hi,

I set up SNMP and packet sniffer sensors on my PRTG server for monitoring the bandwith of my network. I set up the polling intervals to 30 seconds. i observe that the total values (input + output) of SNMP sensors are not the same that the values of the packet sniffer.

Sometime the values of the SNMP and packet Sniffer sensors are insignifiant (150 kbits/s), nevertheless sometime the different between the 2 values are enormous (20 000 kbits/s for the SNMP and 7000 kbits/s for the packet sniffer).

Is It a problem of count method that are different for this 2 sensors ?

Best Regards

Article Comments

Hi there,

The reason for these differences are, that they are two different sensors. SNMP is counting and calculating with the traffic counters of a device (so the device it self is offering these statistics) while the packet sniffer is "just" counting the network traffic running through the selected interface. I am not sure how your setup looks like, but I assume that you using SNMP to monitor a specific interface of a switch or router and you are using the packet sniffer to sniff a specific mirrored port of a switch or router, right?


Dec, 2016 - Permalink

hi,

I set up a SNMP sensor for monitoring a specific interface of a switch, i obtain a the values of input and output on the interface and the total. I set up a port mirorring on the same interface that is monitored by the SNMP sensor. So normally i must have the same value because all the traffic that running through the interface is mirrored and send to my dedicated network interface for the sniffer packet of my prtg server.

Best regards


Dec, 2016 - Permalink

Hi there,

Please compare the graphs of the last 24h for both sensors (SNMP Traffic and Packet Sniffer), does the graphs look almost the same?

The reason for the differences of these two sensors are that the SNMP Traffic sensor just queries the current traffic counters from the device and calculates the bandwidth out of it, the packet sniffer has to analyze all incoming and outgoing packets and has to do a lot of more calculations (this sensors produces the most CPU and network load). This is why you will only see the same data if you take a look at, at least the averages of an hour.


Dec, 2016 - Permalink

hi,

The 2 graphs have the same look on a period of 24h. There are differents on the min and max values but they are insignifiant. The problem is that when i look the values on the equipments board, this values didn't match.

Best regards


Dec, 2016 - Permalink

Hi,

which values do you exactly mean? Please post them so we can analyze them and tell you more about it. :)


Dec, 2016 - Permalink

hi,

The menu where i see the values of my sensor, sorry it's in french, the translation is equipment Menu

this is the values of the packet Sniffer. packet sniffer sensor

This is the valies of the snmp sensor. SNMP Sensor

Best regards


Dec, 2016 - Permalink

Hi,

Now I understand. :)

As described before, both sensors work completely different and therefore they are displaying different live data, especially when they are not scanned at the same time. As long as the 24h (or higher) curve of both sensors is about the same, then everything is okay.


Dec, 2016 - Permalink