Latency on network

[SACHIN SHARMA]

Hello ,

we are receiving complaints from office lan users regarding  slowness in accessing applications at remote site on 20M mpls link ,we configured top talkers and got the below ouput when the user complained about slowness.we see the traffic is destined to tunnel0 is consuming most of the bandwidth but there are no tunnels configured on the router ,can someone explain is it legitimate traffic or virus ?

KAL3626-WAN1#sh ip flow top-talkers

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes

Gi0/2 10.70.2.16 Tu0 10.18.0.19 06 01BD D2E4 30M

SM1/0 10.70.2.16 Gi0/0.347* 10.18.0.19 06 01BD D2E4 7828K

Gi0/2 10.70.2.16 Tu0 10.40.134.14 06 01BD F01B 3771K

Gi0/2 10.70.2.16 Tu0 10.40.130.51 06 01BD D435 3552K

SM1/0 10.18.0.19 Gi0/2* 10.70.2.16 06 D2E4 01BD 2960K

Gi0/2 10.70.2.16 Tu0 10.40.134.10 06 01BD CCE2 1685K

SM1/0 10.40.130.51 Gi0/2* 10.70.2.16 06 D435 01BD 1459K

SM1/0 10.40.134.14 Gi0/2* 10.70.2.16 06 F01B 01BD 1226K

SM1/0 10.40.134.10 Gi0/2* 10.70.2.16 06 CCE2 01BD 1175K

Gi0/0.347 10.18.0.19 Tu2 10.70.2.16 06 D2E4 01BD 896K

10 of 10 top talkers shown. 566 flows processed.

AGS3626-WAN1#sh run int gi0/2

Building configuration...

Current configuration : 186 bytes

!

interface GigabitEthernet0/2

description LAN ROUTING

ip address 10.254.252.145 255.255.255.248

ip wccp 61 redirect in

ip flow ingress

ip flow egress

duplex auto

speed auto

end

Em0/0 admin down down

Gi0/0 up up ATT MPLS Circuit ID

Gi0/0.347 up up

Gi0/1 admin down down

Gi0/2 up up LAN ROUTING

SM1/0 up up

SM1/1 up up Internal switch interface connected to Service Module

Tu0 up up

Tu1 up up

Tu2 up up

Vl1 up up

KAL3626-WAN1#sh run int Tu0

Building configuration...

Current configuration : 5 bytes

end

KAL3626-WAN1#sh run int Tu1

Building configuration...

Current configuration : 5 bytes

end

KAL3626-WAN1#sh run int Tu2

Building configuration...

Current configuration : 5 bytes

end

KAL3626-WAN1#sh ip int br
Interface                  IP-Address      OK? Method Status                Protocol
Embedded-Service-Engine0/0      unassigned      YES NVRAM  administratively down down   
GigabitEthernet0/0                          unassigned      YES NVRAM  up                    up     
GigabitEthernet0/0.347                 10.250.250.49   YES NVRAM  up                    up     
GigabitEthernet0/1                         unassigned      YES NVRAM  administratively down down   
GigabitEthernet0/2                        10.254.252.145  YES NVRAM  up                    up     
SM1/0                                               10.254.251.145  YES NVRAM  up                    up     
SM1/1                                                unassigned      YES unset  up                    up     
Tunnel0                                            172.16.0.1      YES unset  up                    up     
Tunnel1                                            172.16.0.1      YES unset  up                    up     
Tunnel2                                            172.16.0.1      YES unset  up                    up     
Vlan1                                                  unassigned      YES unset  up                    up     

[Richard Burts · Accepted solution]

It is not a virus. I see in the configuration that you have enabled WCCP. And the tunnels that show up in your show ip interface brief are created by WCCP to redirect the traffic.  It is fairly predictable that WCCP redirection through the tunnel would show up as top talker, since it is taking traffic from multiple sources and redirecting it through the tunnels.

We do not have enough information to be able to say how much WCCP is addiing to the latency.  But that is something that you might want to take a look at.

HTH

Rick

[SACHIN SHARMA]

Thanks Rick.