Support Center > Search Results > SecureKnowledge Details
When continuously querying SNMP OID "ifInUcastPkts", sometimes the next returned number is less than the previous returned number
Symptoms
  • When continuously querying SNMP OID "ifInUcastPkts" (.1.3.6.1.2.1.2.2.1.11), sometimes the next returned number is less than the previous returned number.

    Example:

    Thu Oct 14 13:41:33 EDT 2010 
    IF-MIB::ifInUcastPkts.14 = Counter32: 9260
    Thu Oct 14 13:41:43 EDT 2010 
    IF-MIB::ifInUcastPkts.14 = Counter32: 9259
    Thu Oct 14 13:42:03 EDT 2010 
    IF-MIB::ifInUcastPkts.14 = Counter32: 9259
    Thu Oct 14 13:42:13 EDT 2010 
    IF-MIB::ifInUcastPkts.14 = Counter32: 9261
    
Cause

The "ifInUcastPkts" counter is calculated is by subtracting the number of multicast packets from the total number of received packets on the interface (ucast = total - mcast) according to /proc/net/dev.

The multicast packets count increases higher than the total packets count. Therefore, when the multicast packets count is subtracted from the total packets count, the current result could be less than the previous result.

Example:

  • eth1: total packets: 10526392; multicast packets: 10046180 - initial sample
  • eth1: total packets: 10526421; multicast packets: 10046207 - over time, the total packets increased by 29, multicast increased by 27
  • eth1: total packets: 10526449; multicast packets: 10046239 - over time, the total packets increased by 28, multicast increased by 32

As you can see, the number of multicast packets increased more than the total number of packets, which should never happen.


Solution
Note: To view this solution you need to Sign In .