What causes "deferred" in sh int output?

[anup_bekal]

Hi

Please find below the output from a show int command on a Cisco 1721 Router.

Ethernet0 is up, line protocol is up

Hardware is PQUICC Ethernet, address is *********

Description: LOCAL LAN

Internet address is 192.168.8.10/29

MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,

reliability 255/255, txload 5/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Half-duplex, 10BaseT

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output 00:00:00, output hang never

Last clearing of "show interface" counters 1w1d

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 110

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 75000 bits/sec, 40 packets/sec

5 minute output rate 200000 bits/sec, 30 packets/sec

69658820 packets input, 1655003063 bytes, 0 no buffer

Received 1475382 broadcasts, 0 runts, 0 giants, 0 throttles

75 input errors, 0 CRC, 0 frame, 5 overrun, 70 ignored

0 input packets with dribble condition detected

67911033 packets output, 707379700 bytes, 4 underruns

70 output errors, 3625780 collisions, 0 interface resets

0 babbles, 0 late collision, 1006882 deferred

66 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

What can be the cause of "deferred"?. How do we diagnose the same and CRC, output, input errors using debug (also without using debug command- preferred) commands?

Thanks in advance // Anoop

[Kevin Dorrell]

Anoop,

Deferred frames are a normal part of the half-duplex protocol. The rule about half-duplex is that only one person is allowed to talk at a time. All "deferred" means is that the interface had to wait for someone else to finish transmitting before he could have his say.

BTW, "collisions" are also a normal part of the half-duplex protocol, and are nothing to worry about. All they mean is that, like at a dinner-party, two people coincidentally started talking at the same time, backed off, then let one of them talk.

Late collisions would be something to worry about. To take the dinner-party analogy further, this means that I was talking, everyone could hear I was talking, but someone interrupted me well into my speach. That is a breakdown of protocol.

Your 70 output errors consist of 4 underruns (which means you router was too busy to service the receiver, and so lost a frame), and 66 lost carriers (which usually means someone unplugged a cable).

Your 75 input error consist of 5 overruns (which means that your router was too busy to keep the transmitter topped up, and it run out of things to say), and 70 ignored frames, which could be that they did not fit any protocol the router knew about.

Does that help?

Kevin Dorrell

Luxembourg

[anup_bekal]

Hi Mr. Kevin

Thanks a lot! Appreciate your reply and admire your knowledge.

Please let me know, if I replace the Router with another one which have a fast Ethernet inside interface, can I avoid the "deferred" frames? Can this deferred frames cause a slow performance on the link?

Another doubt, what are BTW collisions? Where are they shown in the output?

Is there any website link available with you for further reading on how to analyze the show commands output. There might be a lot in the Internet, but I need something very specific & informative like your reply!

Thanks // Anoop

[Kevin Dorrell]

Anoop,

If you can configure your link to be full-duplex instead of half-, then yes you will avoid the "deferred"s. It is possible to do full-duplex with 10 Mbps Ethernet sometimes, but it is usually a feature of 100 Mbs FastEthernet. Just make sure that you have the same duplex at each end (half-half, full-full, or auto-auto), otherwise you really will run into problems. Your defered frames will be slowing down the link very very slightly, but so little that you would not normally notice.

BTW stands for "By The Way ... " - just an "Net-speak" expression like the French "À propos" or Italian "A proposito". "By the way, collisions are not errors either." ;-)

Here is the documentation page about the show interface command:

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d024.html#wp1140060

Good luck, and let us know if you have any other questions.

Kevin Dorrell

Luxembourg

[martin_kuhn]

Hi Kevin and Anoop,

sorry for thread hijack :) still, i think you can help me Kevin. Your explanation was nice, still can you plz tell me why are deferred packets showing on full-duplex 100mbit connections ? We had problem with less responsive paths for one of our customer. The paths were between DMZ between switches / pixes. Problem which could be seen was really slow internet for users. All we were able to see that there was like dozenz of deferred, still they shouldn't show up on full duplex. Both endpoints were same configured, speed 100, duplex full. On one way exchanging of one patch cord helped. Still we have prob with one more way, which is like 20 meters. All we can think out atm is, that there can be some interference so iface thinks there is some conversation atm it's trying to put data on link. Can that be true ?

Thanks in advance

Martin Kuhn