SNMP - Outbound eth0 bandwidth reporting the same/similar as inbound? (pic)

[the block]

I recently enabled SNMP because I wanted to be able to monitor my bandwidth with PRTG. I believe I have set everything up correctly on the PRTG end, however I believe the data my router is reporting to PRTG is not entirely accurate.

Inbound traffic seems to report fine, but it is the outbound that reports the same/similar as inbound. Look at the graph below. From about 9:00-10:45pm, that's my wife watching Netflix. There should be no (or very minimal) upload traffic as I wasn't doing anything on the network at the time either, yet look at the pink line. It follows the blue line almost perfectly, and the total traffic (light blue) is double what it should be as it is adding Traffic In + the inaccurate Traffic Out.

I am running 378.56_2 on an ASUS RT-AC68P router. The SNMP settings seem to be limited to On/Off, and then authentication settings. I don't see anything that looks like it could be relevant to this issue.

Merlin, or anyone, have any words of wisdom for me? Thanks!

 

[RMerlin]

You'll probably need to disable NAT acceleration to get accurate measurements.

 

[the block]

You'll probably need to disable NAT acceleration to get accurate measurements.

Ok, I'll try disabling it. What downside is there to turning it off? I'm not sure what it does.

 

[the block]

lol I disabled it and I think I may have cut off my internet access at home (I'm at work). I can't access the router anymore, nor any of my services. Hopefully it'll eventually come out of it, but I've given it about 10 minutes already. If it's not back by the time I get home I'll just power cycle the router.

 

[RMerlin]

Ok, I'll try disabling it. What downside is there to turning it off? I'm not sure what it does.

Higher CPU usage with faster Internet connections. Without NAT acceleration, the RT-AC68P can hit a max of around 350-400 Mbps WAN throughput.

 

[the block]

Higher CPU usage with faster Internet connections. Without NAT acceleration, the RT-AC68P can hit a max of around 350-400 Mbps WAN throughput.

What's the max with NAT acceleration? My WAN is only 100/100 so I should be fine with it off, but I'm just curious.

 

[RMerlin]

What's the max with NAT acceleration?

Close to 1 Gbps. People have posted speedtest results maxing their 940 Mbps connection.

 

[the block]

Close to 1 Gbps. People have posted speedtest results maxing their 940 Mbps connection.

Hah damn.. well if I ever get a 1 Gbps connection I'll worry about it then

 

[the block]

So I've gotten home from work and rebooted my router, internet is restored. I checked to make sure NAT hardware acceleration is still off, and it is. I'm doing some test downloading, and it seems my upload/download speeds are still being read the same/similar as you can see in the graph below.

So is there any other fix to this? Is this a bug, or just how SNMP works on the RT-AC68P?

Only other thing I can think to do is, I have a Verizon Quantum router I could put in front of the RT-AC68P and see if it has SNMP, and see if that reads any differently.

Any other ideas?

 

[RMerlin]

No other idea, sorry. I've seen a few oddities with packet accounting in recent firmware releases, however they are usually limited to the newer models such as the RT-AC88U. For these, the issue lies in the closed source Ethernet driver, which returns bogus values when you access /proc/net/dev .

 

[the block]

No other idea, sorry. I've seen a few oddities with packet accounting in recent firmware releases, however they are usually limited to the newer models such as the RT-AC88U. For these, the issue lies in the closed source Ethernet driver, which returns bogus values when you access /proc/net/dev .

Ok, no problem. Thanks for your help, as well as the active development of your great firmware.

 

[sfx2000]

I recently enabled SNMP because I wanted to be able to monitor my bandwidth with PRTG. I believe I have set everything up correctly on the PRTG end, however I believe the data my router is reporting to PRTG is not entirely accurate.

Inbound traffic seems to report fine, but it is the outbound that reports the same/similar as inbound. Look at the graph below. From about 9:00-10:45pm, that's my wife watching Netflix. There should be no (or very minimal) upload traffic as I wasn't doing anything on the network at the time either, yet look at the pink line. It follows the blue line almost perfectly, and the total traffic (light blue) is double what it should be as it is adding Traffic In + the inaccurate Traffic Out

Take a close look at the the SNMP agent data - not sure which item AsusWRT is reporting back, but this looks like a mapping issue within PRTG...

can always do an smnpwalk, and do again a bit later, and compare the counts...

