I had to come up with a way to monitor average packet size on an interface so I wrote the following script (cisco devices). I don't know if anyone finds it useful, but here it is if so. Also, there is one issue with it where if the total number of packets an interface has seen is over 7 digits, it will not calculate it. This appears to be a limitation of the expr command used in cisco TCL and mpexpr is not supported. If anyone else knows a way to bypass this issue I would be glad to hear it. For now it just tells you that the value is too high. I am also considering creating a job that can input the value into an OID that we can poll but not exactly sure how to do that so if anyone has any experience or good references (other than the cisco stuff I find on google) I would be thankful. I save this to flash: or disk: (depending on default tcl location per device) and assign the alias: alias exec psize tclsh psize.tcl Then use it like: Router#psize psize tun1 Packet Size Information for Tunnel1 ---------------------------------------------------- 5 minute input bits/sec = 43000 5 minute input packets/sec = 30 5 minute average packet size = 179 Bytes ---------------------------------------------------- 5 minute output bits/sec = 3000 5 minute output packets/sec = 3 5 minute average packet size = 125 Bytes ---------------------------------------------------- Total input bytes = 1678803 Total input packets = 7761 Total average packet size = 216 Bytes ---------------------------------------------------- Total output bytes = 133316 Total output packets = 1041 Total average packet size = 128 Bytes ---------------------------------------------------- This is my first attempt at a script this complex so if you have any input/suggestions they are welcome. ######################################################################## ##### # # # psize.tcl # # By Thomas Magill - 5/7/2010 # # # ######################################################################## ##### # # Get input from command line set ifname $argv # Check interface name for errors if {[string equal $ifname ""]} { puts "Usage: psize ifname"; return; } if { [ catch { exec "show ip interface $ifname" } errmsg ] } { puts "Invalid interface $ifname, command failed"; return} set cmdtext [ exec "show interface $ifname" ] # Pull interface information and calculate foreach line [split $cmdtext "\n"] { if {[regexp -nocase {^(\S+) is (.*), line protocol is (\S+)} $line ignore ifnamefull ifstatus iflinkstatus]} { } if {[regexp -nocase {5 minute input rate ([0-9]+) bits/sec, ([0-9]+) packets/sec} $line ignore bpsinfive ppsinfive]} { if {$ppsinfive == "0"} {set psizeinfive "0"} else {set psizeinfive [expr $bpsinfive / $ppsinfive]} set psizeinfive [expr $psizeinfive / 8] } if {[regexp -nocase {5 minute output rate ([0-9]+) bits/sec, ([0-9]+) packets/sec} $line ignore bpsoutfive ppsoutfive]} { if {$ppsoutfive == "0"} {set psizeoutfive "0"} else {set psizeoutfive [expr $bpsoutfive / $ppsoutfive]} set psizeoutfive [expr $psizeoutfive / 8] } if {[regexp -nocase {([0-9]+) packets input, ([0-9]+) bytes} $line ignore ppsintotal bpsintotal]} { if {$ppsintotal > "9999999"} {set psizeintotal "Too Large to Find"} elseif {$ppsintotal == "0"} {set psizeintotal "0"} else {set psizeintotal [expr $bpsintotal / $ppsintotal]} } if {[regexp -nocase {([0-9]+) packets output, ([0-9]+) bytes} $line ignore ppsouttotal bpsouttotal]} { if {$ppsouttotal > "9999999"} {set psizeouttotal "Too Large to Find"} elseif {$ppsouttotal == "0"} {set psizeouttotal "0"} else {set psizeouttotal [expr $bpsouttotal / $ppsouttotal]} } } # Output Data puts "\n\nPacket Size Information for $ifnamefull" puts "---------------------------------------------------------" puts " 5 minute input bits/sec = $bpsinfive " puts " 5 minute input packets/sec = $ppsinfive " puts " 5 minute average packet size = $psizeinfive Bytes " puts "---------------------------------------------------------" puts " 5 minute output bits/sec = $bpsoutfive " puts " 5 minute output packets/sec = $ppsoutfive " puts " 5 minute average packet size = $psizeoutfive Bytes " puts "---------------------------------------------------------" puts " Total input bytes = $bpsintotal " puts " Total input packets = $ppsintotal " puts " Total average packet size = $psizeintotal Bytes " puts "---------------------------------------------------------" puts " Total output bytes = $bpsouttotal " puts " Total output packets = $ppsouttotal " puts " Total average packet size = $psizeouttotal Bytes " puts "---------------------------------------------------------" Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 mailto:tmagill@providecommerce.com <mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers <http://www.proflowers.com/> | redENVELOPE <http://www.redenvelope.com/> | Cherry Moon Farms <http://www.cherrymoonfarms.com/> | Shari's Berries <http://www.berries.com/>
Wouldn't SNMP walk/get gives you what you need? On Thu, May 20, 2010 at 4:05 PM, Thomas Magill <tmagill@providecommerce.com> wrote:
I had to come up with a way to monitor average packet size on an interface so I wrote the following script (cisco devices). I don't know if anyone finds it useful, but here it is if so. Also, there is one issue with it where if the total number of packets an interface has seen is over 7 digits, it will not calculate it. This appears to be a limitation of the expr command used in cisco TCL and mpexpr is not supported. If anyone else knows a way to bypass this issue I would be glad to hear it. For now it just tells you that the value is too high. I am also considering creating a job that can input the value into an OID that we can poll but not exactly sure how to do that so if anyone has any experience or good references (other than the cisco stuff I find on google) I would be thankful.
