump in bandwidth only on the
specific port that "owned" the IP.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I watched the ARP debug logs and didn't seem to
find anything unusual. I'm not sure where else to go from here but it
doesn't really seem to be an MRTG problem at this point.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>----- Original Message ----- </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=mpetach@yahoo.com href="mailto:mpetach@yahoo.com">Matthew Petach</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=patrick@nicsys.net
href="mailto:patrick@nicsys.net">Patrick Kremer</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Sunday, November 04, 2007 2:47
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [mrtg] MRTG reporting
incorrect results</DIV>
<DIV><BR></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman,new york,times,serif"><BR>You
say "Obviously this isn't possible" -- actually, if the MAC address table in
your<BR>switch dies/fails to populate for some reason, the normal behaviour is
for the switch<BR>to become a hub, and flood all unknown unicast traffic out
to all ports; which means<BR>you'll see exactly that pattern, the inbound on
each port is correct, but all traffic from<BR>all ports is flooded out to all
other ports, giving you the results you're seeing, where<BR>the outbound data
on all ports is identical.<BR><BR>Matt<BR><BR>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman,new york,times,serif">-----
Original Message ----<BR>From: Patrick Kremer
<patrick@nicsys.net><BR>To: mrtg@lists.oetiker.ch<BR>Sent: Friday,
November 2, 2007 12:07:11 PM<BR>Subject: [mrtg] MRTG reporting incorrect
results<BR><BR>
<STYLE></STYLE>
<DIV><FONT face=Arial size=2>This apparently started happening 2 weeks ago.
All MRTG-monitored interfaces on one particular switch are showing identical
graphs for all "Out" bandwidth. As expected, the report shows varying values
for "In" Max/Average/Current for each port on the switch. However, each
port has the exact same values for all "Out" Max/Average/Current. The blue
line is exactly the same for all ports on all graphs beginning between at
about week 41 1/2. Obviously, this isn't possible</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>It doesn't appear to be something specifically
wrong with MRTG itself because the rest of the monitored switches seem to be
reporting correctly. The MRTG config for the switch in question hasn't changed
in 3 months. I have already tried rebooting the switch and the machine hosting
MRTG. Because I couldn't think of anything else to do, I tried regenerating
the configuration file with an snmpwalk, but it's no different from the
original config file.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I don't know what else to do except assume that I
somehow have a bad switch?? Has anybody come across anything like this
before?</FONT></DIV></DIV><BR></DIV></DIV><BR>__________________________________________________<BR>Do
You Yahoo!?<BR>Tired of spam? Yahoo! Mail has the best spam protection around
<BR>http://mail.yahoo.com </BLOCKQUOTE></BODY></HTML>