Lab 09-04 · Graphs¶

Your phone's Screen Time does not just tell you that you are using Instagram right now. It tells you that last Tuesday you spent three hours on it, and that this week you are 20 % above average. Numbers over time answer questions that a single "now" never can: is it getting worse? when does it happen? is this normal?

The traffic monitor and Torch from the previous lab show now. In this lab r1 starts keeping a diary of its traffic, its queues and its CPU, and draws it as graphs you can open with a browser.

The router's diary¶

Graphing (Tools → Graphs) makes RouterOS record, at regular intervals, the traffic of interfaces and queues and the use of CPU, memory and disk, and publish it as images on its web server under /graphs/.

The analogy for this lab: the router keeps a diary. Every 5 minutes it writes one line: "this much traffic, this much CPU". From those lines it draws four pictures for each thing it watches:

You choose what goes in the diary (which interfaces, which queues, resources) and who may read it (allow-address). With store-on-disk=yes the diary survives a reboot.

flowchart LR
    subgraph R1["r1"]
        G["<b>Graphing</b><br>the diary<br>one line every 5 min"]
        W["<b>www service</b><br>port 80<br>/graphs/"]
        G --> W
    end
    PC["<b>pc1</b><br>allowed reader<br>192.168.88.0/24"]
    X["anyone else<br>not allowed"]
    W -->|"graphs"| PC
    W -.->|"empty page"| X

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>/big.bin 50 MB"]
    CAP["<b>class-ap</b><br>10.0.0.1 · 198.51.100.1"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>10.0.0.x by DHCP"]
        BR["<b>bridge1</b><br>192.168.88.1/24<br>http://192.168.88.1/graphs/"]
    end
    PC1["<b>pc1</b><br>your laptop<br>DHCP 192.168.88.x"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    WAN --- BR
    BR ---|"ether3"| PC1

Start the lab¶

Download the lab files and unzip them: 09-04-graphs.zip. Open a terminal inside the 09-04-graphs folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. Then open the router and the laptop:

ssh admin@clab-mtcna-09-04-r1                 # password: admin
docker exec -it clab-mtcna-09-04-pc1 bash

At any moment, CLAB_EXEC="docker exec" ./check.sh tells you what is already solved.

Step 1 · Open the empty diary¶

On pc1, ask for the graphs page. pc1 has no browser, so use curl and strip the HTML tags to read the text:

curl -s http://192.168.88.1/graphs/ | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' '; echo

Expected: only the title, Graphing | r1 | RouterOS Traffic and system resource graphing. The page exists, but there is nothing in it: nobody has told the router what to record.

On r1, check the web server and the graphing settings:

/ip service print where name=www
/tool graphing print

Expected: www on port 80, and graphing with store-every: 5min.

Done when you have seen the empty page.

Step 2 · Record the interfaces¶

WinBox: Tools → Graphs → Interface Rules → +. Interface all, Allow Address 192.168.88.0/24, Store on Disk ticked.

/tool graphing interface add interface=all allow-address=192.168.88.0/24 store-on-disk=yes
/tool graphing interface print

allow-address=192.168.88.0/24 means: only computers on the LAN may see these graphs. The default, 0.0.0.0/0, would show your traffic to anyone who can reach the router's web server.

Done when the rule is listed.

Step 3 · Record the resources (CPU, memory, disk)¶

WinBox: Tools → Graphs → Resource Rules → +. Allow Address 192.168.88.0/24, Store on Disk ticked.

/tool graphing resource add allow-address=192.168.88.0/24 store-on-disk=yes

Done when /tool graphing resource print shows the rule.

Step 4 · Record a queue¶

Queue graphs need a queue to draw. You met simple queues in Module 7; add one that covers the whole LAN, so there is something to record.

WinBox: Queues → Simple Queues → +: Name lan-total, Target 192.168.88.0/24, Max Limit 10M / 10M. Then Tools → Graphs → Queue Rules → +: Simple Queue all, Allow Address 192.168.88.0/24.

/queue simple add name=lan-total target=192.168.88.0/24 max-limit=10M/10M comment="whole LAN, so there is a queue to graph"
/tool graphing queue add simple-queue=all allow-address=192.168.88.0/24 store-on-disk=yes

Done when /tool graphing queue print shows the rule.

Step 5 · Open the diary again¶

On pc1:

curl -s http://192.168.88.1/graphs/ | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' '; echo

Expected, now: Resources CPU usage Memory usage Disk usage Queues You have access to 1 queue: lan-total Interfaces You have access to 5 interfaces: bridge1 ether1 ether2 ether3 lo.

Each name is a link. The graphs of one port live under /graphs/iface/<name>/, and each period is an image:

curl -s -o /tmp/ether2-daily.gif http://192.168.88.1/graphs/iface/ether2/daily.gif
ls -l /tmp/ether2-daily.gif

/tool graphing interface add interface=all allow-address=172.31.255.28/30 comment="containerlab: browser on the host"
/tool graphing resource add allow-address=172.31.255.28/30

Done when the page lists interfaces, a queue and the resources.

Step 6 · Generate traffic and find it in the diary¶

On pc1, download the big file and let it run to the end (about 7 minutes at the CHR's 1 Mbps):

curl -o /dev/null http://198.51.100.10/big.bin

When it has finished, wait for the next 5-minute mark and look at the daily graph of ether2 (and of the lan-total queue) again, in the browser or by downloading the GIF.

Expected: a block of about 1 Mbps of in traffic on ether2, the same in the queue graph, and a small bump in CPU usage.

Done when the download is visible in the graphs. Run CLAB_EXEC="docker exec" ./check.sh: it must end with RESULT: lab solved.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• Graphing records interfaces, queues and resources every 5 minutes and draws daily, weekly, monthly and yearly graphs.
• Rules are added per type: /tool graphing interface, queue and resource.
• allow-address decides who may see the graphs; everyone else gets an empty page.
• Graphs are served by the www service at http://router/graphs/.
• Graphs show the past; the traffic monitor and Torch show now.

Quick check¶

Next: graphs are nice for one router. A company with fifty routers wants one program that asks them all. That is SNMP.