PDF

Monitoring of Network Interfaces

NetCrunch provides detailed monitoring of network interfaces for SNMP-enabled devices, combining flexible policy-based selection, full duplex-aware metrics, real-time delta calculations for errors and discards, VLAN and MAC mapping, CDP/LLDP-based topology view, and a best-in-class interface visualization and alerting system.

NetCrunch monitors network interfaces using a policy-driven approach that enables precise, automatic selection of interfaces to monitor. Monitoring is based on SNMP, allowing support for a wide range of network devices including switches, routers, firewalls, servers, and other equipment.

Each monitored interface provides detailed traffic, status, error, and topology-aware data, supporting advanced visualization and alerting capabilities.

Interface Monitoring Overview

When SNMP monitoring is enabled on a device, NetCrunch automatically adds an Interface Sensor to the node. This sensor uses a Monitoring Policy to determine which interfaces are included. Not all interfaces are monitored — typically, only those matching the configured policy (such as active, Ethernet, or IP interfaces) are selected.

Monitoring includes:

  • Bandwidth usage tracking
  • Admin and operational status
  • Errors and discards (delta-based)
  • VLAN and MAC address mapping
  • Interface grouping and visualization
  • Duplex-aware utilization tracking
  • CDP/LLDP-based physical segment discovery

Configuring Interface Monitoring

Monitoring Policies

Interface selection is driven by Monitoring Policies. Policies use filter expressions to automatically include or exclude interfaces based on criteria like type, status, or description.

Common built-in policies:

  • All – Includes all SNMP-reported interfaces.
  • All active (default) – Includes interfaces that are up and active.
  • Ethernet only – Selects only Ethernet interfaces.
  • IP only – Selects only interfaces with an assigned IP address.
  • Custom filter – Create a custom expression based on any available interface properties.

Policies can be selected during node configuration at
Node SettingsMonitoringInterfacesEdit Sensor Settings.

64-bit Counters

NetCrunch prefers 64-bit counters when available (device must support SNMPv2c or SNMPv3). 64-bit counters prevent overflow issues on high-speed links (such as 1 Gbps, 10 Gbps, or faster).

When 64-bit counters are unavailable, NetCrunch falls back to 32-bit counters but provides warnings if overflow risk is detected.

Interface Identification Templates

Correctly identifying interfaces across device reboots is crucial. SNMP indexes (interface IDs) can change, but names like ifAlias or ifDescr usually remain stable.

You can customize the identification template using tokens:

  • $ifAlias
  • $ifDescr
  • $ifName
  • $ifIndex

Example template:
$ifAlias|$ifDescr|$ifName

This instructs NetCrunch to use ifAlias first, then ifDescr, then ifName as fallback.

Template configuration is available at
Node SettingsMonitoringInterfacesIdentification Settings.

Monitored Metrics and Counters

NetCrunch monitors a wide range of interface metrics. Deltas are calculated automatically to provide rate-per-second values.

Counter Description
Admin Status Configured status (enabled or disabled by administrator).
Operational Status Actual operational state (up, down, testing).
Last Change Timestamp when interface state last changed.
Speed Current or overridden speed of the interface.
Bytes Received Total bytes received on the interface.
Bytes Received/Sec Rate of bytes received per second (delta).
Bytes Sent Total bytes sent from the interface.
Bytes Sent/Sec Rate of bytes sent per second (delta).
Errors Total packet errors detected.
Errors/Sec Rate of packet errors per second (delta).
Discards Total number of packets discarded.
Discards/Sec Rate of packet discards per second (delta).
Output Queue Length Number of packets currently queued for transmission.
% FD Bandwidth Utilization Full-Duplex bandwidth usage as a percentage of interface speed.
% HD Bandwidth Utilization Half-Duplex bandwidth usage as a percentage of interface speed.
Unknown Protocols Total number of packets received with unknown protocols.
Unknown Protocols/Sec Rate of unknown protocol packets per second (delta).

