IT management data types

Data is passed from managed devices to a Network Management System (NMS), such as NPM, as a stream of bits that are assembled into frames, packets and Protocol Data Units (PDUs). The exact method of decoding the bit streams to IT management data is beyond the scope of this paper. What is important here is to understand some of the properties of the data types. This will help you understand how the data can be used and some inherent limitations.

Below is a list of the most common data types used in network management.

Data Type	Properties
Counter	A 32 or 64-bit positive number with the maximum value depending on the bit size. (232-1 or 264 -1). Counters increase in size until they reach their bit limit when they begin counting again at zero plus the remainder of the last counter update. This is known as counter rollover. Counters are used to count bits transmitted or received as well as other similar data. Example: an automobile’s odometer.
Gauge	A 32-bit number which may increase or decrease in value but not exceed 232-1. Gauges are used for data that varies upward and downward often, such as CPU load, but can also be used for static information like interface speed. Example: an automobile’s tachometer.
Integer	A 32-bit number typically used to indicate an object state, such as 1=up, 2=down, 3=unknown.
IP Address	32-bit dotted decimal for IPv4 or 128-bit hexadecimal for IPv6 indicating the IP address of a node.
Network Address	32-bit dotted decimal for IPv4 or 128 bit-hexadecimal for IPv6 indicating a network or subnet.
Object Identifier	Dotted decimal string indicating a position within a MIB.
Octet Strings	Byte strings used to indicate text or layer 2 addresses.
Time ticks	A 32-bit number used to measure time in 1/100ths of a second.

Raw vs. cooked data

Some data is displayed as raw, unaltered data. A CPU gauge is a good example, displaying in the same value as was collected. For other data types, displaying raw data would be of little use.

For example, the number of bytes received on an interface is raw, counter data. In a polling cycle the NMS might receive a number such as 456723. All this number means is that since the interface counter was reset, or possibly rolled over, 456723 bytes of data passed through the interface. Displaying this data as– is using a gauge would be meaningless. This data must be processed before it can be shown as useful information. The result is sometimes known as cooked data. It is common to use both raw and coked data in IT management.

The below table shows how polled interface utilization data is cooked into useful information.

Poll Time (Seconds) Raw, Absolute	Raw Polled Data (Agent Counter Octets) Raw, Absolute	Data Delta (This poll minus last) Cooked, Absolute	x8 (Bytes to bits) Cooked, Absolute	Bits per second Cooked, Relative	Percent Utilization (1.544 Mbps) Cooked, Relative
0	2156	Null	Null	Null	Null
540	175769	173613	1388904	2572	0.17
1080	3287098	3111329	24890632	46094	2.99
1620	8760987	5473889	43791112	81095	5.25
2160	68734870	59973883	479791064	888502	57.55
2700	98965567	30230697	241845576	447862	29.01
3240	200159898	101194331	809554648	1499175	97.10
3780	265159898	65000000	520000000	962963	62.37
4320	265329899	170001	1360008	2519	0.16

 

As shown in the table, raw data goes through four operations before it is readily usable information, the percent utilization of the T-1 interface.

Absolute vs. relative data

The above table contains two data types that are commonly confused with one another. The first four columns contain absolute data. In column three, the numbers are a result of subtracting a counter number from the latest counter number. The result is still an absolute count. The multiplication by 8 to convert units does not change the fact the data is just a count, and still absolute. The next calculation to bits per second creates a rate, which is relative data. Once data is relative, it remains relative unless the operation that converted it is reversed. In the last column, Percent Utilization, the data is relative.