banshee/windows-collection/windows/snmp/interfaces

Network interfaces of a Windows, by SNMP

Returns, for each network interface of a Windows, the state of its link, its negotiated speed, its MTU, its traffic in each direction and as a share of its speed, its packets, errors and drops, and the number of its IPv4 addresses. Eleven watches are proposed, each one set on the probe.

How it works

The collector reads, indexed by ifIndex:

in IF-MIB, the table ifTable: ifDescr (1.3.6.1.2.1.2.2.1.2, the name Windows gives the card), ifMtu (.4), ifAdminStatus (.7), ifOperStatus (.8), ifInDiscards (.13), ifInErrors (.14), ifOutDiscards (.19), ifOutErrors (.20);
in IF-MIB, the table ifXTable: the 64-bit counters of octets (1.3.6.1.2.1.31.1.1.1.6 in, .10 out) and of unicast, multicast and broadcast packets (.7 to .9 in, .11 to .13 out), and ifHighSpeed (.15, in Mbit/s);
in IP-MIB, the table ipAddrTable: ipAdEntIfIndex (1.3.6.1.2.1.4.20.1.2), the interface that holds each IPv4 address.

Then, for each interface:

Its name is ifDescr. Two cards of the same name each keep their own: the second carries its ifIndex (Intel(R) Ethernet #12).
The state of the link is ifOperStatus in words: up, down, testing, unknown, dormant, notpresent, lowerlayerdown. An interface disabled by the administrator (ifAdminStatus 2) is said disabled, so that it does not pass for a link down.
The negotiated speed is ifHighSpeed; an interface that is down has none (0), and returns none.
The traffic, the packets, the errors and the drops are rates per second of the counters, from this run and the previous one, in and out added together for the packets, errors and drops. They come from the second run on: at the first run there is no earlier reading, and they are not returned; nor are they for an interface without 64-bit counters. The state, the speed, the MTU and the addresses come at once.
The usage is the traffic of a direction over the negotiated speed; it is returned only when the speed is known.
The share of packets dropped is the drops over the packets and drops together.
The errors are judged by the collector itself (watch "Errors"): a warning when the errors per minute pass the set number, a critical when the errors pass the set share of the traffic.

The default selection leaves out the software interfaces of Windows, which carry no traffic of their own or repeat that of the card they filter: the loopback (Software Loopback Interface*), the WAN Miniport*, the tunnels (Microsoft ISATAP Adapter*, Teredo Tunneling*, Microsoft 6to4 Adapter*, Microsoft IP-HTTPS*), Microsoft Kernel Debug Network Adapter*, and the filters of the network stack (*-WFP Native MAC Layer LightWeight Filter-*, *-WFP 802.3 MAC Layer LightWeight Filter-*, *-QoS Packet Scheduler-*, *-Npcap Packet Driver*, *-Virtual WiFi Filter Driver-*, *-Native WiFi Filter Driver-*). The selection is changed on the probe.

Nothing is written to the Windows: SNMP reads only.

Prerequisites

The SNMP service of Windows, installed and started: - on Windows Server, the feature "SNMP Service" (Server Manager, Add Roles and Features; or Install-WindowsFeature SNMP-Service in PowerShell); - on Windows 10 and 11, the optional feature "Simple Network Management Protocol (SNMP)" (Settings, Optional features; or Add-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0 in PowerShell).
In the properties of the service "SNMP Service", tab Security: - a community with the right READ ONLY, which banshee reads in protocol:snmp:v2c:community; - under "Accept SNMP packets from these hosts", the address of the poller.
SNMPv3: the SNMP agent of Windows does not offer it; protocol:snmp:version stays v2c. The community then travels in clear text: keep it read-only and accepted from the poller alone.
The Windows firewall open to the poller on UDP 161 (the rule "SNMP Service (UDP In)").

Outputs

Every output is per interface.

Name	Label	Unit	Per instance
`link`	Link state	—	yes, per interface
`speed`	Negotiated speed	Mbit/s	yes, per interface
`mtu`	MTU	—	yes, per interface
`traffic-in`	Inbound traffic	bit/s	yes, per interface
`traffic-out`	Outbound traffic	bit/s	yes, per interface
`traffic`	Total traffic	bit/s	yes, per interface
`in-percent`	Inbound usage	%	yes, per interface
`out-percent`	Outbound usage	%	yes, per interface
`packets`	Packets	packets/s	yes, per interface
`errors`	Errors	errors/s	yes, per interface
`drops`	Drops	packets/s	yes, per interface
`drop-percent`	Share of packets dropped	%	yes, per interface
`addresses`	IPv4 addresses	—	yes, per interface

Watches

Name	Title	Kind	Defaults	Checked by default
`link-down`	Link down	state to avoid, on `link`	critical on `down` and `lowerlayerdown`; no warning	yes
`speed-degraded`	Negotiated speed degraded	judged by the collector	warning when the negotiated speed is below the expected speed, 1000 Mbit/s	no
`saturation-in`	Inbound saturation	above a threshold, on `in-percent`	warning above 70 %, critical above 90 %, for 5 min	yes
`saturation-out`	Outbound saturation	above a threshold, on `out-percent`	warning above 70 %, critical above 90 %, for 5 min	yes
`errors`	Errors	judged by the collector	warning above 1 error per minute; critical above 0.1 % of the traffic	yes
`drops`	Packets dropped	above a threshold, on `drop-percent`	warning above 0.5 %, critical above 2 %	yes
`traffic-unusual`	Unusual traffic	off its habit, on `traffic`	normal sensitivity, never under 10,000,000 bit/s (10 Mbit/s)	no
`mute`	Silent interface	no activity, on `packets`	warning after 10 min at zero packets; no critical	no
`missing`	Interface missing	expected instances, on `link`	no interface named: it raises nothing until names are set on the probe	no
`mtu`	Unexpected MTU	expected value, on `mtu`	warning when the MTU is anything but 1500; no critical	no
`no-address`	No IPv4 address left	below a threshold, on `addresses`	critical below 1; no warning	no

"Unusual traffic" needs the history of the measure: until the poller has learnt it, the watch says it is learning and raises nothing.

Limits

The SNMP agent of Windows serves neither the duplex nor the changes of a link: a link that flaps between two runs is not seen.
Only IPv4 addresses are counted: ipAddrTable does not hold the IPv6 ones.
The name of an interface is the one Windows gives the card, and can change with its driver: an interface renamed is a new instance, and the former one goes missing.
An interface without 64-bit counters returns neither traffic, nor packets, nor errors, nor drops.