FW: Graphing Peering

Fri Jan 21 20:01:16 UTC 2005

Additional information on MAC accounting from Hakan Lindholm...

(specifically, the SNMPv2c object to pull 64bit MAC accounting counters)

- Dan

------ Forwarded Message
From: Hakan Lindholm <hakan at staff.spray.se>
Date: Fri, 21 Jan 2005 20:36:45 +0100 (CET)
To: Daniel Golding <dgolding at burtongroup.com>
Cc: <druid at softdust.com>, andrew matthews <exstatica at gmail.com>
Subject: Re: Graphing Peering

I'm not registerred to post on nanog.
You may send this info in, with or without quoting me..

On Thu, 20 Jan 2005, Daniel Golding wrote:

>
> Andrew,
>
> The 32 bit counters are a significant problem when using gigabit ethernet
> public peering interfaces. Needless to say, MAC accounting was not designed
> for gigabit speeds. Frequent polling is, sadly the only solution. If you
> write your own scripts, make sure to account for counter wrapping.

What about the .1.3.6.1.4.1.9.9.84.1.2.3.1.2 tree?
Remeber to use SNMPv2c.

We use the following to generate some MRTG config:

while (!$session->{ErrorStr} and
        $$vars[0]->tag eq "ipNetToMediaNetAddress"){

     if ($type eq "dynamic") {

         @mac = split(/:/, $mac);
         $decmac = join('.', hex $mac[0], hex $mac[1], hex $mac[2], hex
$mac[3], hex $mac[4], hex $mac[5]);
         ($iname, @junk) = gethostbyaddr( pack( "C4", split( "\\.", $ip )),
AF_INET );

         if (-z $iname) {$iname = $ip};
         if (!defined($peers{$ip})) {$peers{$ip} = "no BGP peer"};

         $ifi = $ix{$router}[1];

         print "\n";
         print "Target\[$ip\]:
1.3.6.1.4.1.9.9.84.1.2.3.1.2.$ifi.1.$decmac\&1.3.6.1.4.1.9.9.84.1.2.3.1.2.$i
fi.2.$decmac:$ARGV[1]\@$ARGV[0]:::::2\n",

         "MaxBytes\[$ip\]: 25000000\n",
         "Title\[$ip\]: $ix{$router}[0]: $peers{$ip}\n",
         "PageTop\[$ip\]: <H1>$ix{$router}[0]: $peers{$ip}</H1>\n",
         "\tIP: $ip, DNS: ", $iname, "\n";
     }
     ($ip,$mac,$type) = $session->getnext($vars);
};

(This is only part of the script.  You should make it work in your
environment quite easy though.)

> - Dan
>
> on 1/20/05 9:45 AM, "druid at softdust.com" <druid at softdust.com> wrote:
>
>>
>> On Wed, 2005-01-19 at 22:41, andrew matthews wrote:

>> Another problem you might run into is counter wrapping. When polling
>> every 5 minutes, some counters may wrap. (there is no 64 bit counter for
>> the mac-address accounting). So you have to run it in short timeframes,
>> causing more cpu utilization.

Talking about Cisco, see above.  There is such counters.

>> But all in all, mac-accounting and Netflow source-as give you a very
>> good overview of your network flows.

Yes indeed.

/H

------ End of Forwarded Message