interface input errors

[Integration Support]

we see input errors on interface Gi0/1 on cisco 1941/K9

Also after resetting counters we see those errors is cumulative once to 2-3 hours

Any suggestions where to start ?

In show logging there is no output from today at all ..

#sh int gi0/1
GigabitEthernet0/1 is up, line protocol is up
  Hardware is CN Gigabit Ethernet, address is bc16.2222.1111 (bia bc16.2222.1111)
  Description: to LAN-Lehavim
  Internet address is 172.16.55.2/29
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 3/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full Duplex, 1Gbps, media type is RJ45
  output flow-control is unsupported, input flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters 07:15:19
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/1024 (size/max)
  30 second input rate 5911000 bits/sec, 2439 packets/sec
  30 second output rate 14787000 bits/sec, 2919 packets/sec
     72815038 packets input, 3854388881 bytes, 0 no buffer
     Received 16169 broadcasts (5648 IP multicasts)
     0 runts, 0 giants, 0 throttles
     46 input errors, 0 CRC, 0 frame, 46 overrun, 0 ignored
     0 watchdog, 16164 multicast, 0 pause input
     78723290 packets output, 1917039290 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     870 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

Yesterday it was on 1120 errors .

In show processes cpu his there is no spikes

[Mark Malone · Accepted solution]

Hi you have input errors and overruns at the same time

this means your over utilizing the interface , too much traffic coming in , buffers are filling up and dropping traffic when its maxed

This is Cisco answer to overruns

In a small number of cases, the overrun counter may be incremented because of a software defect. However, in the majority of cases, it indicates that the receiving capability of the interface was exceeded. Nothing can be done on the router that reports overruns. If possible, the rate that frames are coming should be controlled at the remote end of the connection. Otherwise, if the number of overruns is high, the hardware should be upgraded.   

[Integration Support]

Thank you mark .

Please correct me if I'm wrong, in order to troubleshoot this its either to:

1- configure netflow and see who's trying to use all interface bandwidth .

2- configure aggregation (two interfaces towards the switch)

Am I wrong , or is there any other option ?

[Mark Malone]

Hi

netflow is a your best chocie there for seeing whats happening  , you could bulk up throughput as well but you will need to monitor make sure the traffic is not all going down 1 link , if it is try set the LB to this....port-channel load-balance src-dst-port , it works well for us on our etherchannels splitting traffic across them

ip accounting may also be supported on that router still that will show you the heavy users as well

[Integration Support]

we just found that there was a spikes in specific hours toward our server that backups all informations to it ..

can you guide me on how to traffic shape traffic on Gi0/1 towards specific external IP address ?

I've tried this configuration
http://www.darylhunter.me/blog/2009/06/cisco-ios-fu-1-traffic-shaping-based-on-acl.html
but this ACL way:
access-list 101 permit ip any host 1.1.1.1
access-list 101 permit ip host 1.1.1.1 any
access-list 101 deny ip any any

but 'traffic-shape' command is Unrecognized command

[Mark Malone]

Its a 1941 so you would be able to use MQC qos and apply a service policy each side and restrict thee traffic based on access-list subnet or even the DSCP value of the traffic , if its backup traffic its using some type of DSCP value , you could restrict traffic based on that so it only restricts backup traffic

heres a couple of docs with good examples of MQC  , you don't have to get to advanced with it if you don't want you could just restrict that type of traffic only and allow everything else as normal  , give it 10% of the link only or whatever you feel you need to stop the oversubscribing

https://supportforums.cisco.com/document/32286/common-qos-configurations-wan-link-using-mqc

https://edennington.wordpress.com/2013/08/09/simplified-qos-on-3850-with-mqc/

[Integration Support]

Thank you

So based on my uderstanding I configured it this way:

interface GigabitEthernet0/1
  service-policy output SRV_BKP_policymap

class-map match-any SRV_BKP
 match access-group 101

policy-map SRV_BKP_policymap
 class SRV_BKP
  bandwidth 500000

access-list 101 permit ip any host 1.1.1.1
access-list 101 permit ip host 1.1.1.1 any
access-list 101 deny   ip any any

[Mark Malone]

Yes that concept looks good restricted to 50mb and I presume your 1.1.1.1 is what the server ip would be , just make sure you see the packets hitting the queue with the show policy-map interface g0/1, clear your counters globably --clear counters and then let it run for a day or too and make sure your still not receiving overruns

if you find its bursting past the 50mb still causing issues as qos is one of those things you need to tweak until exactly right , I would then police the interface as that will drop anything over 50mb

[Integration Support]

Many thanks to you man

Now I see no errors on the specific interface :)

[Mark Malone]

Sounds good ;)

[Alimarefat]

Hi Mark,

I am facing an almost same problem but I only have input errors nothing else. I am sure this link bandwisth is always fully utilized. Could it be the reason or we have L1 problem? I have tried changing the Cable already but it didnt help.

WISKL-WKL-CE01-M1.iM(config)#do sh int gi0/0/1

GigabitEthernet0/0/1 is up, line protocol is up

  Hardware is ISR4221-2x1GE, address is 5c5a.c76f.f271 (bia 5c5a.c76f.f271)

  Description: *** CONNECT TO LAN NETWORK ***

  Internet address is 58.27.67.1/28

  Full Duplex, 1000Mbps, link type is auto, media type is RJ45

     21112 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     165595770 packets output, 122077067232 bytes, 0 underruns

     0 output errors, 0 collisions, 0 interface resets

     0 babbles, 0 late collision, 0 deferred

[KTNC19899]

@Alimarefat and all 

Let me know this issue is still or solve? I also face like this. Kindly let me know how to solve for this issue.

With Sincerely

[KTNC19899]

HI All , 

             In this period facing these issue is there any impact to your network kindly let me know. As for me , I have no impact on this but I'm worried about that it 'll be impact in the future. 

With Sincerely,.

[Alimarefat]

Hi,

it was a SFP problem in my case. After replacing it the problem has been resolved.

regards,

[suyog16.sk1]

By changing negotiation settings if e.g. 100/full change it to auto/auto on the respective interface will clear input errors.