Packet drops while policing in cisco 2811

[netops044]

Hello,

Need help in understanding why packet drop occurs while applying policing in Cisco 2811 running 12.4(24)T7. The drops occurs only when we ping with any packet size more than 500. There is no drops when we remove the policing and when we pinging without packet size. Exceed packets drop counter increases even when the traffic is less than 30% of the CIR value.  Checked increasing the Bc value but still no change.

Regards.

[Vasilii Mikhailovskii]

I think "show runn" and "show policy-map interface ..." could help to describe the problem.

[netops044]

Hi Mikhail, I have noticed the issue in live network and have replicated the same scenario in the lab and found the issue is found.

I have attached the config of the interface and policy-map in the attachment.

Warm regards

[Vasilii Mikhailovskii]

Hello.

Not sure what is the reason to run policer on outbound: you need to run "shape average" instead.

Not sure why you have packet loss on packet size of 500 bytes; maybe because of low latency. Could you provide output for ping command?

PS: configure "shape average" instead of policer in outbound policy-map.

PS2: for the policer you have Tc = 384000*8/1024000 = 3 seconds!!! Not sure if it's what you want.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

This while pinging just one packet, the default five packets, or a bigger series?

Unless you've bumped into a bug, I would suspect a series of packets that exceed the CIR during the Tc.  This can most easily happen if you're physical bandwidth is much more than your policed rate, e.g. policing FE to T1 rate.  If so, increasing Bc should mitigate.  Although you say it hasn't, perhaps you didn't increase it enough?

Since you're using a 2811, have you also tried a shaper instead of the policer?

[netops044]

Hi Joseph,

I have tried out with shaping the traffic and found no drops, but I specifically find this issue in this series router, even I tried out in 3 routers of same model with different IOS. 

There seems to be drops when I pinging with repeat 1000 times and with packet size mentioned.

I have attached the config in my last post. Please have a look.

Warm regards.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Ah, so you are using a large series of pings, 1,000, and you also have a large bandwidth delta FE (?) to 1 Mbps.

If 1,000 packets are each 500 bytes, that would comprise about 500 KB.  Your Bc is 384 KB, so when that's exceeded, packets will be dropped, up to about 116 KB worth for the 1,000 at 500 bytes, each.

I believe ping series pause a little between transmissions, which would decrease the actual transmission rate, and thereby also decrease actual drops.

Do you see drops decrease as you increase Bc or drops increase as you decrease Bc, when performing  the same transmission test?

Likewise do you see drops decrease as you increase CIR or drops increase as you decrease CIR, again when performing the same transmission test?

The thing to remember with policers, actual transmission is always at line-rate.  What they are measuring is capacity utilization.  When you set CIR at 1 Mbps, a policer is insuring actual usage, during some Tc, doesn't exceed what that transmission rate would send, but as the actual transmission rate is faster, it can exceed the measured capacity.  Again, this is happens with a large amount of data sent.

To better see/understand a policer's impact, use a traffic generator that you can control transmission rates (and transmission amount).  A policer shouldn't drop a constant bit rate that's at or below its measured rate.  However, once you exceed the measured rate, you can send, back-to-back packets, at full line rate, and they won't be dropped at long as you don't exceed the amount that are allowed during the measured period; in you case 384 KB (which is a huge amount for 1 Mbps CIR, or about a 3 second Tc [as also calculated by Vasilii]).