Table of Contents
SNMP - 32-bit counter reset
Introduction
Many of the variables accessible via SNMP are counters. SNMP counters do not start at a predefined value and are only reset when they reach their maximum value. For this reason, they are only useful for speed sampling. By taking two values from a counter, the speed can be calculated by dividing the difference between these values by the time interval between them.
The most convincing example of use is for monitoring bandwidth on interfaces using byte counters to measure incoming and outgoing traffic (ifInOctets and ifOutOctets).
SNMP v1 only supports 32-bit counters. SNMP v2 and v3 include support for 64-bit counters. These 64-bit counters have different OIDs to their 32-bit counterparts.
| References IF-MIB | |||
|---|---|---|---|
| 32-bits | 64-bits | ||
| ifInOctets | 1.3.6.1.2.1.2.2.1.10 | ifHCInOctets | 1.3.6.1.2.1.31.1.1.1.6 |
| ifOutOctets | 1.3.6.1.2.1.2.2.1.16 | ifHCOutOctets | 1.3.6.1.2.1.31.1.1.1.10 |
Reset
The maximum value of a 32-bit is 4 294 967 295 (232 - 1). Since this is a number of bytes, it represents 34,359,738,360 bits or 34,359.74 megabits. Divide this by 300 (seconds in 5 minutes) and you get 114.5. Therefore, if the average bandwidth is greater than 114.5 Mbit/s for 5 minutes, you will exceed the maximum value of a 32-bit counter. When the counter exceeds this value, it returns to zero.
If you exceed the maximum value just once during your interval, it doesn't matter. Since we know that counters never decrease in value, if a new value is lower than the previous one, we can deduce that it has been reset and we can still calculate the speed normally.
The problem arises when the counter makes several revolutions. There is no way of knowing how many times it has been reset, so we will have to assume that the answer is once. When the bandwidth reaches around 229 Mbit/s, the counter will reset at least twice in 5 minutes and the values will become useless.
When this happens, if you only have 32-bit counters and no 64-bit counters, the only thing you can do is reduce the time interval.
Solution
As the value of a 32-bit counter is exceeded very quickly, when the supervised element has a 64-bit counter it is better to use this. The maximum value of a 64-bit counter is 18 446 744 073 709 551 615 (264 - 1).
In ESIA, the bandwidth test plugins (CHECK_SNMP_INTERFACE_EASY & CHECK_SNMP_SW_INTERFACE_EASY) will use the 64-bit counter as a priority.