I save this to flash: or disk: (depending on default tcl location per device) and assign the alias:
alias exec psize tclsh psize.tcl
Then use it like:
Router#psize psize tun1
Packet Size Information for Tunnel1
----------------------------------------------------
5 minute input bits/sec = 43000
5 minute input packets/sec = 30
5 minute average packet size = 179 Bytes
----------------------------------------------------
5 minute output bits/sec = 3000
5 minute output packets/sec = 3
5 minute average packet size = 125 Bytes
----------------------------------------------------
Total input bytes = 1678803
Total input packets = 7761
Total average packet size = 216 Bytes
----------------------------------------------------
Total output bytes = 133316
Total output packets = 1041
Total average packet size = 128 Bytes
----------------------------------------------------
This is my first attempt at a script this complex so if you have any input/suggestions they are welcome.
######################################################################## #####
# #
# psize.tcl #
# By Thomas Magill - 5/7/2010 #
# #
######################################################################## #####
#
# Get input from command line
set ifname $argv
# Check interface name for errors
if {[string equal $ifname ""]} { puts "Usage: psize ifname"; return; }
if { [ catch { exec "show ip interface $ifname" } errmsg ] } {
puts "Invalid interface $ifname, command failed"; return}
set cmdtext [ exec "show interface $ifname" ]
# Pull interface information and calculate
foreach line [split $cmdtext "\n"] {
if {[regexp -nocase {^(\S+) is (.*), line protocol is (\S+)} $line ignore ifnamefull ifstatus iflinkstatus]} {
}
if {[regexp -nocase {5 minute input rate ([0-9]+) bits/sec, ([0-9]+) packets/sec} $line ignore bpsinfive ppsinfive]} {
if {$ppsinfive == "0"} {set psizeinfive "0"} else {set psizeinfive [expr $bpsinfive / $ppsinfive]}
set psizeinfive [expr $psizeinfive / 8]
}
if {[regexp -nocase {5 minute output rate ([0-9]+) bits/sec, ([0-9]+) packets/sec} $line ignore bpsoutfive ppsoutfive]} {
if {$ppsoutfive == "0"} {set psizeoutfive "0"} else {set psizeoutfive [expr $bpsoutfive / $ppsoutfive]}
set psizeoutfive [expr $psizeoutfive / 8]
}
if {[regexp -nocase {([0-9]+) packets input, ([0-9]+) bytes} $line ignore ppsintotal bpsintotal]} {
if {$ppsintotal > "9999999"} {set psizeintotal "Too Large to Find"} elseif {$ppsintotal == "0"} {set psizeintotal "0"} else {set psizeintotal [expr $bpsintotal / $ppsintotal]}
}
if {[regexp -nocase {([0-9]+) packets output, ([0-9]+) bytes} $line ignore ppsouttotal bpsouttotal]} {
if {$ppsouttotal > "9999999"} {set psizeouttotal "Too Large to Find"} elseif {$ppsouttotal == "0"} {set psizeouttotal "0"} else {set psizeouttotal [expr $bpsouttotal / $ppsouttotal]}
}
}
# Output Data
puts "\n\nPacket Size Information for $ifnamefull"
puts "---------------------------------------------------------"
puts " 5 minute input bits/sec = $bpsinfive "
puts " 5 minute input packets/sec = $ppsinfive "
puts " 5 minute average packet size = $psizeinfive Bytes "
puts "---------------------------------------------------------"
puts " 5 minute output bits/sec = $bpsoutfive "
puts " 5 minute output packets/sec = $ppsoutfive "
puts " 5 minute average packet size = $psizeoutfive Bytes "
puts "---------------------------------------------------------"
puts " Total input bytes = $bpsintotal "
puts " Total input packets = $ppsintotal "
puts " Total average packet size = $psizeintotal Bytes "
puts "---------------------------------------------------------"
puts " Total output bytes = $bpsouttotal "
puts " Total output packets = $ppsouttotal "
puts " Total average packet size = $psizeouttotal Bytes "
puts "---------------------------------------------------------"
Thomas Magill Network Engineer
Office: (858) 909-3777
Cell: (858) 869-9685 mailto:tmagill@providecommerce.com <mailto:tmagill@providecommerce.com>
provide-commerce 4840 Eastgate Mall
San Diego, CA 92121
ProFlowers <http://www.proflowers.com/> | redENVELOPE <http://www.redenvelope.com/> | Cherry Moon Farms <http://www.cherrymoonfarms.com/> | Shari's Berries <http://www.berries.com/>
That is a stellar TCL script! I generally use netflow to glean information regarding average packet size. show ip cache-flow will provide it via the CLI, or a netflow collector will graph it statistically over time. Chris On Thu, May 20, 2010 at 6:05 PM, Thomas Magill <tmagill@providecommerce.com>wrote:
I had to come up with a way to monitor average packet size on an interface so I wrote the following script (cisco devices). I don't know if anyone finds it useful, but here it is if so. Also, there is one issue with it where if the total number of packets an interface has seen is over 7 digits, it will not calculate it. This appears to be a limitation of the expr command used in cisco TCL and mpexpr is not supported. If anyone else knows a way to bypass this issue I would be glad to hear it. For now it just tells you that the value is too high. I am also considering creating a job that can input the value into an OID that we can poll but not exactly sure how to do that so if anyone has any experience or good references (other than the cisco stuff I find on google) I would be thankful.
