Network interface monitoring in NetCrunch
There is more to Interface monitoring than just IN/OUT traffic examination. This article describes how NetCrunch handles monitoring of High Speed interfaces using 64-bit counters, and how to understand the speed of the interfaces.
High Speed interfaces
Nowadays, most modern networking devices are using interfaces faster than 1GBps. That's why network monitoring software such as NetCrunch needs to use different sets of rules to determine I/O Traffic and the interface speed itself.
Most common problem of 10GBps interfaces is the fact, that interface speed values might be higher than 32-bit integer (2^32). Standard counters used in SNMP monitoring aren't able to display a value larger than [2^32], which leads to incorrect data being displayed in the monitoring software.
To solve this problem, modern devices are using additional MIB (OID: 1.3.6.1.2.1.31.1.1) called ifMIB. Such MIB contains table ifXTable where X stands for extended.
NetCrunch can use this table to automatically display proper (traffic or speed) values of the devices that utilize this feature.
Everything presented in this article can be checked on your own. Please use NetCrunch IP & SNMP tools to do that.
SNMP Counters
Default 32-bit interface counters are located in the table (OID:1.3.6.1.2.1.2.2). Screen below shows actual speed of these interfaces. However, 6th interface has different value. This is because it's a 10Gbps interface, and value presented is the maximum 32-bit integer. If NetCrunch used that value - speed of the interface would be incorrect.
Extended interface counters can be found in the table (OID: 1.3.6.1.2.1.31.1.1). Screen below shows the value which needs to be multiplied by 1,000,000 in order to show the proper value. This is precisely because values displayed in this table are presented as units of 1,000,000 bps (bits per second). Since a 64-bit integer can be used to store such data, it is possible to save and display this data in NetCrunch.
Firmware and device problems related to High Speed interfaces
Some devices are not supporting ifMIB (64-bit counters) and they even have wrong information provided in its SNMP standard 32-bit counters. According to the description of these interfaces - they are in fact 10Gbps, but screenshot below shows that "10" is written in the table instead of the max available number which could provide a hint that this might be an interface of speed beyond 1Gbps. This will result in the wrong data being displayed in NetCrunch (for such configuration it will be 10bps). There is not much that can be done about it, since it can't be calculated effectively.
Effective speed of the interface
While maximum bandwidth of the interface can be shown as 10GBps - it's not always the actual one, as everything depends on what is connected to the other side. For instance: If we connect 100Mbps network adapter of a regular PC to the 10Gbps interface - the actual utilization of the interface may always be shown as 1% when the PC network adapter works at its max bandwidth. Keep this in mind when connecting PCs to a networking device.
