RT-N66U - Odd SNMP Behavior for br0 (378.55)

[Trebonious]

Hello everyone,

I was previously running 378.54_2. I setup a small Raspberry Pi 2 to play around with and setup Cacti along with standard SNMP Interface graphing. I did not want to run the graphing on the RT-N66U due to the single 600 mhz processor. During my reviews I notices that br0 looked like the closest match to actual traffic usage (and according to this thread "...Normally vlan1, eth1 and eth2 are bridged into br0")

Fast forward a couple weeks and I see that 378.55 is out and I upgrade to that new firmware. The procedure (right or wrong) I used is as follows:

1. Downloaded and loaded a USB drive with User NVRAM Save/Restore Utility (R19)
2. Inserted the drive into the router
3. Ran the utility to save user and system nvram variables to a shell script
4. Loaded 378.55 into the router
5. Logged back in to verify everything appeared correctly
6. Issued the command mtd-erase -d nvram to wipe nvram & then issued a halt and then unplugged the router for about 2 minutes
7. Plugged the router back in and waited for the router to become accessible
8. Once the router was accessible I enabled ssh to the router and logged back in
9. Ran the restore script with the clean option
10. Rebooted the router once more.

Everything appears to be running correctly, however, as you can see via the attached graph something has changed with the way br0 is reporting through SNMP.

Any ideas? Nothing has been changed via the graphing software.

Many thanks!

 

[RMerlin]

br0 would also include traffic between wifi (eth1/eth2) and Ethernet. You want eth0 or vlan1 for monitoring Internet traffic.

 

[Trebonious]

br0 would also include traffic between wifi (eth1/eth2) and Ethernet. You want eth0 or vlan1 for monitoring Internet traffic.

I appreciate the update Merlin. Any idea on why br0 changed so dramatically in 378.55? I don't generally have anything that connects locally (no NAS, media streaming, etc going on). Perhaps the change in br0 now only reflects local communications? Going from roughly 800Kb/s to less than 1Kb/s was just large enough to ask about.

None the less I am looking at the other options available now!

Thanks.

Edit: Spooky. I guess the forum move lost his update.

 

[RMerlin]

I appreciate the update Merlin. Any idea on why br0 changed so dramatically in 378.55? I don't generally have anything that connects locally (no NAS, media streaming, etc going on). Perhaps the change in br0 now only reflects local communications? Going from roughly 800Kb/s to less than 1Kb/s was just large enough to ask about.

No idea. You would have to sniff out the traffic to see what's getting transferred.

 

[unknown14725]

I have the same problems as you, Trebonious. I spent a lot of time (weeks) trying to figure out which interface could be used for reliable WAN (internet) statistics, and when I finally found the interface to use, it would suddenly change into something completely different later on. And I struggled a lot trying to figure out why it would change.

The solution I found is to make sure hardware acceleration is off by simply enabling IPTraffic. This will ensure that br0 can be used to graph WAN (internet) traffic. I'm unsure if it is IPTraffic - or the disabled HW acceleration itself - that results in this, though. Anyway, it solves the problem permanently.

However, if you do various changes to the config, the system will sometimes re-create its interfaces, resulting in duplicate interfaces with the same name. Only way I've figured to detect this problem, is to count ifNumber (and have an alert if it changes above a specific value), and then simply do a reboot of the router. Not a big issue really.

See example screenshot here to see what the different interfaces are after enabling IPTraffic:
(I have no idea what the eth0 interface is for now, though. It's definitively NOT counting WAN/Internet traffic anymore)

 

[jrelax]

How are you getting clients and radio information to graph it?