interfaces

State of the network interfaces of a device, by SNMP

Returns, for each interface of a switch, a router or a firewall, its description, its link state, its negotiated speed and duplex, its MTU, how long it has kept its state, and its IPv4 addresses. Seven watches are offered, each one set on the probe.

What changed since version 1

• Version 1 mixed two scopes, the device and its interfaces. The device's name and uptime are now read by network/snmp/system; the traffic, errors and drops by network/snmp/interface-traffic. This collector keeps the state of the links.
• The link state is a word (up, down, lowerlayerdown…), no longer the number of ifOperStatus; an interface the administrator has disabled reads disabled, so it does not pass for a link down.
• The output status becomes link; address, the first IPv4 address, becomes addresses, their number. alias, duplex, mtu and stable-for are new.
• The watch down (critical on 2, not checked) becomes link-down, critical on down and lowerlayerdown, still not checked by default (see below). Its id changes on purpose: a probe upgraded from version 1 would otherwise keep its setting 2, which no word matches, and never raise a link down.
• Six watches are new: link-changed, speed-degraded, half-duplex, missing, mtu, no-address.
• Loopback and null interfaces are left out by the default selection.

How it works

The collector reads ifTable and ifXTable (IF-MIB), dot3StatsDuplexStatus (EtherLike-MIB), ipAddrTable (IP-MIB) for the addresses, and sysUpTime (SNMPv2-MIB). An interface is named by ifName (Gi1/0/1, ether1, ge-0/0/0).

• The link state is ifOperStatus in words: up, down, testing, unknown, dormant, notpresent, lowerlayerdown; disabled when ifAdminStatus says the administrator shut the interface.
• The negotiated speed (ifHighSpeed) and the duplex are returned for a link that is up only; a virtual interface without speed (0) has none.
• The time in its state is sysUpTime less ifLastChange, in minutes: a link that has not changed since the agent started has been in its state since then.
• The description is ifAlias, the text the administrator gives a port (uplink-core); a port without one returns none.
• Two interfaces with the same name each keep their own: the second carries its index (ether1 #12).
• The default selection leaves out lo, lo0*, Lo* (Lo0 on Cisco), Nu* and Null* (Nu0, Null0). It can be changed on the probe.

"Link down" is not checked by default. On an access switch, every port without a cable is a link down: checked on all the ports, the probe would be critical from its first run, and a real fault would drown among the empty ports. To watch the links that count, choose "Only" the uplinks and the server ports in the selection of the probe, by their names (the description read here tells which port is which), then check "Link down". Shutting the unused ports works too: they then read disabled, never down.

The collector only reads: SNMP sends nothing but reads.

Prerequisites

• The SNMP agent of the device enabled, reachable from the poller (UDP 161), its access restricted to the poller.
• The view granted to the poller includes interfaces (.1.3.6.1.2.1.2), ifXTable (.1.3.6.1.2.1.31), ipAddrTable (.1.3.6.1.2.1.4.20) and sysUpTime (.1.3.6.1.2.1.1.3); dot3StatsTable (.1.3.6.1.2.1.10.7.2) for the duplex. Most devices grant all of it to a read-only community or user.
• Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

Outputs

Watches

Limits

• A link that flaps between two runs is seen only through link-changed, from the time in its state; IF-MIB counts no changes.
• sysUpTime wraps after 497 days: until the agent restarts, the time in its state of an interface that changed before the wrap is not returned.
• Without EtherLike-MIB, the duplex is not returned. Only IPv4 addresses are counted: ipAddrTable lists IPv4 only.
• An interface renamed is a new instance, and the former one goes missing.