2

I am trying to calculate the % network utilization for a server on my network for any snmp traffic, (in or out). I have followed the below steps, can someone point out if I have gone wrong in the process ?

Step 1: run tcpdump for one minute to capture all packets which have src or dst port as 161(snmp) and send it to a text file

Step 2: extract the length from the captured packets, example line below

11:09:59.602526 IP (tos 0x0, ttl 252, id 21267, offset 0, flags [none], proto UDP (17), **length 84**)
myremotedevice.snmp > mylocalserver.32802:  { SNMPv1 C=public { GetResponse(37) R=<redected>  E:redected=redected } } 

Step 3: Add all the lengths from the file, lets say, total length= 4505407 Bytes

Step 4: Perform Y=(X * 8)/60 to get the bits per second.

Y = (4505407 * 8) / 60
Y = 600720.93

Step 5: I have a gigabit network, so to find the network util I perform the following: %util = (Y/1000000000) * 100

%util = (600720.93/1000000000) * 100
%util = 0.06%

Thus, I can conclude that the network utilization per second for SNMP traffic for my server is 0.06%

So, the question is, is the above calculation accurate ? Thanks!

1 Answer 1

1

No, that result is about twice what it should be.

Since your filter was either the source OR destination port being 161, then that means that you were interested in both incoming and outgoing SNMP traffic.

Gigabit Ethernet is always switched, which means it is always full-duplex. So it has 1 gigabit/sec of incoming bandwidth, plus 1 gigabit/sec of outgoing bandwidth, for a total of 2 gigabits/sec of aggregate bandwidth. So you should have divided by 2 billion instead of 1 billion.

Other than that, your calculation is probably close enough for most purposes. If you wanted to be even more precise, you could account for the time that mandatory inter-packet gaps, physical-layer preambles, and start-of-frame delimiters take up. When Gigabit Ethernet sends bits, it sends them at 1,000,000,000 bits per second, but it doesn't send useful bits constantly (because of the mandatory gaps and preambles I mentioned). Those things don't show up in what tcpdump captures, so to be ultra-precise, you have to remember to account for them. If I recall correctly, the gap is 96 bit-times, the preable+delimiter is 64 bits, for a total of 160 "invisible" bits per packet.

Edited to add: You might also want to double-check that the length field you're using from that tcpdump output is the full Ethernet frame length, and not just the IP or UDP datagram length.

3
  • thank you for the detailed response it was really helpful, I think you are correct I am only collecting the IP packet length. Am I correct in assuming that this length contains the UDP header length as well as the actual UDP data being transmitted ?
    – termcap
    Oct 14, 2016 at 7:01
  • Further to the above comment and building up from your answer, would if be correct if for the above sample capture that reports a IP header length of 84 bytes, the total size of the packet on the wire would be
    – termcap
    Oct 14, 2016 at 7:03
  • - would be 304 bytes + 84 bytes = 388 bytes. The 305 bytes include the overhead you mentioned as well as 32 bytes each for MAC addresses of the source, destination and 4 bytes for the ethernet type.
    – termcap
    Oct 14, 2016 at 7:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .