On Mon, Nov 22, 2010 at 8:02 AM, Brandon Ross <bross@pobox.com> wrote:
On Mon, 22 Nov 2010, Nick Hilliard wrote: least once a second. Perhaps you are thinking about the rate counters that are often _configured_ to use the last 30 seconds of data to compute the average but also update much more often than every 30 seconds (and default to a 5 minute average).
Show interface rate counters, are not even truly average computed using the last 30 seconds of data. It is indicated as an exponential time-weighted (moving), where data is gathered every 5 seconds. Meaning every update time, a new value is calculated, by using three datapoints, the previous value of the average, and a calculation based on the change over the past 5 seconds (Current - Previous value). Avg(N) = exp(1/W) * (CurrentOctets - PreviousOctets) + (1 - exp(1/W) * Avg(N-1)) Where 'W' is computed based on the "time interval" averaged over Routers or sniffers can aggregate that data, but a NMS that gathered every 5s using SNMP would not scale very well, and TELNET/CLI would not work for that either; for that, you would need to use a different protocol, probably would need to be a new one designed for 5 second accurate timestamped readings. SNMP ifMib readings are not accurately timestamped, and you would encounter measurement errors. Asking a device about one particular statistic about one interface every 5 seconds isn't much trouble. If you have a router with 100 interfaces, and your NMS needs to query each interface every 5 seconds, you have 100 / 5 = 20 interfaces to query per second. Imagine how many packets you have to send if you have 100 devices with 5 interfaces, and you want to track 4 statistics for every interface 12 times per minute. 2000 queries every 5 seconds. You need some serious hardware to handle that on your routers and your NMS, which has 400 values to save per second, assuming your NMS perfectly distributes query load, and responses are never delayed (not likely). -- -JH