Monitoring time capsule bandwidth via MRTG?

I just had to figure this out on a Time Capsule, and since there is a lack of information on the Internet about the new models I did a bunch of trial and error.

Here's what I found:

1. They report the wrong interface speeds via SNMP, which is why cfgmaker is confused about the speeds.
2. They do SNMPv2 just fine.
3. cfgmaker is otherwise accurate.

I believe the interfaces are:

mgi0 LAN

mgi1 WAN

bwl0 2.4 Ghz Radio

bwl1 5.0 Ghz Radio

lo0 loopback

wlan0 2.4 Ghz Network

wlan1 5.0 Ghz Network

pppoe0 PPP Over Ethernet Client

bridge0 Internal bridge between wired an wireless

gif0 6in4 Tunnel

stf0 6to4 Tunneling

The architecture seems to be that mgi0 is attached to the 3-port switch for the LAN ports, so they all aggregate under that one interface. bwl0/wlan0 always report the same bits for 2.4G clients, bwl1/wlan1 the same bits for 5G clients. bridge0 bridges between mgi0, bwl0/wlan0, and bwl1/wlan1. I don't use pppoe, so I can't confirm what that shows, but I assume it's the traffic _inside_ the PPPOE session on the WAN, if used. gif0 is 6in4 tunneling, and stf0 is 6to4 tunneling.

The only thing I'm unsure about is the WiFi interfaces are set to 300Mbps/max in this config. I am unclear if this box can do 450Mbps throughput with the right clients.

A sample MRTG config file is below.

WorkDir: /path/to/your/files

Options[_]: growright,bits

WithPeak[_]: ymw

YSize[_]: 200

XSize[_]: 600

### Interface 1 >> Descr: 'mgi0' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_1]: 1:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_1]: 125000000

Title[10.0.1.1_1]: Traffic Analysis for mgi0 -- timecapsulename

PageTop[10.0.1.1_1]: <h1>Traffic Analysis for mgi0 -- timecapsulename</h1>

### Interface 2 >> Descr: 'mgi1' | Name: '' | Ip: '169.254.147.241' | Eth: '' ###

Target[10.0.1.1_2]: 2:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_2]: 125000000

Title[10.0.1.1_2]: Traffic Analysis for mgi1 -- timecapsulename

PageTop[10.0.1.1_2]: <h1>Traffic Analysis for mgi1 -- timecapsulename</h1>

### Interface 3 >> Descr: 'bwl0' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_3]: 3:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_3]: 37500000

Title[10.0.1.1_3]: Traffic Analysis for bwl0 -- timecapsulename

PageTop[10.0.1.1_3]: <h1>Traffic Analysis for bwl0 -- timecapsulename</h1>

### Interface 4 >> Descr: 'bwl1' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_4]: 4:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_4]: 37500000

Title[10.0.1.1_4]: Traffic Analysis for bwl1 -- timecapsulename

PageTop[10.0.1.1_4]: <h1>Traffic Analysis for bwl1 -- timecapsulename</h1>

### Interface 5 >> Descr: 'lo0' | Name: '' | Ip: '127.0.0.2' | Eth: '' ###

Target[10.0.1.1_5]: 5:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_5]: 125000000

Title[10.0.1.1_5]: Traffic Analysis for lo0 -- timecapsulename

PageTop[10.0.1.1_5]: <h1>Traffic Analysis for lo0 -- timecapsulename</h1>

### Interface 6 >> Descr: 'wlan0' | Name: '' | Ip: '' |

Target[10.0.1.1_6]: 6:public@10.0.1.1:::::2

SetEnv[10.0.1.1_6]: MRTG_INT_IP="" MRTG_INT_DESCR="wlan0"

MaxBytes[10.0.1.1_6]: 37500000

Title[10.0.1.1_6]: Traffic Analysis for wlan0 -- timecapsulename

PageTop[10.0.1.1_6]: <h1>Traffic Analysis for wlan0 -- timecapsulename</h1>

### Interface 7 >> Descr: 'wlan1' | Name: '' | Ip: '' |

Target[10.0.1.1_7]: 7:public@10.0.1.1:::::2

SetEnv[10.0.1.1_7]: MRTG_INT_IP="" MRTG_INT_DESCR="wlan1"

MaxBytes[10.0.1.1_7]: 37500000

Title[10.0.1.1_7]: Traffic Analysis for wlan1 -- timecapsulename

PageTop[10.0.1.1_7]: <h1>Traffic Analysis for wlan1 -- timecapsulename</h1>

### Interface 8 >> Descr: 'pppoe0' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_8]: 8:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_8]: 125000000

Title[10.0.1.1_8]: Traffic Analysis for pppoe0 -- timecapsulename

PageTop[10.0.1.1_8]: <h1>Traffic Analysis for pppoe0 -- timecapsulename</h1>

### Interface 9 >> Descr: 'bridge0' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_9]: 9:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_9]: 125000000

Title[10.0.1.1_9]: Traffic Analysis for bridge0 -- timecapsulename

PageTop[10.0.1.1_9]: <h1>Traffic Analysis for bridge0 -- timecapsulename</h1>

### Interface 10 >> Descr: 'gif0' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_10]: 10:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_10]: 125000000

Title[10.0.1.1_10]: Traffic Analysis for gif0 -- timecapsulename

PageTop[10.0.1.1_10]: <h1>Traffic Analysis for gif0 -- timecapsulename</h1>

### Interface 11 >> Descr: 'stf0' | Name: '' | Ip: '' | Eth: '' ###

Target[10.0.1.1_11]: 11:public@10.0.1.1:::::2

MaxBytes[10.0.1.1_11]: 125000000

Title[10.0.1.1_11]: Traffic Analysis for stf0 -- timecapsulename

PageTop[10.0.1.1_11]: <h1>Traffic Analysis for stf0 -- timecapsulename</h1>

I appear to have misspoke. It does not do SNMPv2c correctly. It does on some interfaces, some of the time.

