how to determine possible root causes peak spikes graph traffic?

[Kn1ghtR1d3rOfD00m]

Hi, 

I tried to find an answer for this but could not find any post related to this. 

What if Im told to check the reason for the spike in the graph from the monitor tool that is showing a high peak traffic and they say it might be related to the issue some users were affected for one vlan?

other vlans /other end users did not experience disconnection just one vlan so they asked for the root cause but if you see the graph, it only shows the edge router not the local core switch where the interface vlans are created

basically the topology is access layer 3750v2------> core switch 6500 series where the gateway is for each vlan------------->edge router ------> Internet

all vlans go to the edge router but they were not affected, just one vlan, no voice traffic was affected since it goes somewhere else. The application where they reported issues only uses Internet but other apps were working fine, just one app was affected.

so they say that it could be related to the peak traffic because it is somewhat the time the issue happened,  but not sure about that because no other vlans reported issues, just that.

what could be the troubleshooting steps to aproach this behavior? to prepare like a report and send it, so it might be the destination app only I think but how I prove this?

check the chart for the graph that was sent for the edge router

what can I check on the local switch or core switch?

I guess, this question is more oriented to the interpretation of the sceneario and steps onhow to aproach a case like that.

thank youso much

[Philip D'Ath]

My initial thoughts are you don't have a problem.  You got a one off minor increase in latency in a single sample.  So what?

Could simply have been the testing device refreshing its ARP caching and re-arp for the destination.

[Kn1ghtR1d3rOfD00m]

Yes, not a big deal haha well, cause there was no downtime but you know final users are like all issues are related to the networking field.

Good point about the ARP. thanks so much

[Seb Rupik]

Hi Alex,

You should configure netflow on your edge router, this would give you better insight into the type of and volumes of traffic passing through the device. You would then be able to correlate netflow data against your latency graph to see if the two were related.

Obviously this will not help for a retrospective analysis. 

cheers,

Seb.

[Kn1ghtR1d3rOfD00m]

Thank you, good idea. 

I will set it up and see how it goes to further analyze the data I think. 

Thank you.