snmp bug

LukeCage

@jimp data is corrupted

not showing the data correctly
well
shows a little traffic shows a lot of traffic
Exactly tnsr showing corrupted data

All traffic coming from my upstream to tnsr and tnsr send all traffic to mikrotik

Graph tnsr screenshot
https://prnt.sc/26d1xzd

Graph mikrotik screenshot
https://prnt.sc/26d1xs1

Note: tnsr sending all traffic to mikrotik both devices running same traffic

johnpoz

@lukecage And who says the mikrotik data is correct, maybe its off and the tnsr data is the correct numbers.

Just at a loss to understand what you expect someone to do with some graphs? Ok not pulling numbers ok, but different values - which one is correct, or closer to correct. How do they average the data, what is the sample rate, etc.. I could see where you might have something to point out if one was showing gigs of data and the other was showing kbits, but one shows max 809 and other shows 701.. But what is the sample rate, is one doing 30 second average, the other doing 60 seconds, etc. Do you have a 3rd sample that corresponds to one of those, or how do you know they are both not wrong..

its like you had a watch that said it was 11:59:00, and then you brought in 2nd watch is wrong because it says it 11:59:01 -- Who says the first watch time was correct in the first place?

LukeCage

@johnpoz
Scanning interval same on both devices - 30 seconds

I can safely say to you, my traffic usage is progressing stability evening rush hour, I'm monitoring the traffic instantly from mikrotik gui(winbox) There is no 1 gbps difference in 30 seconds.

Dont have firewall rules or access lists on both device

Mikrotik snmp show stable traffic usage
https://prnt.sc/26d3muy

Tnsr snmp show unstable traffic usage
https://prnt.sc/26d3n9o

Traffic usage same on both devices
Tnsr sending all traffic to mikrotik device

Note:
I tried update prtg server
I tried change snmp community etc and restart service on tnsr side
I tried reboot tnsr
My problem is unresolved

LukeCage

new screenshots

tnsr
https://prnt.sc/26d8kk1

mikrotik
https://prnt.sc/26d8knp

johnpoz

@lukecage still not seeing anything here other than a 2 watch problem.. Which one is correct?

Maybe your mikrotik smooths the data more than tnsr. Maybe its a difference in whatever your using to graph that, and its polling, or smoothing settings.

Even if using settings same, take reading every 2 seconds and average last 30 seconds.. if they are not looking at the data at exact same time your going to see differences..

If you don't like the data your seeing because it doesn't "match" up exactly with some other system doesn't mean there is a snmp bug.. These are 2 different systems.. 2 different OSes, 2 different nics I assume, 2 different drivers, etc. etc..

Looking at your graphs to me - just looking like one is smoothing more than the other. Or sample time slightly off.. I see increase in data that lines up with increase in data on the other one, I see area that could just be different smoothing applied

jimp

It could also be a difference in how the two handle the data. For example the Mikrotik may be taking longer to process things and queuing up traffic, where TNSR is pushing it out as soon as it gets it.

The totals are so close I find it hard to believe there is a problem with the data.

There are also statistics available via prometheus, which you could try logging instead of SNMP, to see if that makes a difference.

LukeCage

@johnpoz

still not seeing anything here other than a 2 watch problem.. Which one is correct?
mikrotik device showing true data

On the tnsr side, there are too many graphic defects

i tried to install a new tnsr and get data
dont have any problem https://prnt.sc/26d8tzs

why i living this problem my main tnsr router i dont know
https://prnt.sc/26d8ugs

both tnsr working on reading every 30 seconds

note: my traffic is progressing stable, as in the screenshot I mentioned on the tnsr side, there is an imbalance in my traffic.

LukeCage

i changed scanning interval on both devices

tnsr -> 30 seconds to 60 seconds
mikrotik 30 seconds to 5 seconds

i will share results with you in 40-50 minutes

jimp

I'm not seeing any defects, just differences in how the traffic is being processed at higher volumes in your environment.

TNSR uses VPP which does vector processing which handles multiple packets at the same time, most other things process only one packet at a time (scalar processing). So it makes sense that it would handle large chunks of traffic at once (the peaks) as they come in.

https://wiki.fd.io/view/VPP/What_is_VPP%3F