This is what counter rollover looks like.

by gorthx

A friend came to me about a performance monitoring tool he was using for his routers; he was concerned that his traffic in/out graphs for his 10G linkes weren’t matching up nicely with the values he found on the interface counters. The difference was fairly large and not equal across all interfaces (which would indicate a math problem). Without actually seeing his graphs & stats, my initial reaction [1] was “counter rollover!” and pointed him here for an explanation.

Basically, if you have a link that is 100Mb or faster, you want to use ifHCInOctets and ifHCOutOctets instead of ifInOctets and ifOutOctets [2]. (The caveat, of course, is that not all interface types support the ifHC counters, not even those that should.) With reasonably steady traffic, graphs depicting counter rollover have a characteristic jagged pattern. And of course, completely incorrect data.

Here are comparisons of 32- and 64-bit counters on three 10Gbps interfaces. Polling interval was 5 minutes.

1 – “You know what happens when you make an assumption?”
2 – The exception to this would be if you have a 100Mb link that’s very under-utilized and you’re polling regularly and at frequent intervals, but why take a chance?

Tags: ,
%d bloggers like this: