Buffer Pools - Huge buffers being utilised on router.

[kfarrington]

Hello,

I have a question in regards to router buffer pools.

I read this off a cisco page :-

There are six buffer pools:

Small—104 bytes buffers

Middle—600 byte buffers

Big—1524 byte buffers

VeryBig—4520 byte buffers

Large—5024 byte buffers

Huge—18024 byte buffers

For example, if an interface processor needs to pass a 20 byte packet to the RP, it “asks” for a Small buffer. If an interface processor needs to pass a 500 byte packet to the RP, it asks for a Middle buffer, and so forth.

Note: The interface processor must ask for a buffer of a certain size.

Question is, why is my router requesting huge buffer pools from my buffers list and while there are no buffer failures, should I increase the buffers for the huge pool.

All the details are in the attached file to show you the interface and the buffer pools.

Also, I would not have packets entering the serial or being received off the serial with a packet size greater than 1518 bytes, even thought the serial MTU is 4k. So why would anything higher than the Big buffer pool get utilised?

Many thx for your help with this,

Ken

[Georg Pauwen]

Hello Ken,

the only way I can think of generating 18024 byte size packets is by using the extended PING command on the router and specifying the size as 18024. Can you check if somebody might have tried that ?

Regards,

GP

[kfarrington]

Hey fella, many thx for the reply on a Sunday :)

I have just checked and there is no-one on this device except me :(

Also, this is continually incrementing - you can see from the two outputs below.

Unless there is some router process such as SNMP, or other router generated packet that is doing this?

Kindest regards,

Ken

WANROUTER#sh clock

21:14:20.635 GMT Sun Nov 20 2005

WANROUTER#sh buffer

Buffer elements:

499 in free list (500 max allowed)

753454825 hits, 0 misses, 0 created

Public buffer pools:

Small buffers, 104 bytes (total 1024, permanent 1024):

1016 in free list (128 min, 2048 max allowed)

162869247 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Middle buffers, 600 bytes (total 512, permanent 512):

510 in free list (64 min, 1024 max allowed)

40905391 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Big buffers, 1536 bytes (total 500, permanent 500):

499 in free list (64 min, 500 max allowed)

65995710 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

VeryBig buffers, 4520 bytes (total 10, permanent 10):

10 in free list (0 min, 100 max allowed)

164773 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Large buffers, 5024 bytes (total 2, permanent 2):

2 in free list (0 min, 10 max allowed)

0 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Huge buffers, 18024 bytes (total 4, permanent 2, peak 258 @ 1w6d):

4 in free list (0 min, 4 max allowed)

116156852 hits, 408775 misses, 817703 trims, 817705 created

0 failures (0 no memory)

Interface buffer pools:

PXF-TO-RP IPC POOL buffers, 1024 bytes (total 512,

text ommitted....

Header pools:

WANROUTER#

WANROUTER#sh clock

21:15:50.619 GMT Sun Nov 20 2005

WANROUTER#sh buffer

Buffer elements:

499 in free list (500 max allowed)

753470597 hits, 0 misses, 0 created

Public buffer pools:

Small buffers, 104 bytes (total 1024, permanent 1024):

1023 in free list (128 min, 2048 max allowed)

162872437 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Middle buffers, 600 bytes (total 512, permanent 512):

510 in free list (64 min, 1024 max allowed)

40906367 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Big buffers, 1536 bytes (total 500, permanent 500):

499 in free list (64 min, 500 max allowed)

65996852 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

VeryBig buffers, 4520 bytes (total 10, permanent 10):

10 in free list (0 min, 100 max allowed)

164777 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Large buffers, 5024 bytes (total 2, permanent 2):

2 in free list (0 min, 10 max allowed)

0 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory)

Huge buffers, 18024 bytes (total 4, permanent 2, peak 258 @ 1w6d):

4 in free list (0 min, 4 max allowed)

116159500 hits, 408793 misses, 817739 trims, 817741 created

0 failures (0 no memory)

Interface buffer pools:

PXF-TO-RP IPC POOL buffers, 1024 bytes (total 512, text ommitted....

Header pools:

WANROUTER#

WANROUTER#sh users

Line User Host(s) Idle Location

* 2 vty 0 This is me idle 00:00:00 My IP Address

Interface User Mode Idle Peer Address

WANROUTER#

[Georg Pauwen]

Hello,

weird indeed. Can you try and put an access list on your router interface(s) allowing everything, but with the 'log-input' keyword ?

Regards,

GP

[kfarrington]

Unfortunatley this is something I cannot do, but I do think it may be SNMP related as the SNMP max-packet size is 8192 bytes

117559366 SNMP packets output

0 Too big errors (Maximum packet size 8192)

2108 No such name errors

67 Bad values errors

0 General errors

117558664 Response PDUs

702 Trap PDUs

SNMP global trap: enabled

I will try and see what I can do in regards to potentially putting a sniffer on one of the interfaces and see what I can find.

The things is, as with an ACL, this may not capture anything of two much importantance as I can only capture traffic after it has been transmitted by the interface transmit ring, and would be fragmeneted by the interface MTU, but I suppose if I can see traffic going out on the E3 with a packet size 4470 bytes and even when it does out on a gigethernet port I would be able to reconstruct the packet as the IP fragment flags field, the IP ID and fragment offset, as they will be available for me to rebuild the entire packet.

I will give this a go.

Thx for the feedback thus far with this :)

I will report back on my findings.

Kindest regards,

Ken