I save this to flash: or disk: (depending on default tcl location per device) and assign the alias:
alias exec psize tclsh psize.tcl
Then use it like:
Router#psize psize tun1
Packet Size Information for Tunnel1
----------------------------------------------------
5 minute input bits/sec = 43000
5 minute input packets/sec = 30
5 minute average packet size = 179 Bytes
----------------------------------------------------
5 minute output bits/sec = 3000
5 minute output packets/sec = 3
5 minute average packet size = 125 Bytes
----------------------------------------------------
Total input bytes = 1678803
Total input packets = 7761
Total average packet size = 216 Bytes
----------------------------------------------------
Total output bytes = 133316
Total output packets = 1041
Total average packet size = 128 Bytes
----------------------------------------------------
This is my first attempt at a script this complex so if you have any input/suggestions they are welcome.
######################################################################## #####
# #
# psize.tcl #
# By Thomas Magill - 5/7/2010 #
# #
######################################################################## #####
#
# Get input from command line
set ifname $argv
# Check interface name for errors
if {[string equal $ifname ""]} { puts "Usage: psize ifname"; return; }
if { [ catch { exec "show ip interface $ifname" } errmsg ] } {
puts "Invalid interface $ifname, command failed"; return}
set cmdtext [ exec "show interface $ifname" ]
# Pull interface information and calculate
foreach line [split $cmdtext "\n"] {
if {[regexp -nocase {^(\S+) is (.*), line protocol is (\S+)} $line ignore ifnamefull ifstatus iflinkstatus]} {
}
if {[regexp -nocase {5 minute input rate ([0-9]+) bits/sec, ([0-9]+) packets/sec} $line ignore bpsinfive ppsinfive]} {
if {$ppsinfive == "0"} {set psizeinfive "0"} else {set psizeinfive [expr $bpsinfive / $ppsinfive]}
set psizeinfive [expr $psizeinfive / 8]
}
if {[regexp -nocase {5 minute output rate ([0-9]+) bits/sec, ([0-9]+) packets/sec} $line ignore bpsoutfive ppsoutfive]} {
if {$ppsoutfive == "0"} {set psizeoutfive "0"} else {set psizeoutfive [expr $bpsoutfive / $ppsoutfive]}
set psizeoutfive [expr $psizeoutfive / 8]
}
if {[regexp -nocase {([0-9]+) packets input, ([0-9]+) bytes} $line ignore ppsintotal bpsintotal]} {
if {$ppsintotal > "9999999"} {set psizeintotal "Too Large to Find"} elseif {$ppsintotal == "0"} {set psizeintotal "0"} else {set psizeintotal [expr $bpsintotal / $ppsintotal]}
}
if {[regexp -nocase {([0-9]+) packets output, ([0-9]+) bytes} $line ignore ppsouttotal bpsouttotal]} {
if {$ppsouttotal > "9999999"} {set psizeouttotal "Too Large to Find"} elseif {$ppsouttotal == "0"} {set psizeouttotal "0"} else {set psizeouttotal [expr $bpsouttotal / $ppsouttotal]}
}
}
# Output Data
puts "\n\nPacket Size Information for $ifnamefull"
puts "---------------------------------------------------------"
puts " 5 minute input bits/sec = $bpsinfive "
puts " 5 minute input packets/sec = $ppsinfive "
puts " 5 minute average packet size = $psizeinfive Bytes "
puts "---------------------------------------------------------"
puts " 5 minute output bits/sec = $bpsoutfive "
puts " 5 minute output packets/sec = $ppsoutfive "
puts " 5 minute average packet size = $psizeoutfive Bytes "
puts "---------------------------------------------------------"
puts " Total input bytes = $bpsintotal "
puts " Total input packets = $ppsintotal "
puts " Total average packet size = $psizeintotal Bytes "
puts "---------------------------------------------------------"
puts " Total output bytes = $bpsouttotal "
puts " Total output packets = $ppsouttotal "
puts " Total average packet size = $psizeouttotal Bytes "
puts "---------------------------------------------------------"
Thomas Magill Network Engineer
Office: (858) 909-3777
Cell: (858) 869-9685 mailto:tmagill@providecommerce.com <mailto:tmagill@providecommerce.com>
provide-commerce 4840 Eastgate Mall
San Diego, CA 92121
ProFlowers <http://www.proflowers.com/> | redENVELOPE <http://www.redenvelope.com/> | Cherry Moon Farms <http://www.cherrymoonfarms.com/> | Shari's Berries <http://www.berries.com/>
--
On Sun, May 23, 2010 at 5:16 PM, Christopher Gatlin <chris@travelingtech.net> wrote:
That is a stellar TCL script! I generally use netflow to glean information regarding average packet size.
