cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1095
Views
0
Helpful
1
Replies

Catalyst 4948 10G drops packets

zzs-bzwbk
Level 1
Level 1

Hello,

All of our C4948-10G have increasing "output drops" counters. Here's the example of port statistics (this is a SPAN port that drops packets continously

when port load is about 200Mbps/50k pps).

GigabitEthernet1/1 is up, line protocol is down (monitoring)

  Hardware is Gigabit Ethernet Port, address is 0021.d809.6100 (bia 0021.d809.6100)

  Description: SPAN

  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

     reliability 255/255, txload 45/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 1000Mb/s, link type is auto, media type is 10/100/1000-TX

  input flow-control is on, output flow-control is off

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input never, output never, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 853098790

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 0 bits/sec, 0 packets/sec

  5 minute output rate 177443000 bits/sec, 45447 packets/sec

     3989 packets input, 5036752115 bytes, 0 no buffer

     Received 3989 broadcasts (0 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 input packets with dribble condition detected

     1804766864558 packets output, 1290148458844910 bytes, 0 underruns

     0 output errors, 0 collisions, 0 interface resets

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier

     0 output buffer failures, 0 output buffers swapped out

What can be the cause of such behavior? Is 50K pps too much for 1Gig port of 4948?
WM

1 Reply 1

Dale Miller
Cisco Employee
Cisco Employee

I suspect the drops are caused by bursty traffic overrunning the egress buffer. Currently you PPS and Output rate is averaged over a 5 minute period and you can't indentify microburst of traffic. If the destination port is connected to a sniffer or PC with wireshark you can use the IO graph to see the problem. I understand you will not exceed 1GB as the packets are dropped before it is on the wire but at least you have a graphical representation of the traffic.

Using Wireshark

Statistics--> IO Graph

Configure the X Axis to .001 tick interval

Configure the Y Axis to bits per tick

If you have a spike nearing 1,000,000 bits in a .001 interval you close to 1Gb. I have attached an IO Graph showing spikes at 1GB on a 100 Mbs flow.

Regards,

Dale

Review Cisco Networking for a $25 gift card