Network management software with high detailed traffic report

Sun Dec 5 22:45:59 UTC 2010

On Mon, Nov 22, 2010 at 8:02 AM, Brandon Ross <bross at pobox.com> wrote:
> On Mon, 22 Nov 2010, Nick Hilliard wrote:
> least once a second.  Perhaps you are thinking about the rate counters that
> are often _configured_ to use the last 30 seconds of data to compute the
> average but also update much more often than every 30 seconds (and default
> to a 5 minute average).

Show interface rate counters,  are not even truly average computed
using the last 30 seconds of data.
It is indicated as an exponential time-weighted (moving),  where data
is gathered every 5 seconds.
Meaning every update time, a new value is calculated,  by   using
three datapoints, the previous value
of the average,  and a calculation based on the change over the past 5
seconds  (Current   -  Previous value).

Avg(N) =  exp(1/W) * (CurrentOctets -  PreviousOctets)   +  (1 -
exp(1/W) *  Avg(N-1))
Where  'W'   is computed  based  on the   "time interval"    averaged over

Routers or sniffers can aggregate that data, but a NMS that gathered
every 5s using
SNMP would not scale very well,  and TELNET/CLI  would not work for
that either;  for that,
you would need to use a different protocol,  probably would need to be
a new one designed
for 5 second accurate timestamped readings.

SNMP ifMib readings are not accurately timestamped,  and you would
encounter measurement errors.

Asking a device about  one particular statistic about
one interface every 5 seconds isn't much trouble.    If you have a
router with 100 interfaces,
and your NMS needs to query each interface every 5 seconds,  you have
100 / 5 = 20
interfaces to query per second.    Imagine how many packets you have
to send if you
have 100 devices with 5 interfaces,  and you want to  track  4
statistics for every interface
12 times per minute.

2000 queries every 5 seconds.    You need some serious hardware to
handle that on your routers
and your NMS,  which has 400 values to save per second,  assuming your
NMS perfectly distributes query load,
and responses are never delayed (not likely).

--
-JH