Systems and Network Management

Lab Test: Using Cricket to Monitor Network Traffic

Your task is to configure Cricket to monitor network traffic in and out of your own computer.

To do this, you will need to have the agent running on your machine, configured with access to the Mib-2 tree. You should have done this already; the process is described in the handout entitled SNMP Agent and the Set Operation.

You should provide at least one graph, with meaningful labels. You should be able to explain what you did and why. You have to the end of this

class to complete the exercise.

Note that this exercise mainly involves configuring a data source for Cricket. The reference manual for Cricket is helpful. I am reproducing the information about types of data source that Cricket uses.

rrd-ds-type

Default value: GAUGE The DS type is used by RRD to know how to interpret the numbers fetched from this

datasource. There are three possibilities:

GAUGE The measurement will be directly copied into the RRD datafile without any extra processing. Examples of this type of measurement include readings from thermometers, percent disk space free, etc.

COUNTER The measurements from COUNTER datasources will be treated like SNMP counters. An snmp counter increases monotonically until a fixed wrap-around point (usually either 2^{31} − 2 or 2^{63} − 2, depending on the size of the data type). To convert a COUNTER measurement into a rate (for instance, “count of octets” to “octets per second”) rrd subtracts the previous value from the current one, and adjusts for any wraparound conditions. Any snmp variable which is marked with the snmp “COUNTER” data type would normally have its rrd-ds-type set to COUNTER, but unless your datasource guarantees a monotonous increase, it is better to use DERIVE with an rrd-min of zero.

DERIVE DERIVE is like COUNTER, but there is no overflow check, so negative rates are possible. This datasource type would be useful when you have a count of something (which may increase and decrease), and you want to graph the rate of change. With an rrd-min of zero, the DERIVE datasource type acts like COUNTER, except that negative samples are treated as unknown. Handling snmp COUNTERs in this fashion helps reduce the occurrence of spikes in the graphs. Negative values can result from restarting the device or implementation errors in its snmp agent, and are common enough to really recommend using DERIVE rather than COUNTER.

The datasource type names are case-insensitive. They are passed directly through to rrd when the rrd file is created. If the datasource type is changed later, you must use rrd-tune to apply the change to the underlying rrd file. For more information about them, consult the rrd documentation for the create command.

Please note that I have revised the first Cricket document quite a lot, with some useful description of the way that Cricket works, and its configuration.

Nick Urbanik <nicku(at)nicku.org>  ver. 1.9