6 Replies Latest reply on Mar 14, 2008 10:55 AM by greg@solarwinds.net

    NPM stopped to display "Multicast" traffic

      NPM stopped to display "Multicast" traffic (evidently ifInNUcastPkts and ifOutNUcastPkts variables) for newer Cisco switches , see attachment.


      The reason is probably that Cisco has replaced  common ..NU.. variables by more specific Multicast and Broadcast variables in latter IOS version, see next e-mail found on Cisco forum:


      >>>>
      Posted by: jclarke - Customer Support Engineer, CISCO SYSTEMS, CCIE - Nov 6, 2007, 11:16am PST



      Deprecated does not mean obsolete. A deprecated object should still work, but you are encouraged to use its replacement (if any). In this case, ifInNUcastPkts is replaced with ifInMulticastPkts and ifInBroadcastPkts from the IF-MIB. This object were deprecated by the IETF most likely because it did not distinguish between broadcast and multicast frames.
      <<<<


      Monitoring of non unicast traffic is wery useful. May I request an adjusting of SolarWind NPM to this change please?


      There are two available fours of variables for this purpose (the first is Counter32 type, latter Counter64 type):


      ifInMulticastPkts       1.3.6.1.2.1.31.1.1.1.2.Index
      ifInBroadsastPkts       1.3.6.1.2.1.31.1.1.1.3.Index
      ifOutMulticastPkts      1.3.6.1.2.1.31.1.1.1.4.Index
      ifOutBroadcastPkts      1.3.6.1.2.1.31.1.1.1.5.Index


      ifHCInMulticastPkts     1.3.6.1.2.1.31.1.1.1.8.Index
      ifHCInBroatcastPkts     1.3.6.1.2.1.31.1.1.1.9.Index
      ifHCOutMulticastPkts    1.3.6.1.2.1.31.1.1.1.12.Index
      ifHCOutBroadcastPkts    1.3.6.1.2.1.31.1.1.1.13.Index


      Regards,
      Tomas
       

        • Re: NPM stopped to display "Multicast" traffic

           Tomas - NPM will poll :

          ifHCInMulticastPkts     1.3.6.1.2.1.31.1.1.1.8.Index
          ifHCInBroatcastPkts     1.3.6.1.2.1.31.1.1.1.9.Index
          ifHCOutMulticastPkts    1.3.6.1.2.1.31.1.1.1.12.Index
          ifHCOutBroadcastPkts    1.3.6.1.2.1.31.1.1.1.13.Index

          If you select "Allow 64 bit counters" in the node details for the node.  It is however, very unusual that the old ifMIBs are no longer reporting data.  Yes, they are deprecated, but as the Cisco rep says, they will still be supported.

          Are all the interfaces on your device not reporting non-unicast traffic, or just this one? And did it coincide with an IOS change?

           Thanks,

          Greg 

            • Re: NPM stopped to display "Multicast" traffic

              Thanks for your prompt reply.


              I noticed this effect on MRTG monitor at first.


              It evidently coincide with upgrade from 12.2(25)SE to 12.2(40)SE IOS version. NPM displays the same. Interesting that C2960G-48TC-L continues reporting after IOS upgrade but C2960G-24TC-L do not (3 switches on all ports). One C3560G-24TS-S stopped reporting non-unicasts as well.


              I selected "Allow 64 ..", but no change so far.


              Regards,
              Tomas