SNMP Network Interface Monitoring — Bandwidth, Traffic & Errors

Network interface monitoring is the part of SNMP that just works. Unlike environmental readings, everything in this category lives in one standardized, portable tree — the IF-MIB (RFC 2863) — so the same OID means the same thing on a Linux server, a top-of-rack switch, or a core router. Poll it and you get throughput, utilization, error and discard counts, and link state for every interface on the box, without a single vendor MIB in sight. This page routes you to each interface metric and explains the one detail that trips everyone up: counters, not gauges.

Counters, not gauges

The thing to understand before anything else is that the IF-MIB reports traffic as monotonically increasing counters, not instantaneous rates. ifInOctets and ifOutOctets are running totals of bytes since the interface last reset. To get a bit-per-second rate you poll twice, subtract, and divide by the elapsed time. That's why every traffic page here talks about deltas rather than raw values.

There's a second, load-bearing detail: counter width. The original 32-bit octet counters (ifInOctets at 1.3.6.1.2.1.2.2.1.10) wrap — roll back to zero — surprisingly fast on modern links. A 32-bit byte counter rolls over in about 34 seconds at 1 Gbps and under 4 seconds at 10 Gbps, faster than most polling intervals, which makes the reading useless. The fix is the 64-bit high-capacity counters in ifXTable (ifHCInOctets at 1.3.6.1.2.1.31.1.1.1.6), which for practical purposes never wrap. On any interface faster than about 20 Mbps, use the 64-bit counters.

The interface metric pages

Each page below covers one facet of the IF-MIB with real OIDs, query commands, and rate-calculation examples:

• SNMP Bandwidth Monitoring — turn octet counters into a utilization percentage against ifSpeed / ifHighSpeed, and alert on sustained saturation.
• SNMP Interface Traffic — the raw in/out throughput read from ifHCInOctets and ifHCOutOctets, with delta calculation.
• SNMP Interface Errors — ifInErrors (1.3.6.1.2.1.2.2.1.14), ifOutErrors, and discards, the early warning for a bad cable, duplex mismatch, or failing optic.
• SNMP Interface Info — the descriptive side: ifDescr, ifType, ifSpeed, ifAlias, and ifOperStatus for mapping indexes to real ports and watching link up/down.

Key IF-MIB OIDs

The IF-MIB splits across two tables. ifTable (1.3.6.1.2.1.2.2.1) holds the classic 32-bit columns and the descriptive fields; ifXTable (1.3.6.1.2.1.31.1.1.1) holds the 64-bit counters and extras like ifName and ifHighSpeed. Both are indexed by ifIndex, so a single walk lines the two up per interface.

Walk a whole table with snmpwalk -v2c -c public <host> 1.3.6.1.2.1.2.2.1, or grab a single leaf per interface with snmpget once you know the ifIndex.