PPP / PPPoE User Traffic Graphs

[jpingle]

We already monitor the number of PPPoE sessions on our access servers, but in some cases we need more detail.

Has anyone figured out a way to graph a particular user's bandwidth usage? Cisco lists MIBs for getting users and other information (Supposed to be at OID .1.3.6.1.4.1.9.10.19.1.3.1.1.3) but that does not work on any of our routers/access servers.

We can graph the individual Virtual Interfaces, but their dynamic nature makes that impractical, and it's also impractical to tie that data to a particular user. It would be great if we could make a graph for a user "bob" and a script could figure out which interface he's on and graph his traffic, keeping it all straight.

I'm going to keep digging, see if I can find a way, but if anyone else has already figured this out I didn't want to reinvent the wheel.

If there aren't any replies, I'll try to share what I find, if anything.

Thanks!

[vanc]

Hi jpingle,

I like what you are asking about but unfortunately am unable to provide any help but would be very interested in what you come up with. We have a linux box that I would be very interesting in graphing users ppp usage, by usage.

As I write I am thinking a bit... we provide virtual IP's to each user that logs in via PPPoE and may be able to use the correlation between user's and their virtual IP's and graph usage based on that.

I am not sure of how the Cisco PPP works, ie virtual IP etc.

Please post when if you find something.

Thanks

[jpingle]

While I haven't made any progress in figuring out how to use this to aid traffic graphing, I have found some SNMP queries that will get logged in users:

Code: Select all

snmpwalk -On -v 2c -c public NASIP 1.3.6.1.4.1.9.10.24.1.3.2.1.2.2 

That will get a list of current usernames, such as:

Code: Select all

.1.3.6.1.4.1.9.10.24.1.3.2.1.2.2.3215.2578 = STRING: "user@yourdomain.com"

The last three digits of the OIDs returned are a unique identifier allowing you to get the interface id # like so:

Code: Select all

snmpget -Oqv -v 2c -c public NASIP 1.3.6.1.4.1.9.10.24.1.3.2.1.11.2.3215.2578

Which returns an integer corresponding to the dynamically assigned interface number. (In this case, 81)

So that's how a username can be translated into an Interface number, but I currently don't have the time to investigate how to work that into a graphing data setup.

As an aside, I discovered all this when trying to figure out how to kick off a vpdn user via snmp, if needed. That can be done as follows (using the Interface number from the last example, 81):

Code: Select all

snmpset -v2c -c private NASIP 1.3.6.1.2.1.2.2.1.7.81 i 2

[jpingle]

I finally had some time to dig into this and I've had some success in getting graphing results based on username.

I'm still testing what I've got so far, but it ended up being a script and a whole set of templates and such.

There's probably a better way to accomplish it, so comments are welcome.

I especially don't like the fact that there's no real way to automatically generate the graph and data source names (that I know of) so I end up copying and pasting the username in all three fields (one for the username, and the data source and graph names).

Attached is the graph template, script, etc. Let me know if it works or if there are any problems...

I know there is at least one bug: Sometimes, when a graph is created, it takes the Interface counter as the first amount of traffic instead of the baseline. Not sure why or how to fix it. I suppose with proper interface max values, it wouldn't be an issue, but it's only a minor annoyance.

[jpingle]

Unfortunately I seem to have hit a roadblock. Every time a user signs off/on, they get a different Interface, and its SNMP ifInOctets/ifOutOctets are way different than the previous one, and so the graph spikes.

Unfortunately, there is no way to reset the interface counters so I'm not sure how best to solve this one. Using the maximum values for an interface only goes so far to fix it, but it's probably the best way to handle it I guess.

[abdulcc]

Hello Jim

I am not very good at scripting so I was wondering if I should
replace the following fields with

ROUTER=$1 (here router ip address after$)
ROCOMMUNITY=$2 (here router ro community$)
SNMPVERSION=$3 (here router community after$)
USERNAME=$4 (I dont know what to put in this field$)

The MIB below is for .1.3.6.1.2.1.2.2.1.2 a cisco 7200 router on which I can do the snmp query with success

Thanks

Please Help


#!/bin/sh
#
# Find a user's in/out traffic by username.
# Syntax:
# pppoetraffic.sh <router ip> <snmp community> <snmp version> <username>

ROUTER=$1
ROCOMMUNITY=$2
SNMPVERSION=$3
USERNAME=$4


SNMPWALK="/usr/bin/snmpwalk"
SNMPGET="/usr/bin/snmpget"

