I'm using [GroundWork](http://www.groundworkopensource.com) (a monitoring framework built upon Nagios) to monitor some network devices via SNMP, but I'm stuck on a problem with bandwidth usage.

Most routers, including the Cisco 2800 used here, can be queried via SNMP for network traffic information; however, they return this information in the form of a counter, meaning "how many bytes have gone in or out of a given interface since the router was turned on". So, in order to get something meaningful out of this information, you need to, f.e. query this information each second and see how much each measure differs from the previous one.

Groundwork/Nagios can automatically manage this for performance data, because they use RRD for storing those data and RRD supports computing deltas between values.

But how can I generate an alert when bandwidth usage exceeds a certain limit? Nagios can send alerts only when a value is above a given threshold, not based on the difference between two distinct measures of the same value.

I need a way to check if bandwidth usage is above a certain threshold, and generate a Nagios alert (thus sending an e-mail) if this happens; I can't rely only on the admin looking at performance data to see if something is wrong with network bandwidth.