NM-NAM: Questionable traffic statistics in Diffserv Real-Time

[Kevin Melton]

I have been working for a year at a client whom has an NM_NAM installed on each 3800 router on opposite ends of an MPLS circuit.  We have configured the NM-NAM to monitor traffic statistics in the Class of Service using Diffserv.

We use an AT&T MPLS circuit.  The configuration is as follows:  We do not use Class of Service 1.   We use Class of Service 2 (af31) for our most important applicaiton.  We use Class of Service 3 (af21) for most of our Windows user traffic.  We then have the Default Class - Class 4 for the rest of the data.  Bulk data applications typically reside here according to AT&T.

Back to the NAM.  Our MPLS circuit is two T1's bundled together for a collective bandwidth of 3 MG.  The issue is that when I display traffic statistics for each class of service in Real Time, it shows much more than 3 MG being used.  It actually shows Default class running at 3 MG, and then 120K being used for Class 2.

Has anyone ever observed this behaviour before.  What could be the issue with the display of the data not adding up to the avialable bandwidth.  Why would it actually show that we are using more bandwidth than our capacity?

Thanks

Kevin

[Joe Clarke · Accepted solution]

I haven't heard of any pervasive cases of such problems.  Does "show policy" agree or disagree with what the NAM says?  If you sniff some of this traffic in the NAM, do you see any duplicate packets?

[Kevin Melton]

There is definitely a difference in what sho policy on the router says and what the NAM shows.  This circuit is only 3 MG.  We have a policy in place for the classes mentioned Joe.  The NAM shows 3 mg going thru Default class alone and then shows 120K going thru for Class 2.  So the NAM is reporting that we are using more than 3 meg on the pipe...

Maybe I will capture some packets and ship them into Wireshark and see if I can determine traffic volume...

Thanks for your answer.  Do you have a NAM?

Kevin

[Joe Clarke]

I was just curious to see if perhaps the pipe was actually wider than 3 Mbps, but AT&T only sold you "3 Mbps".  If the show policy counters agreed with the NAM, that would have confirmed.  Yes, we have an NM-NAM in our lab, but we aren't tagging traffic (and we don't have that much).  If this looks like a NAM bug, you could open a service request, and perhaps the NAM developers could offer some insight.