Supported Devices

WhatsUp Gold defines interface active monitor states for SNMP based monitors using the details below.

Interface active monitor uses SNMP protocol to obtain the value of the ifOperStatus (OID: 1.3.6.1.2.1.2.2.1.8.x where x is the SNMP index of the interface) from the device to which the interface belongs to. This value is then interpreted as per RFC-1213 to decide Up (value of 1) or Down (value of 2) for the interface. The values for the SNMP active monitor states cannot be changed within the application as they are based on the standards defined by IETF. Values for ifOperStatus and ifAdminStatus are defined in RFC-1213.

Interface Active Monitors have an “argument” that indicates the index of the interface as reported by the device. The index list is retrieved by using the iftable (1.3.6.1.2.1.2.2) from the device. That index is used in gathering details from additional SNMP OIDs which indicate the specifics of the interface including ifDescr, IfName, IfType, IfSpeed, IfOperStatus, IfAdminStatus, etc.

When a device is discovered and added to Monitoring (My Network) from the Discovered device list, Interface Active Monitors are added to the device. The device is assigned a Role or Subrole that has the Interface Active Monitors in the Monitors list for that Role and 2) If the device supports Interfaces active monitors meaning that the device can successfully get the list of interfaces from the iftable and those interfaces report as “UP”(See ifOperStatus above).

SNMP interface Active Monitor States

As indicated above, Interface active monitors check the ifoperstatus of interfaces that have an enabled Interface active monitor (as indicated in the device properties / Monitors dialog). The expectation is that the ifoperstatus will return a “1” (UP) for devices that are operationally up which is reported as “UP” in WhatsUp Gold when the monitor is polled. If ifOperstatus reports “2” (DOWN) the interface is listed as “Down” in WhatsUp Gold.

To determine why an interface is showing down, start by investigating the state change timeline for the device (in the Device Properties, click on the device menu at the top right of the dialog and select “State Change Timeline”. When reviewing the State change timeline for the device with the Interface active monitor reporting as “down” the most common Messages indicating why the monitor is down is 1) Device reported “2” for the operational status of that interface and 2) A Timeout.

Timeout indicates that a request was sent to the device for the specific Interface and no response was returned OR the response was returned outside of the default timeout period and retries specified in the active monitor configuration. This response can indicate that the device was unable to respond to the SNMP request because the device is too busy, there is a slowness on the network, the device is down, the SNMP credential is incorrect or changed, etc. If the timeout is sporadic and the interface is sometimes up, the likelihood is that there is a delay getting the response from the device either due to network congestion or a slowness of the SNMP agent on the device. The default timeout for the Interface active monitor is 2 seconds and is set for 1 retry. WhatsUp Gold will send a request and wait 2 seconds, if no request returns in that timeframe anther request is sent. If no request returns in that timeframe, the interface is considered down. The Timeout and retries can be set to allow for a longer timeout or number of retries in the Monitors library (Interface active monitor and click on Advanced options), however this setting impacts ALL devices that use the Interface active monitor.

One of the tools available within WhatsUp Gold to check the current status for the Interfaces is called the SNMP MIB Walker:

https://community.progress.com/s/article/Using-SNMP-MIB-Walker

When Looking at the down Interface active monitor on your device, please note the “index” for that specific Interface.

The default SNMP interface performance monitors use specific O.I.D.s (Object Identifiers) to collect interface performance information.

If the target device supports SNMP protocol and returns values under the ifTable (OID: 1.3.6.1.2.1.2.2) and ifXTable (OID: 1.3.6.1.2.1.31.1.1) WhatsUp Gold can collect performance information from the target device. Note: The ifXTable is used to collect performance information when 64-bit counters are available on the target device. It is also the recommend and preferred method to collect performance information for any interface that has a maximum throughput over 10Mbps. SNMP ifXTable is defined in RFC-2233 (RFC1213/RFC2233)

Why are my interfaces reporting incorrect utilization?

• Interface speed is incorrect. If using SNMP, this is obtained by retrieving the value of ifSpeed (OID: 1.3.6.1.2.1.2.2.1.5.x where x is the SNMP index of the interface) or ifHighSpeed (OID 1.3.6.1.2.1.31.1.1.15.x where x is the SNMP index of the interface). Note that interface speed can be customized using the performance monitor advanced configuration UI - this allows the user to correct speeds for interfaces that are incorrectly reported by SNMP or do not correctly reflect the actual bandwidth. For example, a WAN interface that is connected to ISP capable of speeds only up to 100 Mbps may report incorrect utilization because the actual interface is a gigabit interface physically capable of up to 1 Gbps and therefore reports 1Gbps as the speed even though the ISP link can only manage up to 100 Mbps. In this example, if the actual usage was close to the 100 Mpbs bandwidth the Utilization is close to 100% but would report a very low utilization (vs. A 1 Gpbs speed). Changing the speed of this specific interface in the performance monitor of that specific device to 100 Mbps would show the “true” utilization.

   

• Interface is a high speed interface but is being monitored using regular (i.e. IfTable based as opposed to ifXTable based) performance counters. Note that interface performance monitor's advanced configuration allows the user to select specific method. The default setting is AUTO, which will use the high speed counters if they are available, otherwise WUG will switch back to the regular counters. There are also times where the SNMP agent on the device will send incorrect data on the high speed counters and using “regular” counters will allow the interface utilization to show up correctly (please note, this is a defect of the device side and will only work for counters that can returned correctly as 32 bit counters).

   

• Interface counters are "wrapping" around between subsequent polls. This is more likely to happen in case of 32-bit (i.e ifTable based) counters. If a very high amount of traffic is going through the interface and/or the polling interval for the interface performance monitor is so large that the performance counters - ifInOctets (OID: 1.3.6.1.2.1.2.2.1.10.x where x is the SNMP index of the interface) and/or ifOutOctets (OID: 1.3.6.1.2.1.2.2.1.16.x where x is the SNMP index of the interface) - reach the maximum value they can store and then "wrap around" to 0 and start counting again.

   

• The device is returning incorrect octet counts for in or out octets. This is usually due to a defect on the device side (with the SNMP agent). The in and out octets are counters on a network device that increases over time. What’s UP Gold polls for the values and needs two collection cycles to get a value. This is collection 2 value – collection 1 value to get the octet count for that period of time (the polling time). If the device incorrectly reports the same value for both collection points, utilization will show 0% utilized. If the value is simply incorrect, the utilization reports in What’s Up Gold can be very high or low although is incorrect either way (when compared with the value reported on the device).