Sometimes it is possible that a network interface graph shows a speed, higher than physically possible. This article explains how that can happen.
Overview
Monitoring network interface throughput is typically done counter based. This is due to the fact, that SNMP implementations and classical operating systems start counters at zero on boot and increase these counters for every bit or packet sent or received. For a monitoring solution to be able to actually monitor throughput, it needs to collect two samples at different points in time and calculate the difference between them. By doing this, they get quite accurate readings, but this logic can fail for different reasons. Read on to find out about these reasons.
Reason
There are two main possible reasons: Timing issues or counter overflows.
Timing issues
As the calculation of interface speed needs data at two points in time, timing is of the essence. Consider an SNMP device being under heavy load and failing to respond in a timely manner. This can lead to both decreased in increased throughput, depending on the exact scenario.
Counter overflows
The OIDs that are being queried for interface throughput calculation can be 32-bit or 64-bit. While it is more likely for a 32-bit counter to overflow, 64-bit counters can also overflow. The result of such an overflow is with utmost certainty a off throughput calculation.
Related articles