<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Courier;
panose-1:2 7 4 9 2 2 5 2 4 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Comic Sans MS";
color:black;
font-weight:normal;
font-style:normal;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>I was
wondering if someone could figure out what is going wrong on this one.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>We have a VPN
concentrator anchoring about 1,600 sites. MRTG measures successfully both WAN and
LAN interfaces. A lot of the sites in the concentrator mesh to other
sites also anchored in the box. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>We wanted to
measure the “bounce” traffic that never enters the LAN, just
bounces off the concentrator in between VPN sites. The solution we came up to was
to subtract from the WAN-out (SNMP 2) the LAN-in (SNMP 4). That would define
the bounce: traffic leaving the concentrator towards the cloud that did not come
from the LAN.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>The target
line attempted was short:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face=Courier><span style='font-size:
10.0pt;font-family:Courier;color:blue'>Target [sonicw-3rd-bounce]:
(2:string@172.16.9.226::10:10) - (-4:string@172.16.9.226::10:10)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>This delivered
garbage numbers unrelated to actual traffic. We thought that maybe the (IN/OUT
swap on using the minus sign in the LAN (4) interface was behind the problem,
and tried directly with OIDs:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=blue face=Courier><span style='font-size:
10.0pt;font-family:Courier;color:blue'>Target [sonicw-3rd-bounce]: (
(.1.3.6.1.2.1.2.2.1.16.2&.1.3.6.1.2.1.2.2.1.16.2:string@172.16.9.226::10:10)
- (.1.3.6.1.2.1.2.2.1.10.4&.1.3.6.1.2.1.2.2.1.10.4:string@172.16.9.226::10:10)
) <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>Still dreck
results. Attempts to play with the parenthesis, adding more, did not help. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>One strange
thing is that the garbage results are unrelated to the arithmetic possible with
the four combinations of WAN/LAN and In/Out. For instance, if traffic is
hovering around 4 megs in the LAN and 6 in the WAN, we could get 26 megs on the
target above.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>Thanks if
someone can point in the right direction.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face="Comic Sans MS"><span
style='font-size:10.0pt;font-family:"Comic Sans MS";color:black'>Fernando<o:p></o:p></span></font></p>
</div>
</body>
</html>