VLAN trunking statistics

This is quite a simple question but I can't find the answer anywhere. Let's say I have a switch with 5 VLANs configured on it. The switch has a trunk port carrying these VLANs. All I want to know is, over a given period of time, how much of the overall packets in/out on that trunk port belong to each VLAN. So if the overall packet count on that trunk interface after 1 hour is 1000 packets, 250 from VLAN 1, 300 from VLAN

2 etc. Then I can work out the bandwidth usage per VLAN. There does not seem to be a specific OID for this in SNMP - also, if you look at the packet counts on "show interface VLAN x" then they are always way out (i.e. if you add them all up then the total is always much less than the packet count for the interface). It is starting to look like the only solution is a hardware solution of some sort to capture the packets and work it out manually - which sounds like no fun...
Reply to
mfurnival
Loading thread data ...

In article , wrote: :This is quite a simple question but I can't find the answer anywhere. :Let's say I have a switch with 5 VLANs configured on it. The switch has :a trunk port carrying these VLANs. All I want to know is, over a given :period of time, how much of the overall packets in/out on that trunk :port belong to each VLAN. So if the overall packet count on that trunk :interface after 1 hour is 1000 packets, 250 from VLAN 1, 300 from VLAN :2 etc. Then I can work out the bandwidth usage per VLAN.

It would depend on the switch, I suppose. There is something that just -might- work; it's a bit clumsy but it you don't find anything else...

In IOS, the process of assigning a VLAN to a port often involves creating a "subinterface". That subinterface is likely to have an entry in the interface table (ifTable); if so then you may be able to read off the packet counts. It would not be quite as easy as asking for information about "vlan 50", as you might have to consult some bridge-group OID or other in order to determine which VLAN is on which subinterface.

Something you would have to watch out for (and just plausibly might be the answer you need) is that IOS tends to use "community indexing": to find out interface information about a particular VLAN, you might need to use a varient on the SNMP community string. For example, vlan:50@MyCommunityString might be the community string you submit in order to read off information about vlan 50. You will want to double-check the syntax, though. The older form used to be just the VLAN number then @ then the community string, but that was modified several releases ago and I always have a hard time locating the reference to the new community indexing format.

Reply to
Walter Roberson

Each VLAN does have an ifTable entry and the counters do go up but the total of these counters for all VLANs is always vastly different from the total for that interface (this was done in test conditions so I was controlling what was going on). The interface stats were something like

600000 packets over a given period whilst the VLAN stats were about 60000. Based on the traffic I was sending the interface packet counts looked right and the VLAN stats looked too low.
Reply to
mfurnival

In article , wrote: :Each VLAN does have an ifTable entry and the counters do go up but the :total of these counters for all VLANs is always vastly different from :the total for that interface (this was done in test conditions so I was :controlling what was going on).

In IOS, the counts are sometimes not accurate for some ACLs, because the ACL entries are not consulted if the flow is found in the flow cache. For testing purposes at least, you might want to risk turning off flow caching and see if the counts start looking right.

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.