Bug in SNMP information for DHCP

RouterOS General
1

I want to keep some statistics about number of DHCP leases on a subnet, and plot them in MRTG.
Unfortunately I see no value in SNMP that just totalizes the number of active leases.
Checking with “snmpwalk” I saw there is information under an “experimental” oid: mib-2.9999.1.1.6.4.1.5
There is a listing of remaining leasetimes. That is acutally nice, I can generate two figures, the number of
leases still active in the server and the ones that have been refreshed today.

So I wrote a small script to get this and return it in MRTG compatible format:

#!/bin/bash
# get number of active DHCP leases from MikroTik router

tmp="/tmp/getmikrotikdhcp.out"
maxlife=604800
active=568800

snmpbulkwalk -Os -v2c -c public router.local mib-2.9999.1.1.6.4.1.5 2>/dev/null | \
    sed -e 's/.*Gauge32: //' >$tmp

num_leases=`wc -l <$tmp`

num_active=0

while read expires_after
do
    if [ $expires_after -gt $active ]
    then
        ((num_active++))
    fi
done <$tmp

echo $num_active
echo $num_leases
echo "0 days, 0 hours"
echo "DHCP"

rm -f $tmp
exit 0

This worked quite well initially.
I should add that the network is a /22 and the DHCP server hands out 192.168.244.10 - 192.168.247.250
While the assigned addresses were all in the 192.168.244 range SNMP neatly returned all the active
addresses and they were evalutated correctly. Now the first range is full and addresses from 192.168.245
are being assigned, but now the snmpbulkwalk fails like this:

mib-2.9999.1.1.6.4.1.5.192.168.245.0 = Gauge32: 604686
mib-2.9999.1.1.6.4.1.5.192.168.245.1 = Gauge32: 603789
mib-2.9999.1.1.6.4.1.5.192.168.245.2 = Gauge32: 604695
mib-2.9999.1.1.6.4.1.5.192.168.245.3 = Gauge32: 604630
mib-2.9999.1.1.6.4.1.5.192.168.245.4 = Gauge32: 599313
mib-2.9999.1.1.6.4.1.5.192.168.245.5 = Gauge32: 603095
mib-2.9999.1.1.6.4.1.5.192.168.245.6 = Gauge32: 603146
mib-2.9999.1.1.6.4.1.5.192.168.245.7 = Gauge32: 600636
mib-2.9999.1.1.6.4.1.5.192.168.245.8 = Gauge32: 604477
mib-2.9999.1.1.6.4.1.5.192.168.245.9 = Gauge32: 602661
mib-2.9999.1.1.6.4.1.5.192.168.244.10 = Gauge32: 533130
Error: OID not increasing: mib-2.9999.1.1.6.4.1.5.192.168.245.9
 >= mib-2.9999.1.1.6.4.1.5.192.168.244.10

There appears to be some modulo-256 related bug in there, because 192.168.245.9 is not the last IP
address assigned in the 192.268.245 range, but 192.168.244.10 is the first address assigned and that
is where it wraps. When those addreses in the 245 range were not yet there, the SNMP walk started
at 192.168.244.10 and there was no problem.

2

Found that I can add -Cc tp snmpbulkwalk to make it ignore this non-increasing oid and go on, but then only up
to 256 entries are retrieved, even though there are more when I view them in the WebFig.
It looks like the entries are stored in a 256-element buffer which is used in modulo fashion…
Maybe I am lucky that it did not simply overwrite the buffer and crash the router?

3

This observation turns out to be incorrect. Not all entries are received above 256, but I was overlooking that a
few leases had expired at the moment I was checking this. Now there are 258 leases in the WebFig page and
the commandline interface, but SNMP returns 257. For practical purposes this is close enough, but of course
it is strange.