Network interface speed is higher than phyiscally possible

Owned by Dennis Ehmer
Last updated: Oct 03, 2024 by Matthew Hierholzer

Sometimes it is possible that a network interface graph shows a speed, higher than physically possible. This article explains how that can happen.

APPLICABLE TO ALL CHECKMK VERSIONS

Table of Contents

Overview

Monitoring network interface throughput is typically done counter based. This is due to the fact, that SNMP implementations and classical operating systems start counters at zero on boot and increase these counters for every bit or packet sent or received. For a monitoring solution to be able to actually monitor throughput, it needs to collect two samples at different points in time and calculate the difference between them. By doing this, they get quite accurate readings, but this logic can fail for different reasons. Read on to find out about these reasons.

Reason

There are two main possible reasons: Timing issues or counter overflows.

Timing issues

As the calculation of interface speed needs data at two points in time, timing is of the essence. Consider an SNMP device being under heavy load and failing to respond in a timely manner. This can lead to both decreased or increased throughput, depending on the exact scenario.

Counter overflows

The OIDs that are being queried for interface throughput calculation can be 32-bit or 64-bit. While it is more likely for a 32-bit counter to overflow, 64-bit counters can also overflow. The result of such an overflow is with utmost certainty an off throughput calculation.