It was more of a quick and dirty project and a reason for me to learn some TCL. I wasn't aware of any way to get the value from snmp or any cli command so I pulled the info I did have (show int) and worked with that. As I try to improve my TCL skills, I will probably work on this. In fact, I have already updated it somewhat but do not have the final r2. This was basically a random fun project for me and thought some people may find value in the (semi) finished product. Thanks to everyone for the input though. It gives me things to try to figure out. And I am definitely no match major so the margin of error was really the last thing on my mind... I was just automating what one of my team was doing manually. As far as the comments of using netflow, I usually agree but we have the solarwinds netflow product which I am not a fan of at all and find it hard to get the useful data I want. Other products I have used allow such better ability to drill in to data but solarwinds has let me down in the netflow arena. -----Original Message----- From: James Hess [mailto:mysidia@gmail.com] Sent: Sunday, May 23, 2010 4:14 PM To: Christopher Gatlin Cc: Thomas Magill; nanog@nanog.org Subject: Re: Useful TCL script? On Sun, May 23, 2010 at 5:16 PM, Christopher Gatlin <chris@travelingtech.net> wrote:
That is a stellar TCL script! I generally use netflow to glean information regarding average packet size.
Seems like a good script to me. My only criticism would be pretty hard to do anything about... you're averaging an average over a longer period of time than the underlying data that computes the average. dividing 5 minute average databytes approximation by 5 minute average packets approximation is probably not a very reliable estimate for 5 minute average packet size. Even ignoring roundoff errors, an amount of error is introduced by averaging less precise samples, than the device should have access to (if it could compute that rolling average itself using 1 minute or higher resolution data) The less stable the packet size, the more error your approximation should have. Example of 5 minute average over 5 60-second bps divided by pps samples... Versus taking the two 5 minute average rates and dividing them. 60sec average after 1min 2min 3min 4min 5min | Actual 5 minute average rate | bps 100000 200000 300000 400000 850000 | 370000 pps 600 300 900 1000 3620 | 1284 bps/pps 166.67 666.67 333.33 400 234.80 | 360.294 BPS / PPS that would be computed by 370000 / 1284 = 288.16 bits When 360.294 bits should be the answer, is an error of 72.134 bits (or 9 bytes out of 45 bytes), Representing an introduced error of ~20% -- -J