Switch and router ports

Port monitoring reads every port on your switches and routers over SNMP: how busy it is, its errors and discards, and whether it is up. It answers the questions a network manager asks every week: which links are full, which ports have a bad cable, what went down overnight, and how many ports each switch has left.

Turn it on

1. Make sure each switch and router has an SNMP sensor. Discovery adds an Uptime sensor to every network device that answers SNMP. Port monitoring uses the same community or SNMPv3 credential, version and port, so there is nothing else to enter.
2. Open Settings › Ports, tick Read ports on switches and routers and choose Save. Admins can also choose Turn on port monitoring on Devices › Ports.
3. The first ports appear within a minute or two. How busy a port is needs a second reading, one interval later; ports are read every 5 minutes unless you change Read every (minutes).

By default routers, switches, firewalls, wireless controllers and other network gear are read. Change Device types to read, add single devices under Also read these devices, whatever their type, or leave some out under Never read these devices. Busy at (% of the port speed) sets the busy level, 80% by default, and Unused after (days not up) sets when a port counts as unused, 30 days by default.

Tip: Each device gets a few hundred small SNMP requests per reading. Most switches don't notice; keep an eye on very old ones on the first day.

Reading Devices › Ports

The numbers at the top each open their list: Switches and routers, Ports, Up now, Busy now, With errors, Uplinks that went down and Unused 30+ days. Below them are six lists, each with a site filter and a search box:

• Busiest: ranked by the 95th percentile of in or out use, now or over the last 24 hours, 7 days or 30 days, with the peak, the average and the last 3 hours.
• Errors: errors and discards per minute now, or totals over the period. Errors usually mean a cable, duplex or hardware fault; discards usually mean the port was too busy.
• Went down: uplinks whose link went down in the period, the ones still down first. Access ports go down whenever the computer behind them is switched off, so untick Uplinks only to see every port. A port that went down three times or more is marked flapping.
• Unused: per switch, the ports in use, the ports not up now and the ports not up for 30 days or more, for capacity planning.
• All ports: every port with its status, speed, use, errors and what is connected to it, from LLDP or CDP or the number of MAC addresses seen on it.
• Devices: every device that is read, when it was last read and, if a read failed, why.

Uplinks only keeps aggregates, WAN links, 10 Gbit/s ports, ports with a switch or many MAC addresses behind them, ports described as uplinks, and watched ports. VLAN interfaces and tunnels are hidden unless you tick VLAN and virtual interfaces. Download CSV gives the whole list, up to 5,000 rows.

Watch an important port

Click any port for its chart over 6 hours to 30 days, in Mbit/s or as a share of the port speed, with status changes marked and errors shown as bars. Admins can choose Watch this port: it adds three sensors to the device, in, out and status, that check every minute and alert like any other sensor. Status goes Down whenever the port isn't up, and in and out turn Warning at the busy level. Stop watching removes them.

Each device's dialog also has a Ports section with every port, and Read now for operators and admins. The device's timeline lists important ports going down and coming back: uplinks, aggregates, WAN links and watched ports.

Good to know

• Port history stays on the collector: 5-minute points for 2 days and hourly points for 30 days by default (change both under Advanced). Port monitoring adds no new secrets; it uses the SNMP access each device's own sensors already have.
• Status changes are seen at each reading, so a port that drops and recovers between two readings isn't noticed. Watch the port to check it every minute.
• Rates are averages over the interval, so a burst shorter than that shows as a smaller rise.
• A port marked 32-bit only has 32-bit counters, which can wrap more than once between readings on a fast port and read low. Read it with SNMP v2c or SNMPv3, which carry 64-bit counters, or read more often.
• Port monitoring reads over SNMP v1, v2c and v3, and only devices that have an SNMP sensor; the communities and SNMPv3 credentials discovery tries aren't used on their own.
• Unused ports are counted from when Monitaria first saw them. On Cisco switches, MAC counts cover the default VLAN only.
• By default, uplinks going down, coming back and showing errors are passed to other features such as webhooks and tickets. Change it under Tell other features (webhooks, tickets) when ports go down or show errors.