in More Search Options

NPM stopped to display "Multicast" traffic

Last post 03-14-2008 10:55 AM by greg@solarwinds.net. 6 replies.
Page 1 of 1 (7 items)
Sort Posts:
  • 03-10-2008 8:05 AM

    • Tomas
    • Not Ranked
    • Joined on 07-27-2007
    • Posts 10
    • Points 26

    NPM stopped to display "Multicast" traffic

    NPM stopped to display "Multicast" traffic (evidently ifInNUcastPkts and ifOutNUcastPkts variables) for newer Cisco switches , see attachment.

    The reason is probably that Cisco has replaced  common ..NU.. variables by more specific Multicast and Broadcast variables in latter IOS version, see next e-mail found on Cisco forum:

    >>>>
    Posted by: jclarke - Customer Support Engineer, CISCO SYSTEMS, CCIE - Nov 6, 2007, 11:16am PST


    Deprecated does not mean obsolete. A deprecated object should still work, but you are encouraged to use its replacement (if any). In this case, ifInNUcastPkts is replaced with ifInMulticastPkts and ifInBroadcastPkts from the IF-MIB. This object were deprecated by the IETF most likely because it did not distinguish between broadcast and multicast frames.
    <<<<

    Monitoring of non unicast traffic is wery useful. May I request an adjusting of SolarWind NPM to this change please?

    There are two available fours of variables for this purpose (the first is Counter32 type, latter Counter64 type):

    ifInMulticastPkts       1.3.6.1.2.1.31.1.1.1.2.Index
    ifInBroadsastPkts       1.3.6.1.2.1.31.1.1.1.3.Index
    ifOutMulticastPkts      1.3.6.1.2.1.31.1.1.1.4.Index
    ifOutBroadcastPkts      1.3.6.1.2.1.31.1.1.1.5.Index

    ifHCInMulticastPkts     1.3.6.1.2.1.31.1.1.1.8.Index
    ifHCInBroatcastPkts     1.3.6.1.2.1.31.1.1.1.9.Index
    ifHCOutMulticastPkts    1.3.6.1.2.1.31.1.1.1.12.Index
    ifHCOutBroadcastPkts    1.3.6.1.2.1.31.1.1.1.13.Index

    Regards,
    Tomas
     


    • Post Points: 3
  • 03-10-2008 8:40 AM In reply to

    Re: NPM stopped to display "Multicast" traffic

     Tomas - NPM will poll :

    ifHCInMulticastPkts     1.3.6.1.2.1.31.1.1.1.8.Index
    ifHCInBroatcastPkts     1.3.6.1.2.1.31.1.1.1.9.Index
    ifHCOutMulticastPkts    1.3.6.1.2.1.31.1.1.1.12.Index
    ifHCOutBroadcastPkts    1.3.6.1.2.1.31.1.1.1.13.Index

    If you select "Allow 64 bit counters" in the node details for the node.  It is however, very unusual that the old ifMIBs are no longer reporting data.  Yes, they are deprecated, but as the Cisco rep says, they will still be supported.

    Are all the interfaces on your device not reporting non-unicast traffic, or just this one? And did it coincide with an IOS change?

     Thanks,

    Greg 

     

    Greg Newman
    SolarWinds Toolset
    • Post Points: 3
  • 03-12-2008 12:14 PM In reply to

    • Tomas
    • Not Ranked
    • Joined on 07-27-2007
    • Posts 10
    • Points 26

    Re: NPM stopped to display "Multicast" traffic

    Thanks for your prompt reply.

    I noticed this effect on MRTG monitor at first.

    It evidently coincide with upgrade from 12.2(25)SE to 12.2(40)SE IOS version. NPM displays the same. Interesting that C2960G-48TC-L continues reporting after IOS upgrade but C2960G-24TC-L do not (3 switches on all ports). One C3560G-24TS-S stopped reporting non-unicasts as well.

    I selected "Allow 64 ..", but no change so far.

    Regards,
    Tomas

    • Post Points: 1
  • 03-13-2008 1:12 PM In reply to

    • Tomas
    • Not Ranked
    • Joined on 07-27-2007
    • Posts 10
    • Points 26

    Re: NPM stopped to display "Multicast" traffic

    The selection of 64 bit counters is partly succesful - NPM started reporting. But values reported are false. It seems to be only multicasts reported and broadcasts omitted.

    We  have MRTG adjusted to plot the sum of multicasts and broadcasts. Display is the same as before the IOS upgrade,  see

    http://pc068.fzu.cz/mrtg/bcast/ss-u4p1_10127.html

     


    • Post Points: 3
  • 03-14-2008 10:35 AM In reply to

    Re: NPM stopped to display "Multicast" traffic

    Tomas - this is probably due to the change in the Iftable vs. IfxTable.  Notice that the ifxTable(64bit) breaks down broadcasts and multicasts, whereas the ifTable (32bit) lumps the both into NU (Non-Unicast).

    Since we don't have charts for the separate types (only multicast), you are truly seeing only multicast when using the 64bit counters (ifxTable).

     

    • Ifx:
    • ifName (1)
    • ifInMulticastPkts (2)
    • ifInBroadcastPkts (3)
    • ifOutMulticastPkts (4)
    • ifOutBroadcastPkts (5)
    • ifHCInOctets (6)
    • ifHCInUcastPkts (7)
    • ifHCInMulticastPkts (8)
    • ifHCInBroadcastPkts (9)
    • ifHCOutOctets (10)
    • ifHCOutUcastPkts (11)
    • ifHCOutMulticastPkts (12)
    • ifHCOutBroadcastPkts (13)
    • ifLinkUpDownTrapEnable (14)
    • ifHighSpeed (15)
    • ifPromiscuousMode (16)
    • ifConnectorPresent (17)
    • ifAlias (18)
    • ifCounterDiscontinuityTime (19)

     

     

    • ifTable:
    • ifInOctets (10)
    • ifInUcastPkts (11)
    • ifInNUcastPkts (12)
    • ifInDiscards (13)
    • ifInErrors (14)
    • ifInUnknownProtos (15)
    • ifOutOctets (16)
    • ifOutUcastPkts (17)
    • ifOutNUcastPkts (18)
    • ifOutDiscards (19)
    • ifOutErrors (20)

     

    HTH,

    Greg

    Greg Newman
    SolarWinds Toolset
    • Post Points: 3
  • 03-14-2008 10:52 AM In reply to

    • Tomas
    • Not Ranked
    • Joined on 07-27-2007
    • Posts 10
    • Points 26

    Re: NPM stopped to display "Multicast" traffic

    It is what I suspected. Multicasts are much less interesting than broadcasts (storms!) Were it possible display  broadcast in place of multicast values? (Or better sum of both?)

    Regards,

    Tomas

    • Post Points: 3
  • 03-14-2008 10:55 AM In reply to

    Re: NPM stopped to display "Multicast" traffic

    Tomas -  I agree the bcast info is very valuable, and we are currently formulating a strategy on how to address this.

     Thanks,

    Greg
     

    Greg Newman
    SolarWinds Toolset
    • Post Points: 1
Page 1 of 1 (7 items)