Skip to content

Monitoring bandwidth and counters

An SNMP counter (Counter32/Counter64) keeps rising since the device started. Its value — “4,812,377,123 bytes received” — says nothing about how full a link is right now. Only the change per second is a measurement. That is what the two check types on this page compute.

Check Use
Interface utilization (bandwidth) (snmp_bandwidth) How full is a link? Utilization in Mbit/s or %, plus errors and discards per minute. No OID knowledge needed.
SNMP counter as a rate (snmp_counter) Any other counter — packets, errors, requests, connections — as a rate per second (or per minute/hour via the factor).

Quickest: device scan

The device scan (Host → Device scan) suggests the checks on this page for every device that reports interface counters (IF-MIB — switches, routers, firewalls, NAS, servers, printers; the vendor does not matter). Group Bandwidth:

Suggestion What it measures Preselected
Interface Utilization (highest) Load of the busiest connected interface in %, WARNING from 90 % yes — only if the device reports speeds
Interface Errors Errors per minute on the worst link, WARNING from 5, CRITICAL from 60; radio interfaces are excluded yes
Bandwidth \<name> Traffic of a single interface in Mbit/s (uplink, WAN, PPPoE, VLAN) no

If the host already measures one of them — even under another name, such as "Port Utilization (highest)" from the device profile — the suggestion shows Present: \<name> and is not preselected. "All" only selects new ones.

Interface utilization

  1. On the device (with SNMP credentials): Add check → Interface utilization (bandwidth).
  2. Interfaces: One interface (by its name) or All — the busiest one counts.
  3. Interface: pick from the list — it shows the interfaces the device reports (from the device snapshot or the check's last result) — or type the name, e.g. ether1 (MikroTik), Gi1/0/1 (Cisco), eth0 (Linux).
  4. Metric: utilization, errors per minute or discards per minute.
  5. Direction: both (the higher one counts), inbound or outbound.
  6. Unit: percent of the speed or Mbit/s.
  7. Limits in the threshold fields. For percent, 85 / 95 are common.

Why by name?

An interface's number (ifIndex) can change after a restart or firmware update — a check on “number 3” would silently watch another link. The name stays.

Percent or Mbit/s

  • Percent = load ÷ interface speed (ifHighSpeed, otherwise ifSpeed). Good for “is the port full?”.
  • Mbit/s = the load itself. Good for graphs and for interfaces that report no speed (tunnels, bridges).
  • Reference bandwidth (under “Advanced”): for internet lines. If a 100 Mbit/s line hangs on a 1 Gbit/s port, enter 100 — then 100 % means “line full”, not “port full”.

“All interfaces”

The check measures every connected physical interface and reports the busiest (“Highest: ether5 …”). Details lists every interface with inbound and outbound. Under “Advanced”:

  • Exclude interfaces (name contains) — e.g. bridge, wlan.
  • Include interfaces without a link — otherwise only connected ones.
  • Include virtual interfaces — VLAN, tunnel, loopback. Their traffic is already counted on the physical interface below.

The graph

For one interface the graph draws inbound and outbound as two lines; for all, the highest load per direction.

SNMP counter as a rate

For any other counter: OID (single counter) or Table column (walk OID) with aggregation (maximum, minimum, average, sum), name column and filters — like the snmp check.

  • Factor applies to the change per second: 60 = per minute, 3600 = per hour, 8 = bits from bytes.
  • Unit: empty = /s. With factor 60, e.g. /min.

An snmp check on a counter is almost always wrong

Its value grows forever — a limit on it eventually turns permanently red and stays there. If the configuration tab of an snmp check shows Counter32/Counter64 as the return value, the value belongs in a rate check.

Good to know

The first value comes after one interval. A rate needs two measurements. A new check therefore shows Waiting for data until the second run — that is not an error. Check now (Active-Checker) measures twice, 5 seconds apart.

After a device restart one run is skipped. The counter starts over; a rate across the restart would be made up. Vesana detects the restart from the device's uptime (sysUpTime) and skips exactly one measurement. The same applies after a collector restart or hand-over.

64-bit before 32-bit. The bandwidth check uses the 64-bit counters (ifHCInOctets/ifHCOutOctets). Only if the device lacks them does it use the 32-bit counters — which overflow every 34 seconds at 1 Gbit/s. A single overflow is accounted for; if the counter may have overflowed more than once between two runs, the check reports UNKNOWN with an interval that works (“… set the check interval to 30 s or less”).

Error messages

Message Meaning What to do
Interface "ether9" not found (ifName). Available: … No name matches. Pick one of the listed names — the field offers them.
No interface chosen — pick one … Mode “one interface” without a name (typical: a WAN check freshly added from a profile). Choose the interface on the check — the message lists the available ones.
Interface name "…" is not unique Two interfaces share the name. Under “Advanced”, choose another column at Name from (ifDescr/ifAlias).
The device reports no speed for this interface … Percent needs a speed. Choose unit Mbit/s or enter a reference bandwidth.
The device only provides 32-bit counters … 32-bit counters overflow several times per interval. Set the interval mentioned in the message.
The collector running this check does not support this check type yet … The collector is older than the check type. Wait, or update the collector — collectors update themselves after a Vesana update.
No rate yet: … (only with Check now) The device restarted or the counter was reset between the two measurements. Check again or wait for the next run.

Port view and firewall panel

From the second run of the device snapshot, a switch's port view and the firewall panel show the current load per port (average over the time between two snapshots, e.g. “Ø 5 min”) instead of the total since the restart. The totals remain in the port details.

See also