VPDNNUM=`$SNMPWALK -On -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER snmpwalk .1.3.6.1.2.1.2.2.1.2 | grep "\"$USERNAME\"" | cut -f1 -d'=' | sed 's/.1.3.6.1.2.1.2.2.1.2.//'`

if [ "$VPDNNUM" != "" ]
then
IFNUM=`$SNMPGET -Oqv -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER .1.3.6.1.2.1.2.2.1.2.$VPDNNUM`
else
IFNUM=0
fi

if [ "$IFNUM" = "0" ]
then
INOCTETS=0
OUTOCTETS=0
else
INOCTETS=`$SNMPGET -Oqv -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER ifInOctets.$IFNUM`
OUTOCTETS=`$SNMPGET -Oqv -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER ifOutOctets.$IFNUM`
fi

echo "in_traffic:$INOCTETS out_traffic:$OUTOCTETS"

[abdulcc]

By the way my query on the router returns the following I am guessing maybe the scripts needs to be modified for the virtual access field

.1.3.6.1.2.1.2.2.1.2.332 = STRING: Virtual-Access2.318
.1.3.6.1.2.1.2.2.1.2.333 = STRING: Virtual-Access2.319
.1.3.6.1.2.1.2.2.1.2.334 = STRING: Virtual-Access2.320
.1.3.6.1.2.1.2.2.1.2.335 = STRING: Virtual-Access2.321
.1.3.6.1.2.1.2.2.1.2.336 = STRING: Virtual-Access2.322
.1.3.6.1.2.1.2.2.1.2.337 = STRING: Virtual-Access2.323
.1.3.6.1.2.1.2.2.1.2.338 = STRING: Virtual-Access2.324
.1.3.6.1.2.1.2.2.1.2.339 = STRING: Virtual-Access2.325
.1.3.6.1.2.1.2.2.1.2.340 = STRING: Virtual-Access2.326
.1.3.6.1.2.1.2.2.1.2.341 = STRING: Virtual-Access2.327
.1.3.6.1.2.1.2.2.1.2.342 = STRING: Virtual-Access2.328
.1.3.6.1.2.1.2.2.1.2.343 = STRING: Virtual-Access2.329
.1.3.6.1.2.1.2.2.1.2.344 = STRING: Virtual-Access2.330
.1.3.6.1.2.1.2.2.1.2.345 = STRING: Virtual-Access2.331
.1.3.6.1.2.1.2.2.1.2.346 = STRING: Virtual-Access2.332

[jpingle]

The script will only do one username at a time, not every username.

The fields requested in the script are passed by Cacti and are specified in the data source definition. You shouldn't have to edit the script.

ROUTER=$1 (here router ip address after$)
ROCOMMUNITY=$2 (here router ro community$)
SNMPVERSION=$3 (here router community after$)
USERNAME=$4 (I dont know what to put in this field$)

The USERNAME field is the actual username of the person you're creating the graph for. For testing at the command line you could just run it like so:

Code: Select all

./pppoetraffic.sh 1.2.3.4 public 2c myuser@mydomain.com

And it will search through the logged in users to find that user's interface and return that user's input and output traffic.

I'm not sure about the VirtualAccess field. On my router (2610), it returns all numbers. Unfortunately I don't have a 7200 to test against so I'm not sure what's going on there. The OID should be the same as what I'm using, but again I'm not sure. You might try going through each step of my earlier post and showing the output when you try those OIDs. (Be sure to remove anything sensitive/private from the output, of course)

Jim

[abdulcc]

snmpwalk -On -v 2c -c public 1.2.3.4 .1.3.6.1.2.1.2.2.1.2

will return th following

.1.3.6.1.2.1.2.2.1.2.354 = STRING: Virtual-Access2.340
.1.3.6.1.2.1.2.2.1.2.356 = STRING: Virtual-Access2.342
.1.3.6.1.2.1.2.2.1.2.357 = STRING: Virtual-Access2.343
.1.3.6.1.2.1.2.2.1.2.359 = STRING: Virtual-Access2.345
.1.3.6.1.2.1.2.2.1.2.360 = STRING: Virtual-Access2.346
.1.3.6.1.2.1.2.2.1.2.363 = STRING: Virtual-Access2.349
.1.3.6.1.2.1.2.2.1.2.364 = STRING: Virtual-Access2.350
.1.3.6.1.2.1.2.2.1.2.368 = STRING: Virtual-Access2.354
.1.3.6.1.2.1.2.2.1.2.369 = STRING: Virtual-Access2.355
.1.3.6.1.2.1.2.2.1.2.372 = STRING: Virtual-Access2.358
.1.3.6.1.2.1.2.2.1.2.373 = STRING: Virtual-Access2.359
.1.3.6.1.2.1.2.2.1.2.377 = STRING: Virtual-Access2.363
.1.3.6.1.2.1.2.2.1.2.379 = STRING: Virtual-Access2.365
.1.3.6.1.2.1.2.2.1.2.380 = STRING: Virtual-Access2.366
.1.3.6.1.2.1.2.2.1.2.384 = STRING: Virtual-Access2.370

This means that there are 370 PPOE users connected on the router at that time. How would I create a script that would count and return that text string so that it can be graphed

Thanks

[jpingle]

I'm still not sure you're looking at the proper OID. When I try your OID on my router, I do get a listing like you get. However, it is only a list of the active Virtual-Access interfaces, which is not an accurate count of the number of logged in users, and there's no easy way to use that to get the information needed for the script I posted.

