01-09-2012 06:32 AM - edited 03-04-2019 02:51 PM
I have a 2911 and a 1921 router, both are having unknown protocol drops only on the GE 0/0 interface. Both routers are connected to HP switches:
2911 -- E5406zl
1921 -- HP 2600 series
I disabled CDP on both routers, but the unknown protocol drops on the 2911 keep going up drastically. I have posted the config from the 2911 below.
Building configuration...
Current configuration : 3529 bytes
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone year
service password-encryption
!
hostname
!
boot-start-marker
boot-end-marker
!
card type t1 0 0
card type t1 0 1
card type t1 0 2
!
no aaa new-model
clock timezone gmt -5
clock summer-time cdt recurring
no network-clock-participate wic 0
no network-clock-participate wic 1
no network-clock-participate wic 2
!
no ipv6 cef
ip source-route
ip cef
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
license udi pid CISCO2911/K9 sn FTX1513ALLS
!
!
!
!
controller T1 0/0/0
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/0/1
clock source internal
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/1/0
clock source internal
cablelength long 0db
channel-group 3 timeslots 1-24
!
controller T1 0/1/1
clock source internal
cablelength long 0db
channel-group 2 timeslots 1-24
!
controller T1 0/2/0
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/2/1
clock source internal
cablelength long 0db
channel-group 0 timeslots 1-24
!
buffers middle permanent 200
buffers middle max-free 230
buffers middle min-free 50
buffers big permanent 75
buffers big max-free 200
buffers big min-free 15
buffers verybig permanent 20
buffers verybig max-free 20
buffers tune automatic
!
!
!
!
interface Multilink1
ip address 192.168.200.1 255.255.255.252
ip flow ingress
ip flow egress
load-interval 30
ppp multilink
ppp multilink group 1
ppp multilink fragment disable
no cdp enable
hold-queue 4000 out
!
interface GigabitEthernet0/0
ip address 10.10.3.1 255.255.240.0
ip flow ingress
ip flow egress
duplex full
speed auto
no cdp enable
hold-queue 3000 in
hold-queue 4096 out
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
hold-queue 40 out
!
interface Serial0/0/1:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
hold-queue 40 out
!
interface Serial0/1/0:3
ip address 192.168.1.2 255.255.255.0
ip flow ingress
ip flow egress
load-interval 60
no fair-queue
hold-queue 200 in
hold-queue 4000 out
!
interface Serial0/1/1:2
ip address 192.168.8.2 255.255.255.0
ip flow ingress
ip flow egress
load-interval 30
no fair-queue
hold-queue 200 in
hold-queue 4096 out
!
interface Serial0/2/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
!
interface Serial0/2/1:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip flow-cache timeout active 1
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination
!
ip route 0.0.0.0 0.0.0.0 10.10.18.1
ip route 10.10.1.0 255.255.255.0 192.168.1.1
ip route 10.10.5.0 255.255.255.0 192.168.8.1
ip route 10.10.9.0 255.255.254.0 192.168.200.2
!
logging trap notifications
logging
!
!
snmp-server community
snmp-server community
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
session-timeout 60
privilege level 15
logging synchronous
login
transport input telnet
!
scheduler allocate 20000 1000
end
01-09-2012 06:43 AM
This problem will not be detectable by checking the config.
Likely there is a protocol on the LAN which the router does not recognize.
It could be ipv6 or some multicast protocol used on the LAN or some non-standard application, just to mention a few possibilities. Perhaps you can make a Wireshark trace to see what traffic is on the net?
Feel free to post the result if you like.
If there is a lot of non-ipv4 traffic, you are likely to have found the culprit.
regards,
Leo
01-09-2012 12:24 PM
Thanks, I'll run a wireshark scan tomorrow and let you know of the results.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide