Well, the short answer is that when an SNMP query goes out
and a response doesnt come back, MRTG has to assume something to put
in the graph, and by default it assumes that the last answer we got
back is probably closer to the truth than zero. This assumption is
not perfect (as you have noticed). Its a trade-off that happens to
fail during a total outage.
If this is an unacceptable trade-off, use the unknaszero option.
You may want to know what youre trading off, so in the spirit of
trade-offs, heres the long answer:
The problem is that MRTG doesnt know *why* the data didnt come back, all
it knows is that it didnt come back. It has to do something, and it
assumes its a stray lost packet rather than an outage.
Why dont we always assume the circuit is down and use zero, which will
(we think) be more nearly right? Well, it turns out that you may be
taking advantage of MRTGs assume last behaviour without being aware of
MRTG uses SNMP (Simple Network Management Protocol) to collect data, and
SNMP uses UDP (User Datagram Protocol) to ship packets around. UDP is
connectionless (not guaranteed) unlike TCP where packets are tracked and
acknowledged and, if needed, retransmitted. UDP just throws
packets at the network and hopes they arrive. Sometimes they dont.
One likely cause of lost SNMP data is congestion; another is busy routers.
Other possibilities include transient telecommunications problems, router
buffer overflows (which may or may not be congestion-related), dirty
lines (links with high error rates), and acts of God. These things
happen all the time; we just dont notice because many interactive
services are TCP-based and the lost packets get retransmitted
In the above cases where some SNMP packets are lost but traffic is
flowing, assuming zero is the wrong thing to do - you end up with a graph
that looks like its missing teeth whenever the link fills up. MRTG
interpolates the lost data to produce a smoother graph which is more
accurate in cases of intermittent packet loss. But with V2.8.4 and above,
you can use the unknaszero option to produce whichever graph is best
under the conditions typical for your network.