If you're only looking for a count of signed on pppoe/vpdn users, use this OID:
.1.3.6.1.4.1.9.10.24.1.1.4.1.3.2

What I was wanting you to try, if you're looking for individual traffic graphs, is to step through this. This example assumes you are trying to make a traffic graph for the user someone@myisp.com:
">>>" Is something you type. The other lines are what you should see

Code: Select all

>>> snmpwalk -On -v 2c -c public 1.2.3.4 1.3.6.1.4.1.9.10.24.1.3.2.1.2.2
...bunch of lines...
.1.3.6.1.4.1.9.10.24.1.3.2.1.2.2.27236.56150 = STRING: "someone@myisp.com"
...bunch of lines...

Note that the last three digits of the OID for the line that corresponds to the user you're looking for are what you stick at the end of this next line (i.e. 2.27236.56150):

Code: Select all

>>> snmpget -Oqv -v 2c -c public 1.2.3.4 1.3.6.1.4.1.9.10.24.1.3.2.1.11.2.27236.56150
52
>>> snmpget -Oqv -v 2c -c public 1.2.3.4 ifInOctets.52                                 
499859064
>>> snmpget -Oqv -v 2c -c public 1.2.3.4 ifOutOctets.52  
2773751328
>>> snmpget -Oqv -v 2c -c public 1.2.3.4 ifName.52         
Vi22

You should get something similar to what I put for the output. If not, then there may be some differences in your router. If so, then the script should have worked.

Jim

[abdulcc]

snmpwalk -On -v 2c -c public 1.2.3.4 .1.3.6.1.2.1.2.2.1.2


If you're only looking for a count of signed on pppoe/vpdn users, use this OID:
.1.3.6.1.4.1.9.10.24.1.1.4.1.3.2

This Oid does not work on my routers

How would I put a script that allows me to count the number of vpdn users every 5 minutes?

[jpingle]

You don't need to make a script, just use the built-in "SNMP - Generic OID Template" in Cacti. When you create the graph under the host, you'll have a place to type in the OID to query, just enter it and give it a description (i.e. "PPPoE Users currently logged in".)

[abdulcc]

and it returns the numbers of pppoe users connected

snmpwalk -v 2c -c public 10.18.2.5 1.3.6.1.4.1.9.9.194.1.1.1
SNMPv2-SMI::enterprises.9.9.194.1.1.1.0 = Gauge32: 329


You don't need to make a script, just use the built-in "SNMP - Generic OID Template" in Cacti. When you create the graph under the host, you'll have a place to type in the OID to query, just enter it and give it a description (i.e. "PPPoE Users currently logged in".)

I did as you suggested, For the moment the graph is created with no data
I dont know if you have any other suggestions

I dont get why its not being graphed as the poller cache shows

Data Source: BAMAKO5 - Current PPPOE users
RRD: /var/www/cacti/rra/bamako5_snmp_oid_193.rrd
Action: 0, OID: 1.3.6.1.4.1.9.9.194.1.1.1 (Host: 10.18.2.5, Community: public)


In my log file I get
M - CMDPHP: Poller[0] Host[20] DS[194] SNMP: v2: 10.18.2.5, dsname: snmp_oid, oid: 1.3.6.1.4.1.9.9.194.1.1.1, output: U

[abdulcc]

For some reason I polled the device and used the

snmpwalk -On -v 2c -c public 1.2.3.4 .1.3.6.1.4.1.9.9.194.1.1.
.1.3.6.1.4.1.9.9.194.1.1.1.0 = Gauge32: 301

Then I used the oid it returned
.1.3.6.1.4.1.9.9.194.1.1.1.0

Its graphing and returning data sources

Thank you

[dsmooth]

...

Code: Select all

snmpwalk -On -v 2c -c public NASIP 1.3.6.1.4.1.9.10.24.1.3.2.1.2.2 

That will get a list of current usernames, such as:

Code: Select all

.1.3.6.1.4.1.9.10.24.1.3.2.1.2.2.3215.2578 = STRING: "user@yourdomain.com"

...
Try as I might, I am unable to pull a list of userids from a Cisco 7200. Does anyone know the appropriate OID?