 

[sfx2000]

In any event, RMerlin's build has the net snmp MIB's here...

https://github.com/RMerl/asuswrt-merlin/tree/master/release/src/router/net-snmp-5.7.2/mibs

 

[the block]

Take a close look at the the SNMP agent data - not sure which item AsusWRT is reporting back, but this looks like a mapping issue within PRTG...

can always do an smnpwalk, and do again a bit later, and compare the counts...

I first asked for help on the PRTG forums and the guy that responded implied all PRTG was doing is it shows what the router is broadcasting via SNMP.

I'm not really sure what to check on PRTG to look for "mapping issues".

In any event, RMerlin's build has the net snmp MIB's here...

https://github.com/RMerl/asuswrt-merlin/tree/master/release/src/router/net-snmp-5.7.2/mibs

Unfortunately I don't know what to do with this either. These also look to be for a RT-AC87, while I have a RT-AC68P.

I think I may just try and get rid of the total taffic line and just assume In and Out are interchangeable and combined. It does give me good info on overall traffic usage, just not the specifics. It's better than nothing I suppose. Thanks

 

[sfx2000]

I do not have access to an AsusWRT device to check - but what I can say from experience is that sometimes the interpreters don't map out the values correctly...

 

[the block]

Today I finally upgraded from 378.56_2 to 380.65_4. There's a lot of version updates in the middle of that stretch, and I don't know which one did it, but my eth0 PRTG bandwidth graph seems to be working properly now. Traffic In & Out now look to be independent of each other:

 

[the block]

Today I finally upgraded from 378.56_2 to 380.65_4. There's a lot of version updates in the middle of that stretch, and I don't know which one did it, but my eth0 PRTG bandwidth graph seems to be working properly now. Traffic In & Out now look to be independent of each other:

Scratch that, I checked again and it's back to it's old ways. The below screenshot is from a large download. Notice the Traffic Out is the same as Traffic In. Oh well.

 

[awrightus]

Recently loaded Merlin 384.5 on my AC87U. I've enabled SNMP and am seeing the same thing in this thread with similar upload/download speeds on the WAN interface (eth0). NAT acceleration is disabled. Has anything changed since the last post in this thread or is there anything I can do to get correct interface stats on the wan interface via snmp? Thanks.

 

[Ari_el]

RT3100, 384.4.2, same thing. Noticeable when e.g. streaming netflix 4k, stream 17Mbps. The router UI graph ("Traffic Analyzer") shows it like it is, download ~17Mbps, upload of a few Kbps.Querying the router MIB

1.3.6.1.2.1.2.2.1.10.5
1.3.6.1.2.1.2.2.1.16.5

"while the streaming is ongoing" shows that outOctets is about the same as inOctets, which is obviously wrong.
I tried disabling cut-through forwarding (NAT acceleration) and it made no difference whatsoever. Note that the problem only shows clearly with continuous streams/flows

Seems to be a bug...

 

[Ari_el]

RT3100, 384.4.2, same thing. Noticeable when e.g. streaming netflix 4k, stream 17Mbps. The router UI graph ("Traffic Analyzer") shows it like it is, download ~17Mbps, upload of a few Kbps.Querying the router MIB

1.3.6.1.2.1.2.2.1.10.5
1.3.6.1.2.1.2.2.1.16.5

"while the streaming is ongoing" shows that outOctets is about the same as inOctets, which is obviously wrong.
I tried disabling cut-through forwarding (NAT acceleration) and it made no difference whatsoever. Note that the problem only shows clearly with continuous streams/flows

Seems to be a bug...

Reply to self: here's an explanation of why the In/Out values for eth0 look the same:

https://www.snbforums.com/threads/rt-ac68u-snmp-values-the-same-for-in-out.19074/

this thread explains some details on the meaning of port nomenclature:
https://www.snbforums.com/threads/what-do-each-of-the-interfaces-in-merlin-translate-to.23745/