pfSense Support Subscription

Author Topic: How do I account for this traffic?  (Read 4419 times)

0 Members and 1 Guest are viewing this topic.

Offline perkiset

  • Newbie
  • *
  • Posts: 6
    • View Profile
How do I account for this traffic?
« on: April 03, 2012, 12:36:47 pm »
Hello all -

I have written a telemetry / monitoring system to collect the load against all of our pfSense instances (quite a lot, actually). I'm walking the SNMP and gathering the ifInOctets and ifOutOctets and have the correct formula/method for converting that into real information - or at least my graphs look dang close to the Traffic Graph in pfSense :)

The question I have is the ifInUcastPkts (.1.3.6.1.2.1.2.2.1.11.1, .2 and .3). Their values clearly contribute to the overall load, but I'm not sure how to attribute them. Would it be fair to say that Octets are all TCP and Ucast are pandora-esque stuff? I'm afraid I'm outside my experience here, sorry if the question is completely stupid.

TIA

Offline perkiset

  • Newbie
  • *
  • Posts: 6
    • View Profile
Re: How do I account for this traffic?
« Reply #1 on: April 03, 2012, 12:41:09 pm »
Also forgot to mention that I have multiple VPNs, don't know if they could be contributing.

Offline cmb

  • Administrator
  • Hero Member
  • *****
  • Posts: 6295
    • LinkedIn
    • Twitter
    • View Profile
    • Chris Buechler
Re: How do I account for this traffic?
« Reply #2 on: April 08, 2012, 07:07:42 am »
ucast is unicast traffic. i.e. everything except multicast and broadcast. Unicast should account for pretty much all your Internet traffic, though if you're on cable, your WAN is a gigantic broadcast domain and you'll have a lot of broadcast noise hitting your WAN, so not quite "pretty much all" in that instance. Any internal NICs will have some level of broadcast and multicast noise as well.

Offline perkiset

  • Newbie
  • *
  • Posts: 6
    • View Profile
Re: How do I account for this traffic?
« Reply #3 on: April 09, 2012, 07:23:53 pm »
Thanks for responding CMB

So at the end of the day, the Octets OID would be showing the total traffic across the interface regardless of type (U, M, B), correct?

Offline cmb

  • Administrator
  • Hero Member
  • *****
  • Posts: 6295
    • LinkedIn
    • Twitter
    • View Profile
    • Chris Buechler
Re: How do I account for this traffic?
« Reply #4 on: April 10, 2012, 10:02:36 pm »
correct