Cisco 4500 - slowing down of LAN

[IgorHamzic]

Hi all.At one of our offices connected to our central location over a metroethernet LAN we have a Cisco 4500.

Recently we have started experiencing weird slowing downs of network for a few moments.I believe that the problem is in the metroethernet link and I have setup SAA monitoring to see if really there is something wrong with the link because I can't see any dropped packets or flushes on the 4500 interfaces and neither is the CPU utilization high(it sometimes jumps to around 85 percent for a few seconds but that seems OK),there are no routing loops and ping over the link when I test seems OK.But as the problem is contained only in this part of the network I think the problem is the link.

Can anyone think of another reason why there are these weird slowing downs besides the link as they can really frustrating.

[Joseph W. Doherty]

Something to check, if your hand-off is faster than the bandwidth guarantee, e.g. 100 Mbps connection but only 20 Mbps guaranteed, you might check what the MetroE provider does when you go over, i.e. drop or queue. If they drop, often worthwhile to shape your traffic to the guaranteed rate.

[IgorHamzic]

The link itself is 100Mbit and is connected to 100Mbit interface so I don't think shaping is needed.

One thing that was reported today was that the traffic to the internet has slowed down on moments but the traffic to the other resources over the link hasn't experienced any such problems.It's really weird because all traffic goes first to the central location over the same link and is then routed accordingly.I don't have any kind of QoS setup that could explain this behavior.

Perhaps some host is generating something that slows down the network but I haven't been able to capture any out of place traffic.

[IgorHamzic]

The link itself is 100Mbit and is connected to 100Mbit interface so I don't think shaping is needed.

One thing that was reported today was that the traffic to the internet has slowed down on moments but the traffic to the other resources over the link hasn't experienced any such problems.It's really weird because all traffic goes first to the central location over the same link and is then routed accordingly.I don't have any kind of QoS setup that could explain this behavior.

Perhaps some host is generating something that slows down the network but I haven't been able to capture any out of place traffic.

[Joseph W. Doherty · Accepted solution]

If the link's hand-off is 100 Mbps and it provides 100 Mbps end-to-end, there shouldn't be any unusual problems beyond any other link. This also assumes that it isn't a multipoint link and the provider isn't having any internal issues.

You now mention a possible slow down of Internet access, so perhaps the prior reported network issue wasn't precise enough beyond the often common user complaint "the network is (occasional) slow". You may need to continue to analyze performance in addition to requesting users to be a precise as possible of what they see as slow and when they see it. Besides your SAA monitoring, you might also trying sniffing the traffic flow across this link looking for other errors, e.g. high TCP retransmits, etc.

[IgorHamzic]

Besides the SAA which is monitoring the link for packet drops,rtt times etc. I'm also monitoring the traffic load to see if there are some out of the ordinary peaks in traffic and I'm also sniffing the traffic coming across the link to see if any users are generating unusual traffic.

I guess I have to keep watching that part of the LAN and see if there is something unusual going on.

It's funny how tiring it is to chase ghosts like this.