IP Acounting Idea for 2.5

Quoted 22 lines

From: Ian Stirling [mailto:[email protected]]

Quoted 2 lines

Manfred Bartz responded to

Quoted 1 line

Russell King <[email protected]> who writes:

<snip>

Quoted 3 lines

Quoted 3 lines

You just illustrated my point. While there is a reset capability people will use it and accounting/logging programs will get wrong data. Resetable counters might be a minor convenience

when debugging

Quoted 1 line

Quoted 1 line

but the price is unreliable programs and the loss of the

ability of

Quoted 3 lines

Quoted 1 line

several programs to use the same counters.

You of course, are commenting from the fact that your

applications are

Quoted 1 line

stupid, written poorly, and cannot handle 'wrapped' data. Take MRTG

<snip>

Quoted 1 line

Similarly, if my InPackets are at 102345 at one read, and

2345 the next

Quoted 2 lines

read,
and I know that my counter is 32 bits, then I know i've

wrapped and can do

Quoted 7 lines

I think the point being made is that if InPackets are at 102345 at one read,
and 2345 the next, and you know it's a 32 bit counter, it's completely unreliable to assume that you have in fact recieved 4294867295 packets, if the counter can be zeroed.
You can say nothing other than at least 2345 packets, at most 2345+n*2^32 have been got since you last checked.

Ah, yes.. I seem to have misplaced a bit of text in my reply.

The continuation of thought:

How the application derives the status of a wrapped counter or a zero'ed counter is dependant on the device being monitored.

Yes, you have to know what your interface is capable of (maxbytes/sec) so that you can do a simple calculation where:

maximum_throughput = maxbytes_sec * (time_now - time_last_read)

and if your previous good counter + the maximum throughput wraps the counter, you have a good chance that you've simply wrapped.

If not, then you can assume that your counters were cleared at some point, log the data you've got, and keep moving forward.