ScreenOS 6.3.x - SNMP SubInterface Statistics - IF-MIB

[routenull0]

With the rollout of ScreenOS 6.3.x, Juniper made changes to incorporate subinterfaces into the SNMP information, per the KB:
https://kb.juniper.net/InfoCenter/index ... id=KB22257

Code: Select all

Solution:
The code in 6.3 has implemented certain changes, which allows the monitoring of sub-interfaces via RFC MIB’s. The changes are as follows:

In 6.3 firmware version, sub-interfaces are added to the IfTable (with OID 1.3.6.1.2.1.2.2) of the IF-MIB RFC MIB. Within ifTable, the sub interface information is displayed shown on all the OID's from OID .1.3.6.1.2.1.2.2.1.1 to OID .1.3.6.1.2.1.2.2.1.22. IfTable contains the following OID's:

    IfIndex 1.3.6.1.2.1.2.2.1.1
    IfDescr 1.3.6.1.2.1.2.2.1.2
    IfType 1.3.6.1.2.1.2.2.1.3
    IfMtu 1.3.6.1.2.1.2.2.1.4
    IfSpeed 1.3.6.1.2.1.2.2.1.5
    IfPhysAddress 1.3.6.1.2.1.2.2.1.6
    IfAdminStatus 1.3.6.1.2.1.2.2.1.7
    IfOperStatus 1.3.6.1.2.1.2.2.1.8
    IfLastChange 1.3.6.1.2.1.2.2.1.9
    IfInOctets 1.3.6.1.2.1.2.2.1.10
    IfInUcastPkts 1.3.6.1.2.1.2.2.1.11
    IfInNUcastPkts 1.3.6.1.2.1.2.2.1.12
    IfInDiscards 1.3.6.1.2.1.2.2.1.13
    IfInErrors 1.3.6.1.2.1.2.2.1.14
    IfInUknownProtos1.3.6.1.2.1.2.2.1.15
    IfOutOctets 1.3.6.1.2.1.2.2.1.16
    IfOutUcasePkts 1.3.6.1.2.1.2.2.1.17
    IfOutNUcasePkts 1.3.6.1.2.1.2.2.1.18
    IfInDiscards 1.3.6.1.2.1.2.2.1.19
    IfInErrors 1.3.6.1.2.1.2.2.1.20
    IfOutQlen 1.3.6.1.2.1.2.2.1.21
    IfSpecific 1.3.6.1.2.1.2.2.1.22

Note: The 'IF-MIB' RFC MIB will not display any information about the IP address configuration for the interfaces. To obtain the above OID's, along with the IP address related information, use the 'RFC1213-MIB' RFC MIB.

In RFC1213-MIB, you can check the IP address related features for all the interfaces, including sub-interfaces. This information is added to the ipAddrTable OID .1.3.6.1.2.1.4.20. It covers OID .1.3.6.1.2.1.4.20.1 to OID .1.3.6.1.2.1.4.20.5 and provides information on all IP related configuration of interfaces.

This is valid when I walk the device:

Code: Select all

192.168.33.3 .1.3.6.1.2.1.2.2
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.2 = INTEGER: 2
IF-MIB::ifIndex.3 = INTEGER: 3
IF-MIB::ifIndex.4 = INTEGER: 4
IF-MIB::ifIndex.5 = INTEGER: 5
IF-MIB::ifIndex.6 = INTEGER: 6
IF-MIB::ifIndex.7 = INTEGER: 7
IF-MIB::ifIndex.8 = INTEGER: 8
IF-MIB::ifIndex.9 = INTEGER: 9
IF-MIB::ifIndex.10 = INTEGER: 10
IF-MIB::ifIndex.11 = INTEGER: 11
IF-MIB::ifIndex.12 = INTEGER: 12
IF-MIB::ifIndex.13 = INTEGER: 13
IF-MIB::ifIndex.14 = INTEGER: 14
IF-MIB::ifIndex.15 = INTEGER: 15
IF-MIB::ifIndex.16 = INTEGER: 16
IF-MIB::ifIndex.17 = INTEGER: 17
IF-MIB::ifIndex.18 = INTEGER: 18
IF-MIB::ifIndex.19 = INTEGER: 19
IF-MIB::ifIndex.20 = INTEGER: 20
IF-MIB::ifDescr.1 = STRING: ethernet0/0
IF-MIB::ifDescr.2 = STRING: ethernet0/1
IF-MIB::ifDescr.3 = STRING: ethernet0/1.20
IF-MIB::ifDescr.4 = STRING: ethernet0/1.55
IF-MIB::ifDescr.5 = STRING: ethernet0/2
IF-MIB::ifDescr.6 = STRING: Management
IF-MIB::ifDescr.7 = STRING: ethernet6/0
IF-MIB::ifDescr.8 = STRING: ethernet6/0.11
IF-MIB::ifDescr.9 = STRING: ethernet6/0.50
IF-MIB::ifDescr.10 = STRING: ethernet6/1
IF-MIB::ifDescr.11 = STRING: ethernet6/2
IF-MIB::ifDescr.12 = STRING: ethernet6/3
IF-MIB::ifDescr.13 = STRING: ethernet6/4
IF-MIB::ifDescr.14 = STRING: ethernet6/5
IF-MIB::ifDescr.15 = STRING: ethernet6/6
IF-MIB::ifDescr.16 = STRING: ethernet6/7
IF-MIB::ifDescr.17 = STRING: tunnel.1
IF-MIB::ifDescr.18 = STRING: tunnel.3
IF-MIB::ifDescr.19 = STRING: tunnel.5
IF-MIB::ifDescr.20 = STRING: vlan1

