next »

[perkiset]

Hello all -

I have written a telemetry / monitoring system to collect the load against all of our pfSense instances (quite a lot, actually). I'm walking the SNMP and gathering the ifInOctets and ifOutOctets and have the correct formula/method for converting that into real information - or at least my graphs look dang close to the Traffic Graph in pfSense

The question I have is the ifInUcastPkts (.1.3.6.1.2.1.2.2.1.11.1, .2 and .3). Their values clearly contribute to the overall load, but I'm not sure how to attribute them. Would it be fair to say that Octets are all TCP and Ucast are pandora-esque stuff? I'm afraid I'm outside my experience here, sorry if the question is completely stupid.

TIA

[perkiset]

Also forgot to mention that I have multiple VPNs, don't know if they could be contributing.

[cmb]

ucast is unicast traffic. i.e. everything except multicast and broadcast. Unicast should account for pretty much all your Internet traffic, though if you're on cable, your WAN is a gigantic broadcast domain and you'll have a lot of broadcast noise hitting your WAN, so not quite "pretty much all" in that instance. Any internal NICs will have some level of broadcast and multicast noise as well.

[perkiset]

Thanks for responding CMB

So at the end of the day, the Octets OID would be showing the total traffic across the interface regardless of type (U, M, B), correct?

[cmb]

correct