Seems like a good script to me. My only criticism would be pretty hard to do anything about... you're averaging an average over a longer period of time than the underlying data that computes the average. dividing 5 minute average databytes approximation by 5 minute average packets approximation is probably not a very reliable estimate for 5 minute average packet size. Even ignoring roundoff errors, an amount of error is introduced by averaging less precise samples, than the device should have access to (if it could compute that rolling average itself using 1 minute or higher resolution data) The less stable the packet size, the more error your approximation should have. Example of 5 minute average over 5 60-second bps divided by pps samples... Versus taking the two 5 minute average rates and dividing them. 60sec average after 1min 2min 3min 4min 5min | Actual 5 minute average rate | bps 100000 200000 300000 400000 850000 | 370000 pps 600 300 900 1000 3620 | 1284 bps/pps 166.67 666.67 333.33 400 234.80 | 360.294 BPS / PPS that would be computed by 370000 / 1284 = 288.16 bits When 360.294 bits should be the answer, is an error of 72.134 bits (or 9 bytes out of 45 bytes), Representing an introduced error of ~20% -- -J
It was more of a quick and dirty project and a reason for me to learn some TCL. I wasn't aware of any way to get the value from snmp or any cli command so I pulled the info I did have (show int) and worked with that. As I try to improve my TCL skills, I will probably work on this. In fact, I have already updated it somewhat but do not have the final r2. This was basically a random fun project for me and thought some people may find value in the (semi) finished product. Thanks to everyone for the input though. It gives me things to try to figure out. And I am definitely no match major so the margin of error was really the last thing on my mind... I was just automating what one of my team was doing manually. As far as the comments of using netflow, I usually agree but we have the solarwinds netflow product which I am not a fan of at all and find it hard to get the useful data I want. Other products I have used allow such better ability to drill in to data but solarwinds has let me down in the netflow arena. -----Original Message----- From: James Hess [mailto:mysidia@gmail.com] Sent: Sunday, May 23, 2010 4:14 PM To: Christopher Gatlin Cc: Thomas Magill; nanog@nanog.org Subject: Re: Useful TCL script? On Sun, May 23, 2010 at 5:16 PM, Christopher Gatlin <chris@travelingtech.net> wrote:
That is a stellar TCL script! I generally use netflow to glean information regarding average packet size.
Seems like a good script to me. My only criticism would be pretty hard to do anything about... you're averaging an average over a longer period of time than the underlying data that computes the average. dividing 5 minute average databytes approximation by 5 minute average packets approximation is probably not a very reliable estimate for 5 minute average packet size. Even ignoring roundoff errors, an amount of error is introduced by averaging less precise samples, than the device should have access to (if it could compute that rolling average itself using 1 minute or higher resolution data) The less stable the packet size, the more error your approximation should have. Example of 5 minute average over 5 60-second bps divided by pps samples... Versus taking the two 5 minute average rates and dividing them. 60sec average after 1min 2min 3min 4min 5min | Actual 5 minute average rate | bps 100000 200000 300000 400000 850000 | 370000 pps 600 300 900 1000 3620 | 1284 bps/pps 166.67 666.67 333.33 400 234.80 | 360.294 BPS / PPS that would be computed by 370000 / 1284 = 288.16 bits When 360.294 bits should be the answer, is an error of 72.134 bits (or 9 bytes out of 45 bytes), Representing an introduced error of ~20% -- -J
participants (4)
-
Christopher Gatlin -
James Hess -
Jian Gu -
Thomas Magill