Input/Output rate in bps with or without Ethernet header?

[ricart.cortinas]

I'm not sure about the data I'm collecting by my Cacti (MRTG) server or by the output of a show interface command.

The input or output rate in bits/sec includes meassurement with Ethernet header? It is usually not important as pakcet size is much greater. My question becomes important when packet size is of 29 bytes, due to a DDoS attack and want to know if the amount of Mbps of my SNMP grpahics are including or not the Ethernet header in the calculation.

Example of the show interface:

FastEthernet0/1 is up, line protocol is up

  Hardware is Fast Ethernet, address is 0016.47e9.04df (bia 0016.47e9.04df)

  Internet address is 10.0.0.47/24

  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, 100BaseTX/FX

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 00:00:02, output 00:00:02, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/4096/0/6 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: fifo

  Output queue: 0/4096 (size/max)

  5 minute input rate 1000 bits/sec, 4 packets/sec  --- Does it include 20 to 30bytes of Ethernet header per paecket in this average rate?

  5 minute output rate 25000 bits/sec, 3 packets/sec --- Does it include 20 to 30bytes of Ethernet header per paecket in this average rate?

     3556080 packets input, 225842679 bytes

     Received 1483940 broadcasts, 0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 watchdog

     0 input packets with dribble condition detected

     2257306 packets output, 1751375346 bytes, 0 underruns

     0 output errors, 0 collisions, 3 interface resets

     0 unknown protocol drops

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier

     0 output buffer failures, 0 output buffers swapped out

[paolo bevilacqua]

For a layer 2 interface, it should include Ethernet header and CRC. But you should double check looking at the input bytes counter, because sometime there are bugs in this regards.

[ricart.cortinas]

Thanks Paolo for your comment.

In any case, on a Cisco 7200 or ASR1000 routers, I understand a Gigabit Interface is treated as layer 2 interface, even when definning subinterfaces per vlan.

Expanding my question:

Should I expect that bps (bits per second) counter and pps (packet per second) counter are updates separately? I mean, not relationed by an arithmetic formula...

Thanks in advance. Comments are wellcome.

[paolo bevilacqua · Accepted solution]

On a 7200 routers, a gigabit ethernet is a layer 3 interface, and chances are is that layer 2 overhead is not included in counters.

Bits per second are calculated with a time-biased formula that has never been divulged.

However the input to bitsp per second is the interface counter, so they are directly related.

[ricart.cortinas]

That helped me very much.

You sound really much more sure than myself unable to find any related document explainning clearly this point.

Thanks for your comments.

[paolo bevilacqua]

Thanks for the nice rating and good luck!