banshee/network-collection/network/snmp/interfaces

State of the network interfaces of a device, by SNMP

Returns, for each interface of a switch, a router or a firewall, its description, its link state, its negotiated speed and duplex, its MTU, how long it has kept its state, and its IPv4 addresses. Seven watches are offered, each one set on the probe.

The device's name and uptime are read by network/snmp/system; the traffic, errors and drops by network/snmp/interface-traffic.

Versions

Generic: any device whose agent serves IF-MIB, whatever its brand; EtherLike-MIB adds the duplex, IP-MIB the IPv4 addresses.

How it works

The collector reads ifTable and ifXTable (IF-MIB), dot3StatsDuplexStatus (EtherLike-MIB), ipAddrTable (IP-MIB) for the addresses, and sysUpTime (SNMPv2-MIB). An interface is named by ifName (Gi1/0/1, ether1, ge-0/0/0).

The link state is ifOperStatus in words: up, down, testing, unknown, dormant, notpresent, lowerlayerdown; disabled when ifAdminStatus says the administrator shut the interface.
The negotiated speed (ifHighSpeed) and the duplex are returned for a link that is up only; a virtual interface without speed (0) has none.
The time in its state is sysUpTime less ifLastChange, in minutes: a link that has not changed since the agent started has been in its state since then.
The description is ifAlias, the text the administrator gives a port (uplink-core); a port without one returns none.
Two interfaces with the same name each keep their own: the second carries its index (ether1 #12).
The default selection leaves out lo, lo0*, Lo* (Lo0 on Cisco), Nu* and Null* (Nu0, Null0). It can be changed on the probe.

"Link down" is not checked by default. On an access switch, every port without a cable is a link down: checked on all the ports, the probe would be critical from its first run, and a real fault would drown among the empty ports. To watch the links that count, choose "Only" the uplinks and the server ports in the selection of the probe, by their names (the description read here tells which port is which), then check "Link down". Shutting the unused ports works too: they then read disabled, never down.

The collector only reads: SNMP sends nothing but reads.

Prerequisites

The SNMP agent of the device enabled, reachable from the poller (UDP 161), its access restricted to the poller.
The view granted to the poller includes interfaces (.1.3.6.1.2.1.2), ifXTable (.1.3.6.1.2.1.31), ipAddrTable (.1.3.6.1.2.1.4.20) and sysUpTime (.1.3.6.1.2.1.1.3); dot3StatsTable (.1.3.6.1.2.1.10.7.2) for the duplex. Most devices grant all of it to a read-only community or user.
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

Outputs

Name	Label	Unit	Per instance
`alias`	Description	—	yes, per interface
`link`	Link state	—	yes, per interface
`speed`	Negotiated speed	Mbit/s	yes, per interface
`duplex`	Duplex	—	yes, per interface
`mtu`	MTU	—	yes, per interface
`stable-for`	Time in its state	min	yes, per interface
`addresses`	IPv4 addresses	—	yes, per interface

Watches

Name	Title	Kind	Defaults	Checked by default
`link-down`	Link down	state to avoid, on `link`	critical on `down` and `lowerlayerdown`; no warning	no: check it once the selection keeps the links that count
`link-changed`	Link changed recently	below a threshold, on `stable-for`	warning below 15 min	no
`speed-degraded`	Negotiated speed degraded	judged by the collector	warning when the negotiated speed is below the expected speed, 1000 Mbit/s	no
`half-duplex`	Half duplex	state to avoid, on `duplex`	warning on `half`	yes
`missing`	Interface missing	expected instances, on `link`	no interface named: it raises nothing until names are set on the probe	no
`mtu`	Unexpected MTU	expected value, on `mtu`	warning when the MTU is anything but 1500	no
`no-address`	No IPv4 address left	below a threshold, on `addresses`	critical below 1	no

Limits

A link that flaps between two runs is seen only through link-changed, from the time in its state; IF-MIB counts no changes.
sysUpTime wraps after 497 days: until the agent restarts, the time in its state of an interface that changed before the wrap is not returned.
Without EtherLike-MIB, the duplex is not returned. Only IPv4 addresses are counted: ipAddrTable lists IPv4 only.
An interface renamed is a new instance, and the former one goes missing.