Cisco – How to learn current ACLs on a Cisco router’s interface

I would say that they are not designed to do the same things. ASA have powerful CPU so that can handle large numbers of packets with very large/complex access-list. Newer version of IOS can do stateful inspection but it's cpu intensive.

ACL (used for ip filtering) on router were originally designed to filter network to network flow using only short access-list. This works on the ASIC and is very very fast. Today you can do more powerful filtering but it will need to be done on the CPU and a router's CPU tends to be less powerful than that in a firewall.

So I would use short ACLs on routers handling large amounts of traffic, which will run on the ASIC. I would use complex ACLs (CBAC & cie) on a router that will only have small amounts of traffic to filter. But I would use an ASA to filter traffic from one network to another because you will need large and complex ACLs that won't run on a router ASIC and will be passing too many packets for the router handle that with it's CPU.

I'm not a switch designer, so so in terms of what the cost would be to monitor at this frequency I can't say.

What I can say, is that I have run into the situation where even a second isn't always enough because you can overun the buffers in periods shorter than a second. So if you want to know if a link is maxed out, I recommend looking at the dropped packets (You can monitor this via SNMP as well). If you are dropping packets (a few here there is okay, but a lot is not good) then you are demanding more than the interface can handle. This can also happen on your servers before they even hit the switch. The precise rate of dropped packets generally isn't important, but if they keep increasing each show interface you are likely in a bad place.

In terms of Cacti, that is not a limit of the switch or SNMP. SNMP records the bits sent and received as an increasing counter, so if you poll every second, you will get per second resolution. The way it works is the time stamp of each sample is taken along with the current count. It then takes the difference and expresses it in units of "per second" but in reality is is really a per 5 minute rate converted or expressed as per second.

If you try polling SNMP every second though, you better watch your CPU.