Manual adjustment of traffic values

[wirespot]

For some reason, my hardware broadband router is always doing about 9 or 10 KB/s worth of conversation with my modem cable. That's why I have a ~10 KB "blanket" on my traffic graph at all times, even when I'm not using the Internet connection at all.

I'm using SNMP to query the traffic_in and traffic_out thingies on the router. I'm new to Cacti and SNMP.

Question: is it possible to manually adjust the IN values I'm getting and decrease them with that respective amount?

[wirespot]

Anybody? I'm sorry if this is something obvious, as I said, I'm new to Cacti & co.

So, is there any way to "mangle" the data and subtract a certain constant value?

[BSOD2600]

You sure you're not monitoring the LAN side of the cable modem and not the WAN? 10KB sure it a lot.... heh, you sure there isn't someone else (like on wireless) who isnt using your connection?

[wirespot]

It's not a wireless modem so that's out of the question.

I'm not sure what to say about the WAN interface. I'm using a Data Source that was predefined in Cacti, called "Router - Traffic - End of MIB/Ethernet-WAN". The graph template is "Interface - Traffic (bytes/sec, Total Bandwidth)". I look at the data source and I see it's based on custom data, index type = ifDescr, index value = Ethernet-WAN, and output type = in/out bits.

I'm going to attach the the snmpwalk output for the router, although I don't see other counters that would work better.

I did some SNMP queries by hand:

Code: Select all

snmpget -c public -v 2c router ifInOctets.1

I've read the result at 1 second intervals and displayed the difference. Indeed, it shows positive values ranging from 4 KB to 13 KB.

The outgoing counter, however, seems to show the proper data, and it stays on zero when not using the connection.

[BSOD2600]

Ah, well then it could be very possible that you have ~10KB if incoming data to you router all the time. That does seem like quite a bit though. You happen to be on a cable modem?

Looking at my parents house who has cable, where there are 3 computers connected to the internet, MRTG reports 3557.0 B/s in and 308.0 B/s out, most of the time.

[gandalf]

That's it. In your example, you're querying your router from "inside" your network, as BSOD200 stated, from the LAN side. But as you are asking the router to give you all the counters you do create some traffic, well? That is the snmp traffic between you cacti host and the router, eh? At the very same time, the routers WAN side (the one the the internet) may be doing nothing. So you have a look at ALL the router's interfaces to get info about outbound (internet) traffic. If this is e.g an ATM port, you'll need to query the ATM OIDs, Ethernet will not do.
Reinhard

[wirespot]

BSOD2600: yes, it's a cable connection and a cable modem. What you're saying seems to suggest the modem is doing some kind of conversation with the router at all times. So unless I convince the router to give me SNMP values without that conversation included, there's nothing that Cacti can do, since the amount of conversation is not even constant.

lvm: The traffic I'm seeing is constant and in too big amounts for it to be created by my own queries. As previous posters have said, 10 KB is quite a lot. Besides, I run the Cacti collector only once a minute, yet I see traffic every second.

How would I go about querying all/other router interfaces? I've posted the full snmpwalk above, is that not all that I can get from the router? Is there mode information, hidden?

Will simply using the public address to query the router as opposed to the private (LAN) address give me different results? Or do I have to craft a special query?

L.E.: I tried the public IP and still got the same info. I've also read some SNMP docs about the format for SNMPv2-MIB and IF-MIB and from what I gather (see the above dump) this router only has one interface.

[gandalf]

How would I go about querying all/other router interfaces? I've posted the full snmpwalk above, is that not all that I can get from the router? Is there mode information, hidden?

That depends. My DSL Router at home, for instance, does not report its WAN interfaces (with current firmware). But obviously, there is a WAN interface . I have asked for updated firmware to report about that interface.
But I suppose that BSOD2000 is more familiar with the kind of device you're treating with. Suppose he'll be giving best advice to you
Reinhard

[BSOD2600]

Would you post the interface list as cacti sees it?

You can see from my examples that each device should report a WAN and LAN side. You do realize that on a cable modem network, you share all traffic with everyone thats on the same headend as you, basically turning your neighbors into large LAN (albiet only on the cable modems IP range, which is not your public one). I still find it hard to belive that you've got 10KB of 'idle traffic' on the WAN side of the cable modem... but I suppose it's possible.

[wirespot]

Would you post the interface list as cacti sees it?

Sure, if you can tell me where to find a screen similar to what you posted. I've been all over Cacti and I can't seem to find it.

I still find it hard to belive that you've got 10KB of 'idle traffic' on the WAN side of the cable modem... but I suppose it's possible.

Make that even higher... The highest I've seen was 18 KB.

[BSOD2600]

In a device, click on 'create graphs for device'. Assuming you have the snmp - interface associated data query active, you should see a list of interfaces.

[wirespot]

Ah, got it. Here's what came out. I'm afraid it only has one interface, after all.

Well, doesn't look like I can do much more about it. If the modem insists on talking to it, and there isn't a separate interface to filter on, that pretty much closes it up.

So, now back to my original question. The Cacti stats show an average of about 10.3 KB during actual idle times. Can I subtract 10 KB out of all readouts (without going into negative, of course), and take my chances with what goes over? It's bound to be more realistic than what I get now.

[BSOD2600]

Yes it is possible. You'll want to use a CDEF in the graph template... how exactly it's done I'm not sure since I don't play around with those often. lvm or others will probably know...

[gandalf]

Yes it is possible. You'll want to use a CDEF in the graph template... how exactly it's done I'm not sure since I don't play around with those often. lvm or others will probably know...

Thank you for the flowers . Subtracting is easy to do; comparing to zero will work as well; just let me think about that CDEF for a moment.
wirespot: I'm kinda worried about your interface list. First, "End of MIB" should not show up. Second, neither ifSpeed is reported correct nor the IP@ of that interface. Can you please run snmpwalk against all interfaces and post the results:

Code: Select all

snmpwalk -c <your community string> -v 1 <your device name/IP> interface

to verify that cacti is reporting this correctly.
Reinhard

[wirespot]

I've posted a snmpwalk above:
http://forums.cacti.net/post-46296.html#46296

As I understand from the manual page, that means a query of MIB-2 by default. If I add "MIB-2" at the end of the line, as the interface, I get the same walk.

However, I can't seem to figure out any other interface OID to pass as an extra parameter (and apparently neither does Cacti). Anything I enter after the router IP produces one message: "End of MIB".

Any suggestion of good interface strings I could use?

And, are you sure it's even supposed to have more than one interface? Logically, I can understand the need for at least two, but why is it hiding them so well?