SNMP Bandwidth usage calculation

[dbrian]

Hello,

I'm writing an application that uses SNMP to retrieve some device data and to show the average bandwidth usage over a given period of time (like 5 minutes for example). The problem is that for some reason I can't get an accurate reading of the usage so either my calculations are off or the readings are off.

If it helps with something the application is written in PHP and the test was done on a Debian install.

Test procedure:
- did a reading via snmpwalk (doesn't matter if it's from command line or the application)
- run a test on speedtest.net (results were ~93Mbps on download)
- did a reading again via snmpwalk

Results: ~28MB/s inbound - done over a 100Mbps uplink (basically it's ~18MB/s over the maximum physical capabilities of the interface)

Note: The interval between the pools was 30 seconds.

The OID I used is 1.3.6.1.2.1.2.2.1.10 which corresponds to ifInOctets and the formula I used is: (ifInOctets(reading2) - ifInOctets(reading1)) * 8 / poolInterval.

Does anyone know why I get these results and not the actual usage?

 

[Lithium381]

How accurate is the polling interval? Also, why are you multiplying by 8 and then reporting results in bytes and you report your speedtest results in bits? which are you using? Can I see the whole script either via PM or here? I've written my own PHP scripts to graph my cisco bandwidth but I used a slightly different method. . . I found it easier to use Cisco's 5 minute rolling average for my graph. . . . it smoothed it out over time so it was easier to read when i was putting up several hours worth of info. . .

 

[Railgun]

Unless you have a one second interval, you will never get an accurate reading.

You could have a 30 second poll. In the first five seconds you saturate the link. The next 25, nada. Your 30 second result will suggest all is well and good.

 

[dbrian]

How accurate is the polling interval? Also, why are you multiplying by 8 and then reporting results in bytes and you report your speedtest results in bits? which are you using? Can I see the whole script either via PM or here? I've written my own PHP scripts to graph my cisco bandwidth but I used a slightly different method. . . I found it easier to use Cisco's 5 minute rolling average for my graph. . . . it smoothed it out over time so it was easier to read when i was putting up several hours worth of info. . .

The pooling interval was calculated using the "uptime" value from SNMP. In the script it's calculated using the current timestamp (should I be using the "uptime" value here as well?)

I had a look at the script, and indeed I'm calculating wrong. The goal is to show the speed in bytes therefore the forumula should be (ifInOctets(reading2) - ifInOctets(reading1)) / poolInterval, but even so given the results the speedtest reports 93Mbps and I get 28Mbps.

The script has 2 parts: one that retrieves the data and calculates the difference between the "in" readings, the "out" readings and the time difference and one that does the bandwidth calculations

Unless you have a one second interval, you will never get an accurate reading.

You could have a 30 second poll. In the first five seconds you saturate the link. The next 25, nada. Your 30 second result will suggest all is well and good.

I also tried a 1 second pool interval but got the same results (maybe the interval was not spot on).

 

[jersiq]

The pooling interval was calculated using the "uptime" value from SNMP. In the script it's calculated using the current timestamp (should I be using the "uptime" value here as well?)

I had a look at the script, and indeed I'm calculating wrong. The goal is to show the speed in bytes therefore the forumula should be (ifInOctets(reading2) - ifInOctets(reading1)) / poolInterval, but even so given the results the speedtest reports 93Mbps and I get 28Mbps.

The script has 2 parts: one that retrieves the data and calculates the difference between the "in" readings, the "out" readings and the time difference and one that does the bandwidth calculations



I also tried a 1 second pool interval but got the same results (maybe the interval was not spot on).

I am confused by your while loop.

You are dividing by 1024, but network speed isn't in powers of 2, it's in powers of 10. So from bits, you divide by 10^6 to get Megabits per time. Or, you can divide bits by 10^9 to get Gigabits per time. I haven't done the backwards math to see if this picks it up for you or not.

 

[dbrian]

I am confused by your while loop.

You are dividing by 1024, but network speed isn't in powers of 2, it's in powers of 10. So from bits, you divide by 10^6 to get Megabits per time. Or, you can divide bits by 10^9 to get Gigabits per time. I haven't done the backwards math to see if this picks it up for you or not.

I've updated the script to divide by 1000 when converting, but still get some strange readings - need to investigate some more.

 

[dbrian]

After some investigating I figured out that the problem was the way I was storing the polled data.

I've tested again, this time by monitoring the wireless AP and using my phone to do the speed test (the reason for this is that through the AP no other traffic was passing besides the one from my phone).

When monitoring the AP the application reported 455KB/s and the speed test site reported 376KB/s so this was fairly accurate, but when monitoring the Debian server I still got some spikes (max speed) of 50-100MB/s (although the speed reported by speedtest.net is 11.6MB/s).

To check the results on the Debian box I had another monitoring software (darkstat3) running in another window and it reported correctly.

Any ideas why I have those spikes?