Speed Override

In real-world scenarios, the interface speed reported by SNMP might not match the actual usable link speed because:

  • Hardware limits and software configuration differ
  • Internet Service Providers assign logical speeds (e.g., 500 Mbps over 1 Gbps port)
  • Virtual interfaces report generic speeds
  • Speed autonegotiation issues or interface misreporting

To ensure accurate bandwidth utilization calculations, NetCrunch allows manual overriding of interface speed.

SettingsMonitoringInterfacesAdditional Interface Properties

Select the node, and its monitored interfaces are listed. For an interface you set:

  • Speed — the real link speed
  • Units — kbps, mbps or gbps

The interface name is shown but cannot be edited. You are correcting the figure NetCrunch calculates against, not renaming anything.

Overriding Speed Through the REST API

The same settings are available through the REST API, which is how you would apply an override across many nodes at once:

GET /api/rest/2/interfaceSettings/<node>
All settings defined for a node.
GET /api/rest/2/interfaceSettings/<node>/<ifIndex>
Settings for one interface.
PUT /api/rest/2/interfaceSettings/<node>/<ifIndex>
Set the settings for one interface.
DELETE /api/rest/2/interfaceSettings/<node>
Remove every override defined for a node.
DELETE /api/rest/2/interfaceSettings/<node>/<ifIndex>
Remove the override on one interface.

PUT accepts JSON. Speed is in bit/s here, unlike the console, which asks for a value and a unit separately:


{"speed": "64000000", "note": "overridden speed"}

Errors and Discards Tracking

NetCrunch tracks delta values for errors and discards:

  • Delta counters measure changes between polling intervals, not accumulated totals.
  • Users can reset counters at any time to start a fresh observation period.
  • This helps isolate intermittent issues such as cable faults, duplex mismatches, or congestion.

VLAN & Connected Device Insights

NetCrunch displays VLAN membership and connected devices directly within the interface view.

  • Each interface shows VLAN assignments
  • Side panel displays connected MAC addresses and IP mappings
  • Hovering or clicking on a VLAN column reveals full VLAN names and tags
  • Connected nodes are automatically linked if known in the Atlas

All this data is visible without external tools or config parsing.

Physical Segment Visualization

NetCrunch uses CDP and LLDP protocols to map physical Layer 2 links, including:

  • Aggregated (trunk) links
  • Port-channel interfaces
  • Bandwidth load on each segment
  • Topology views with click-through to live traffic stats

Interface links are drawn as network segments, and clicking them reveals:

  • Interface description
  • Traffic chart (Live, 24h, 7d, 30d)
  • Input/output byte counts
  • Errors and discards

Interface Grouping and Views

Interfaces can be grouped for better navigation and analysis.

Grouping Options:

  • By Switch
  • By VLAN
  • By Switch and VLAN
  • Ungrouped View

An upcoming release adds full grouping by VLAN across the Atlas — improving visibility into broadcast domains and tagged links.

Alerts for Network Interfaces

NetCrunch includes alerting options for:

  • Interface state (UP/DOWN)
  • Bandwidth utilization (%)
  • Errors and discards (by count or percentage)
  • Any other metric threshold

Threshold types include:

  • Value, Range, Deviation, Delta, Limit, and others

Alerts are policy-driven and can be reused across multiple nodes and groups.

Licensing and Interface Monitoring

  • Monitored interfaces consume license units
  • Default: monitors only active interfaces
  • Use filters to avoid monitoring:
    • Loopback interfaces
    • Tunnels or virtual devices
    • Disabled ports

What Makes NetCrunch Unique

  • Policy-based interface selection with reusable filters
  • Interface names identified via customizable templates
  • Bandwidth metrics include both Full- and Half-Duplex modes
  • Errors and discards are tracked as deltas, not just totals
  • VLANs and MAC addresses are fully visible
  • CDP/LLDP is used to draw Layer 2 topology
  • Users can override reported interface speed to ensure accurate utilization
  • Live views, graphs, and clickable topology map are built-in — no separate tools required

NetCrunch doesn’t just read interface counters — it understands network topology and presents actionable, integrated insights.

interfacesmonitoringnetworkroutersschemesswitches