Different values for ifIn/OutOctets for local and remote queries.

John Rouillard <[email protected]>
Newsgroups gmane.network.net-snmp.user
Message-ID <[email protected]>
Hello all:

I have a problem that's driving me batty. Googling and searching the
mailing list didn't turn up anything of use. I have tcpdumped the
remote data and verified that it looks fine. Short of recompiling and
running a debugger I have run out of ideas.

I have a server S and clients A and B. If I do an:

   snmpget -c public -v 2c S sysUpTime.0 \
           IF-MIB::ifOutOctets.2 IF-MIB::ifInOctets.2

on S against S I get:

  SNMPv2-MIB::sysUpTime.0 = Timeticks: (338603) 0:56:26.03
  IF-MIB::ifOutOctets.2 = Counter32: 111439149495
  IF-MIB::ifInOctets.2 = Counter32: 301610011485

which is fine. If I am on A or B and I do:

   snmpget -c public -v 2c S sysUpTime.0 \
           IF-MIB::ifOutOctets.2 IF-MIB::ifInOctets.2

I get:

  SNMPv2-MIB::sysUpTime.0 = Timeticks: (339026) 0:56:30.26
  IF-MIB::ifOutOctets.2 = Counter32: 0
  IF-MIB::ifInOctets.2 = Counter32: 0

It doesn't matter if the query is v1, I get the same results in all
three cases. A tcpdump on S of the query from A is:

03:35:00.756819 IP (tos 0x0, ttl 62, id 1, offset 0, flags [DF], proto 17,
   length: 103) A.57133 > S.snmp: [udp sum ok] { SNMPv2c 
     { GetRequest(60) R=531627557
       system.sysUpTime.0
       interfaces.ifTable.ifEntry.ifOutOctets.2
       interfaces.ifTable.ifEntry.ifInOctets.2 } }

03:35:00.758456 IP (tos 0x0, ttl  64, id 469, offset 0, flags [DF], proto 17,
    length: 117) S.snmp > A.57133: [bad udp cksum 8a66!]  { SNMPv2c
      { GetResponse(74) R=531627557  
        system.sysUpTime.0=339026
        interfaces.ifTable.ifEntry.ifOutOctets.2=4067270909
          interfaces.ifTable.ifEntry.ifInOctets.2=1082932159 } }

An snmpget -d shows:

  Sending 75 bytes to S
  0000: 30 49 02 01  01 04 06 70  75 62 6C 69  63 A0 3C 02    0I.....public.<.
  0016: 04 7C 57 9B  3E 02 01 00  02 01 00 30  2E 30 0C 06    .|W.>......0.0..
  0032: 08 2B 06 01  02 01 01 03  00 05 00 30  0E 06 0A 2B    .+.........0...+
  0048: 06 01 02 01  02 02 01 10  02 05 00 30  0E 06 0A 2B    ...........0...+
  0064: 06 01 02 01  02 02 01 0A  02 05 00                    ...........


  Received 89 bytes from S
  0000: 30 57 02 01  01 04 06 70  75 62 6C 69  63 A2 4A 02    0W.....public.J.
  0016: 04 7C 57 9B  3E 02 01 00  02 01 00 30  3C 30 0F 06    .|W.>......0<0..
  0032: 08 2B 06 01  02 01 01 03  00 43 03 05  2C 58 30 13    .+.......C..,X0.
  0048: 06 0A 2B 06  01 02 01 02  02 01 10 02  41 05 19 F2    ..+.........A...
  0064: 6E 23 B5 30  14 06 0A 2B  06 01 02 01  02 02 01 0A    n#.0...+........
  0080: 02 41 06 02  BE 40 96 A7  6F                          [email protected]

  SNMPv2-MIB::sysUpTime.0 = Timeticks: (339032) 0:56:30.32
  IF-MIB::ifOutOctets.2 = Counter32: 0
  IF-MIB::ifInOctets.2 = Counter32: 0

The server is a 64 bit machine running centos 4.2 with kernel:

  2.6.9-22.0.2.ELsmp #1 SMP Fri Dec 30 05:51:35 UTC 2005
         x86_64 x86_64 x86_64 GNU/Linux

with net-snmp versions:
   net-snmp-5.1.2-11.EL4.6, net-snmp-utils-5.1.2-11.EL4.6.