Even ifHCInOctets is different for each index:

Code: Select all

192.168.33.3 .1.3.6.1.2.1.31.1.1.1.6
IF-MIB::ifHCInOctets.1 = Counter64: 713632478516
IF-MIB::ifHCInOctets.2 = Counter64: 438505354313
IF-MIB::ifHCInOctets.3 = Counter64: 438505355083
IF-MIB::ifHCInOctets.4 = Counter64: 438505358147
IF-MIB::ifHCInOctets.5 = Counter64: 573526738006
IF-MIB::ifHCInOctets.6 = Counter64: 10369589459
IF-MIB::ifHCInOctets.7 = Counter64: 346728217
IF-MIB::ifHCInOctets.8 = Counter64: 346728217
IF-MIB::ifHCInOctets.9 = Counter64: 346728217
IF-MIB::ifHCInOctets.10 = Counter64: 0
IF-MIB::ifHCInOctets.11 = Counter64: 0
IF-MIB::ifHCInOctets.12 = Counter64: 0
IF-MIB::ifHCInOctets.13 = Counter64: 0
IF-MIB::ifHCInOctets.14 = Counter64: 0
IF-MIB::ifHCInOctets.15 = Counter64: 0
IF-MIB::ifHCInOctets.16 = Counter64: 82086432
IF-MIB::ifHCInOctets.17 = Counter64: 0
IF-MIB::ifHCInOctets.18 = Counter64: 0
IF-MIB::ifHCInOctets.19 = Counter64: 0
IF-MIB::ifHCInOctets.20 = Counter64: 0

However, when I setup graphing, for ethernet0/1 - ethernet0/1.20 - ethernet0/1.55, all the graph values are the same:


The host is configured as a Generic SNMP Host, with the interface stats data query being SNMP - Interface Statistics.

Could this be a problem in the SNMP - Interface Statistics XML file?

[routenull0]

Doing some more digging, and it looks like the poller is looking at the correct OIDs, but getting the wrong value..

Code: Select all

09/08/2015 06:04:03 PM - SPINE: Poller[0] Host[39] TH[1] DS[1466] SNMP: v3: FIREWALL1, dsname: traffic_in_1min, oid: .1.3.6.1.2.1.31.1.1.1.6.2, value: 439592241445
09/08/2015 06:04:03 PM - SPINE: Poller[0] Host[39] TH[1] DS[1466] SNMP: v3: FIREWALL1, dsname: traffic_out_1min, oid: .1.3.6.1.2.1.31.1.1.1.10.2, value: 986418300393
09/08/2015 06:04:03 PM - SPINE: Poller[0] Host[39] TH[1] DS[1467] SNMP: v3: FIREWALL1, dsname: traffic_in_1min, oid: .1.3.6.1.2.1.31.1.1.1.6.3, value: 439592241445
09/08/2015 06:04:03 PM - SPINE: Poller[0] Host[39] TH[1] DS[1467] SNMP: v3: FIREWALL1, dsname: traffic_out_1min, oid: .1.3.6.1.2.1.31.1.1.1.10.3, value: 986418300393
09/08/2015 06:04:03 PM - SPINE: Poller[0] Host[39] TH[1] DS[1468] SNMP: v3: FIREWALL1, dsname: traffic_in_1min, oid: .1.3.6.1.2.1.31.1.1.1.6.4, value: 439592241445
09/08/2015 06:04:03 PM - SPINE: Poller[0] Host[39] TH[1] DS[1468] SNMP: v3: FIREWALL1, dsname: traffic_out_1min, oid: .1.3.6.1.2.1.31.1.1.1.10.4, value: 986418300393

Compared to actually looking at them

Code: Select all

192.168.33.3 .1.3.6.1.2.1.31.1.1.1.6.2
.1.3.6.1.2.1.31.1.1.1.6.2 = Counter64: 439637478858
192.168.33.3 .1.3.6.1.2.1.31.1.1.1.10.2
.1.3.6.1.2.1.31.1.1.1.10.2 = Counter64: 986674808481
.1.3.6.1.2.1.31.1.1.1.6.3
.1.3.6.1.2.1.31.1.1.1.6.3 = Counter64: 439670637588
192.168.33.3 .1.3.6.1.2.1.31.1.1.1.10.3
.1.3.6.1.2.1.31.1.1.1.10.3 = Counter64: 986856340719

[routenull0]

Poking around, I found this thread:
http://forums.cacti.net/viewtopic.php?f ... 6&start=15

I set the max oid's on the host to 1 and noticed different values on each polling.

Code: Select all

./spine -v
SPINE 0.8.8b  Copyright 2002-2013 by The Cacti Group

I'll grab SPINE 0.8.8f and see if there is any difference.

[routenull0]

Updating to SPINE 0.8.8f didn't result in any change

Setting Max OID's on the host to 1 does appear to generate a small amount in the value differences, they aren't exactly the same when cacti polls, but they are still completely different than manually polling at the same time.