banshee/network-collection/network/snmp/interface-traffic

Traffic of the network interfaces of a device, by SNMP

Returns, for each interface of a switch, a router or a firewall, its description, its inbound and outbound traffic, its usage of the negotiated speed, its packets, errors and drops. Six watches are offered, each one set on the probe.

What changed since version 1

Version 1 read one interface, named by the variable network:interface, and stopped as misconfigured when it was not found. Version 2 reads every interface; the variable disappears, replaced by the selection of the probe ("Only" the interfaces you want).
Version 1 skipped the whole run on its first reading; version 2 returns nothing for an interface until its second reading, and nothing is skipped.
The description of the port, the total traffic, the usage, the packets, the errors and the drops are new outputs, with their watches.
The output status and the watch down leave this collector: the state of the links is read by network/snmp/interfaces, whose watch link-down replaces down.

How it works

The collector reads ifTable and ifXTable (IF-MIB). An interface is named by ifName (Gi1/0/1, ether1, ge-0/0/0), as in network/snmp/interfaces.

Traffic, packets, errors and drops come from the 64-bit counters (ifHCInOctets, ifHCOutOctets, the unicast, multicast and broadcast packets) and from the error and discard counters, over the interval between two runs: on the first run they are not returned; they come on the next one. Nor after the device restarts, when the counters go back.
Usage is traffic against the negotiated speed (ifHighSpeed); an interface without a negotiated speed (down, or virtual) has none.
The share of drops is the dropped packets against the packets that passed and those dropped.
The description is ifAlias, the text the administrator gives a port (uplink-core); a port without one returns none.
Two interfaces with the same name each keep their own: the second carries its index (ether1 #12).
The default selection leaves out lo, lo0*, Lo*, Nu* and Null*, as network/snmp/interfaces does. It can be changed on the probe.

The collector only reads: SNMP sends nothing but reads.

Prerequisites

The SNMP agent of the device enabled, reachable from the poller (UDP 161), its access restricted to the poller.
The view granted to the poller includes interfaces (.1.3.6.1.2.1.2) and ifXTable (.1.3.6.1.2.1.31).
SNMPv2c or SNMPv3: the 64-bit counters do not exist in SNMPv1. Read-only access, set on the host or one of its folders (protocol:snmp:* variables).

Outputs

Name	Label	Unit	Per instance
`alias`	Description	—	yes, per interface
`traffic-in`	Inbound traffic	bit/s	yes, per interface
`traffic-out`	Outbound traffic	bit/s	yes, per interface
`traffic`	Total traffic	bit/s	yes, per interface
`in-percent`	Inbound usage	%	yes, per interface
`out-percent`	Outbound usage	%	yes, per interface
`packets`	Packets	packets/s	yes, per interface
`errors`	Errors	errors/s	yes, per interface
`drops`	Drops	packets/s	yes, per interface
`drop-percent`	Share of packets dropped	%	yes, per interface

Watches

Name	Title	Kind	Defaults	Checked by default
`saturation-in`	Inbound saturation	above a threshold, on `in-percent`	warning above 70 %, critical above 90 %, for 5 min	yes
`saturation-out`	Outbound saturation	above a threshold, on `out-percent`	warning above 70 %, critical above 90 %, for 5 min	yes
`errors`	Errors	judged by the collector	warning above 1 error per minute; critical above 0.1 % of the traffic	yes
`drops`	Packets dropped	above a threshold, on `drop-percent`	warning above 0.5 %, critical above 2 %	yes
`traffic-unusual`	Unusual traffic	off its habit, on `traffic`	normal sensitivity, never under 10,000,000 bit/s (10 Mbit/s)	no
`mute`	Silent interface	no activity, on `packets`	warning after 10 min at zero packets; no critical	no

"Unusual traffic" needs the history of the measure: until the poller has learnt it, the watch says it is learning and raises nothing.

Limits

An interface without 64-bit counters returns nothing; the 32-bit counters are not read, as they wrap in less than a minute at 1 Gbit/s.
The traffic is an average over the interval of the probe: a burst shorter than that interval is smoothed out.
Drops on a switch port often mean congestion of its output queue, not a fault of the link.
An interface renamed is a new instance.