Client A is a Centos 4 box running kernel:

  2.6.9-22.0.1.ELsmp #1 SMP Thu Oct 27 13:14:25 CDT 2005
         i686 i686 i386 GNU/Linux

with net-snmp versions:
   net-snmp-5.1.2-11.EL4.6, net-snmp-utils-5.1.2-11.EL4.6

Client B is a Fedora Core 3 box running:

  2.6.11-1.35_FC3 #1 Mon Jun 13 00:52:08 EDT 2005
         i686 i686 i386 GNU/Linux

with net-snmp versions: 
  net-snmp-5.2.1.2-FC3.1, net-snmp-utils-5.2.1.2-FC3.1

I have things configured properly in snmpd.conf. As I understand it, I
should receive an error if I have misconfigured the security
parameters. The relevant entries from snmpd.conf are:

  #       sec.name  source          community
  com2sec notConfigUser  127.0.0.1    public
  com2sec notConfigUser  A            public
  com2sec notConfigUser  B            public

  group   notConfigGroup v1           notConfigUser
  group   notConfigGroup v2c          notConfigUser

  view    all           included   .1

  #       group          context sec.model sec.level prefix read   write  notif
  access  notConfigGroup ""      any       noauth    exact  all    none none

and I am receiving data in all three cases.

Since I am using v2c, I also tried using ifHCOutOctets.2 and
ifHCInOctets.2, but they aren't defined on server S 8-(.

While I was writing this up I got a bright idea and tried running the
snmpget on another 64 bit box (Client C). It works correctly. An
snmpget with -d shows:

  snmpget -d -c public -v 2c S sysUpTime.0 ifOutOctets.2 ifInOctets.2

  Sending 75 bytes to S
  0000: 30 49 02 01  01 04 06 70  75 62 6C 69  63 A0 3C 02    0I.....public.<.
  0016: 04 32 38 5D  8F 02 01 00  02 01 00 30  2E 30 0C 06    .28].......0.0..
  0032: 08 2B 06 01  02 01 01 03  00 05 00 30  0E 06 0A 2B    .+.........0...+
  0048: 06 01 02 01  02 02 01 10  02 05 00 30  0E 06 0A 2B    ...........0...+
  0064: 06 01 02 01  02 02 01 0A  02 05 00                    ...........


  Received 88 bytes from S
  0000: 30 56 02 01  01 04 06 70  75 62 6C 69  63 A2 49 02    0V.....public.I.
  0016: 04 32 38 5D  8F 02 01 00  02 01 00 30  3B 30 0E 06    .28].......0;0..
  0032: 08 2B 06 01  02 01 01 03  00 43 02 04  1F 30 13 06    .+.......C...0..
  0048: 0A 2B 06 01  02 01 02 02  01 10 02 41  05 1A 0E 17    .+.........A....
  0064: 9F 0D 30 14  06 0A 2B 06  01 02 01 02  02 01 0A 02    ..0...+.........
  0080: 41 06 02 C0  9B C9 4B 6E                              A.....Kn

  SNMPv2-MIB::sysUpTime.0 = Timeticks: (1055) 0:00:10.55
  IF-MIB::ifOutOctets.2 = Counter32: 111905578765
  IF-MIB::ifInOctets.2 = Counter32: 3026270636910

Note that the return packet to client A was 89 bytes while the return
packet to client C is 88 bytes.

However the cacti and nagios monitoring are both on 32 bit boxes and
not likely to change any time soon. So does this ring any bells with
anybody? Any ideas for troubleshooting or resolving the problem.

-- 
				-- rouilj

John Rouillard
System Administrator
Renesys Corporation
603-643-9300 x 111


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.