I went back to SNMPv1 (remove ::::2 from the end of each target, e.g. 11:public@10.0.1.1:) and it's working fine. To be sure I have no counter wrap issues I also went to one minute polling, but that's probably overkill for most people.

One last post, as I think this will help people understand what they are seeing on the various graphs, here's the block architecture of a Time Capsule. I highly suspect a Extreme Base Station is the same thing but without a hard drive:

mgi0 is the WAN.

mgi1 is connected to an internal 4 port GigE switch that appears to not have any individual pollable ports via SNMP. The other three ports are exposed on the back of the unit as the LAN ports.

wlan0/wlan1 are the data connections for the 2.4Ghz and 5Ghz radios, respectively.

bwl0/bwl1 appear to be some sort of managmenet interface for the radios. They report outbound traffic only, never inbound. Traffic on these interfaces increases as traffic increases on the wlan0/wlan1 interfaces, but at a much lower rate.

bridge0 is a software bridge that sits between wlan0, wlan1, and mgi1 briding the WiFi's and LAN ports together. Traffic between any two of these three will pass the bridge interface.

pppoe0 is for tunneling PPP over Ethernet, if you use that on the WAN port, basically in that case mgi0 would be with PPPoE overhead, and pppoe0 would be without.

gif0 is 6in4 tunneling, if you have for instance a tunnel broker tunnel. Again, this would be traffic with no overhead, then as the packets go out mgi0 they would count there with the tunnel overhead.

sth0 is 6to4 (automatic) tunneling. Again, this would be traffic with no overhead, then as the packets go out mgi0 they would count there with the tunnel overhead.

Lastly, there's a SATA port to the disk in a Time Capsule.

Now if you graph all of them it should be easy to make sense of where the traffic is going and why!

Well.... nice drawing - but You state that mgi0 is WAN...it's not! mgi0 is LAN (ie. 3 x Eth. ports on the back) and mgi1 is WAN Interface 🙂

mgi0 = Lan Interface (ie. 3 x Eth. ports - total trafic)

mgi1 = WAN Interface (total trafic)

wlan0 = 2,4GHZ Network trafic (total)

wlan1 = 5GHZ Network trafic (total)

bwl0 = 2,4GHZ Management Radio Trafic

bwl1 = 5GHZ Management Radio Trafic

lo0 = Loopback

Bridge0 = If more Airport's is in bridge-mode, then "total trafic" between those - ie. if you have 2, 3 or 4 (maybe more) in bridgemode, then this would be "total trafic" to/from all of them!

I can't replicate trafic on Bridge0 to be "between" interface mgi0 and wlan0 or wlan1 - but I can see that trafic into my primary (master) Airport Extreem and several bridged (other) Airport's goes through Bridge0.

Cheers :-)

It's entirely possible I swapped the mgi0/mgi1 labels when making the drawing. I'm actually not using the Time Capsule as a router right now so I can't just check, but I'm going to set it back up to test a few things in 7.6.3 over the weekend and will double check what I see.

Yes, "bridge0" is a virtual interface that contains the sum of all traffic between the bridged interfaces. For instance if a packet comes in the WiFi and is routed out to the Internet, it would not appear on bridge0; however a packet that comes in the WiFi and goes out to the wired ethernet would count as 1 in + 1 out on bridge0.

I believe it operates substantially similar to FreeBSD's bridge(4) interface, here's the man page on it: http://www.freebsd.org/cgi/man.cgi?query=bridge&sektion=4

Basically the main block of the diagram is a unix box, probably some variant of OS X, with 2 WiFi and 2 wired ethernet ports. One of the wired ethernet ports is then connceted internally to a dumb 4 port switch chipset, which has the effect of expanding it into the 3 ports on the back for the LAN side. Given OS X's FreeBSD/NetBSD lineage and the fact that all the names match FreeBSD interface names I suspect the man pages for those fairly closely indicate how the various parts work.

I finally did some testing and you are correct, I had swapped the labels in my earlier attempt. An updated diagram:

I think you were originally correct bicknell! I am monitoring my TC right now and mgi0 is showing UP. I have my ethernet plugged into it and not to any of the 3 ethernet ports. mgi1 shows DOWN. Just my two cents. I think Hans is wrong....

That may depend up on which way is "up" from the point of view of a particular interface. To get the data from the various wlanN to agree with mgi1, I have to swap up/down on mgi1. For mgi0 it may be the same. A better mnemonic, instead of up/down might be in/out. What comes *in* wlan0 from my MacBook may go *out* mgi1 to the cable modem for me, for example.