Table of Contents

Overview

Monitoring network interface throughput is typically done counter based. This is due to the fact, that SNMP implementations and classical operating systems start counters at zero on boot and increase these counters for every bit or packet sent or received. For a monitoring solution to be able to actually monitor throughput, it needs to collect two samples at different points in time and calculate the difference between them. By doing this, they get quite accurate readings, but this logic can fail for different reasons. Read on to find out about these reasons.

Reason

There are two main possible reasons: Timing issues or counter overflows.

Timing issues

As the calculation of interface speed needs data at two points in time, timing is of the essence. Consider an SNMP device being under heavy load and failing to respond in a timely manner. This can lead to both decreased or increased throughput, depending on the exact scenario.

Counter overflows

The OIDs that are being queried for interface throughput calculation can be 32-bit or 64-bit. While it is more likely for a 32-bit counter to overflow, 64-bit counters can also overflow. The result of such an overflow is with utmost certainty an off throughput calculation.

Related articles

Page:

How-to rename fs_ Service to Filesystem
Page:

How-to work with HTTP(s) Iframes in Checkmk
Page:

How-to set graphical user interface (GUI) defaults
Page:

How-to enable Pretty-print configuration files
Page:

How-to customize graphs timeseries transformation percentile

Browser not supported