Oversized Packets being sent from WAP321 to SG220 Series Switch

[Net_Connect473]

We have a situation with a client where two WAP321's are sending out over-sized packets to an SG220 Series POE+ switch.

We have tried reducing the WAP's Fragmentation Threshold to 1400 and this has helped some, but there are still oversized packet's from the WAP's reaching the SG220.  There does not appear to be an MTU selector for the wired ethernet port on the WAP.  Jumbo frames are disabled on the SG220 and cannot be enabled due to compatibility issues with other equipment.  The WAP's are in a cluster with each other

A ping -l 1472 -f to the WAP's management IP address is the largest packet size that does not need fragmentation.

We have tried both rebooting and resetting all of the network devices.

The firmware on the WAP 321's is 1.0.5.3 (latest as of 5/19/2015)

The firmware on the SG220-26P is R1.0.0.18

I would like to eliminate the oversized packets coming into the SG220.  These appear to be causing performance issues with the WAP's.

[Eric Moyers]

My name Eric Moyers. I am an Engineer in the Small Business Support Center.

I am sorry to hear that you are experiencing this issue. 

So I can get a better understanding of your network are the oversize packets coming through on both WAPs that you mentioned or just one? What kind of devices are connecting to the WAP321s? Does everything send over-sized packets or can you narrow them down as coming from one particular device.

Out of curiosity, what are the compatibility issues that prevent jumbo from being enabled on the switch?

Eric Moyers
.:|:.:|:. CISCO | Cisco Presales Technical Support | Wireless Subject Matter Expert

Please rate helpful Posts and Let others know when your Question has been answered.

[Net_Connect473]

Hi Eric,

Both WAP's are sending out over-sized packets.  The devices connected to the WAP's are 2 or 3 android phones, a couple iphones, two or three laptops, a few tablet devices, a wireless printer, and a couple Roku's.  

I am hesitant to enable jumbo frames on the switch because, in addition to the devices listed above, the sometimes have guests over with additional devices.  In addition, there are several wired multimedia devices (AV receivers, etc.) on their network.  Since we don't always know what is going to be on their network, I want to try to limit things that could cause compatibility issues.

Network topology is as follows:  

WAN ---> RV320 --> SG220-26P ---> WAP's

Three vlans:  management, private network, guest network

Thanks!

[Eric Moyers]

I don't think that it is the WAP that is sending the over-sized packets. Testing here at my lab shows me that with no wireless devices connected that any traffic coming across the ethernet port is very minimal. To test this we can do a packet capture on the WAP321. 

Here is a link on how to perform this.

http://sbkb.cisco.com/CiscoSB/ukp.aspx?vw=1&docid=dfa8a2df27a64200b1d4e70fc50dcd01_packet_capture_on_wap121_and_wap321.xml&pid=2&respid=0&snid=3&dispid=0&cpage=search

Follow the steps down to View Captured Packet in Wireshark. You can view if you like or you are welcome to send it to me to review. (You can find my email by holding the mouse over my picture)

Once we have that we can determine if the packets are coming from directly from the WAP or passing through from a connected wireless device, by checking the source and destination packet IP's or MAC Addresses. To do this we would also need some of the MAC Addresses or IP's of connected devices. From looking at the list of connected wireless devices my money would be on the Rokus. But that is just a guess, the Packet Capture will tell the truth.  

If you would rather have some assistance in doing this, you are most welcome to call the support center and open a case so that one of our Engineers can assist you with this.

http://www.cisco.com/c/en/us/support/web/tsd-cisco-small-business-support-center-contacts.html

If you do please respond back with your case number. I work on same floor as most of them and would like to check in on the case and assist if needed.

Eric Moyers
.:|:.:|:. CISCO | Cisco Presales Technical Support | Wireless Subject Matter Expert

Please rate helpful Posts and Let others know when your Question has been answered.

[Net_Connect473]

Shouldn't the WAP re-size any packets that it gets to confirm with a standard MTU?  I'm assuming that since it can't be adjusted on the WAP321, that the WAP's MTU is 1500 bytes including headers.  

[Eric Moyers]

No sir that is not one of the features or jobs of the Access Point, to re-size packets or frames.

We need to do some directed troubleshooting to find the cause of this issue.

Eric Moyers
.:|:.:|:. CISCO | Cisco Presales Technical Support | Wireless Subject Matter Expert

Please rate helpful Posts and Let others know when your Question has been answered.

[Eric Moyers]

Also what is the exact problem your experiencing with the over-sized packets, is there a network slowdown or something? 

Usually routers are the only device that can change the size of packets. With switches you can enable jumbo packets (>1500) otherwise they will drop the packet. AP's should basically operate like switches. After researching our WAPs should fragment packets greater than 2346 on wireless. I could not find any fragmentation that happens on the ethernet side.

Doing a packet capture to and looking at traffic source and destination will be the next best step.

Eric Moyers 

[Net_Connect473]

We were troubleshooting wireless access issues in one room of the client's building.  Basically, in that particular area, connectivity was bouncing a lot. 

After we adjusted down the wireless fragmentation size to about 1400 bytes, the connection leveled out and things got significantly more stable.  So, the practical part of the issue may be resolved at this point.

I created this forum topic to get additional information about whether the oversized packets I was seeing was normal or not.  In working with multiple vendors WAP's over the past few years (Engenius, Cisco SMB, Netgear, Trendnet, Meraki), I have never seen over-sized packets show up on a switchport from a WAP.

[Net_Connect473]

Interesting.  I have learned something today.  My assumption would have been that the WAP would re-size packets to make them compliant with the MTU of the LAN medium before sending them out on the wire.

At the time I was trouble-shooting, the over-sized packets were coming from one of three devices:  either my laptop. or one of the clients two Roku units in opposite areas of the building from one another.  Those were the only active devices on the network at the time of our last on-site visit.

My guess is it was the two Roku's since switchports connected to each WAP were showing the the oversized packets.  The Roku's don't appear to have a mechanism to adjust their network MTU.

I note that my office WAP121 (not a WAP321) connected to an SG300-10 shows no oversized packets arriving on the switchport connected to the WAP.  We have a Roku at my house that is wireless and connected to another WAP121- SG300-10 combination.  I'll check out the switchports there to see if I can see oversized packets.

By changing the Fragmentation setting on the WAP, it seemed the oversized packets problem was greatly diminished (but not completely banished), so we have not scheduled a return on-site visit at this point.

[Eric Moyers]

I have as well, your questions have made me dig a little deeper than I have had to in a while. It was fun. 

If we can be of any help in the future please let us know. Or you are welcome to hit me up on email as well. Just mouse over my photo for it.

Eric Moyers.