SNMP out or in octets (Network Traffic)

Question

I am writing software in C# measuring or utilizing out or in octets (bytes) via SNMP. I need to do how many bytes pass in 1000 secs?

According to my research, its value gets timed out or reset sometimes because some results give a negative value.

.1.3.6.1.2.1.2.2.1.10 for input stream in .139

In 1024 secs it gives result of -2,1 MBytes.

How can I get accurate measurement of traffic (in or out) ?

EDIT : This code I use for calculations. It takes value in everysec and gets result.

private void timer1_Tick(object sender, EventArgs e)
        {
            Cursor.Current = Cursors.WaitCursor;

            SnmpObject objSnmpObject, objSnmpIfSpeed;

            objSnmpObject = (SnmpObject)objSnmpManager.Get(".1.3.6.1.2.1.2.2.1.16.139");
            objSnmpIfSpeed = (SnmpObject)objSnmpManager.Get(".1.3.6.1.2.1.2.2.1.5.139");

            if (GetResult() == 0)
            {
                float value = Int64.Parse(objSnmpObject.Value);
                float ifSpeed = Int64.Parse(objSnmpIfSpeed.Value);

                float Bytes = (value * 8 * 100 / ifSpeed);
               // float megaBytes = Bytes / 1024;
                sum += Bytes;
                tb_calc.Text = (sum.ToString() + " Bytes");
            }
            _gv_timeSec++;
            lb_timer.Text = _gv_timeSec.ToString();

            Cursor.Current = Cursors.Default;

        }

score 0 · Accepted Answer · edited May 23 '17 at 12:17

1.3.6.1.2.1.2.2.1.10 is the OID for IF-MIB::ifInOctets which is described by MIB as a Counter32 which has a upper limit of 2^32-1 (4294967295 decimal).

"The total number of octets received on the interface, including framing characters.

Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime."

Quoting this SO answer :

a Counter32 has no defined initial value, so a single reading of Counter32 has no information content. This is why you have to take two (or more) readings to make sense of it. An example of this would be the number of packets received on an ethernet interface. If you take a reading and get back 4 million packets, you haven't learned anything: the wire could have been pulled out of the interface for the past year, or it could be passing millions of packets per second. You have to take multiple readings to know anything.

Reviewing the new code is perhaps a different question & answer that the original; it probably would be cleaner in its own new question (with input and actual/expected results). — k1eran, Oct 20 '15 at 09:19

score 0 · Answer 2 · answered Dec 11 '17 at 15:25

0

I'd recommend ifHCInOctets .1.3.6.1.2.1.31.1.1.1.6 and ifHCOutOctets .1.3.6.1.2.1.31.1.1.1.10 which are 64 bit versions of OIDs mentioned by @k1eran

Those counters don't rotate so quickly when dealing with higher speeds.

answered Dec 11 '17 at 15:25

simPod

11,498
17
86
139

SNMP out or in octets (Network Traffic)

2 Answers2