When continuously querying SNMP OID "ifInUcastPkts", sometimes the next returned number is less than the previous returned number
The "ifInUcastPkts" counter is calculated is by subtracting the number of multicast packets from the total number of received packets on the interface (ucast = total - mcast) according to /proc/net/dev.
The multicast packets count increases higher than the total packets count. Therefore, when the multicast packets count is subtracted from the total packets count, the current result could be less than the previous result.
- eth1: total packets: 10526392; multicast packets: 10046180 - initial sample
- eth1: total packets: 10526421; multicast packets: 10046207 - over time, the total packets increased by 29, multicast increased by 27
- eth1: total packets: 10526449; multicast packets: 10046239 - over time, the total packets increased by 28, multicast increased by 32
As you can see, the number of multicast packets increased more than the total number of packets, which should never happen.