MAC responsible for congestion

[themizzz21]

Hello,

A gigabit uplink interface of a C3560 switch is congested.

Broadcast and multicast traffic is low.

Is it possible to find which MAC address congests this interface?

Thanks.

[Sergey Lisitsin]

Hello,

Is it a trunk or an access port? If it is access, just look what MAC address is learned on it.

show mac address interface GiX/XX

[themizzz21]

Hello Sergey,

It's a trunk port.

Something consumes the 100% of the  gigabit uplink (trunk) interface from time to time during the day and need to find who causes this.

Thanks.

[balaji.bandi]

You can find that way what IP using bandwidth until you have any NetFlow configured here. or enable ip accounting on the interface (not sure C3560 support check - have used long back those models)

if the each device connected to each port. check the utilization port based on the counters of the interface.

do you have any NMS in place so you can monitor the port?

[themizzz21]

Hi Balaji,

Thank you for your reply. This is an old network with old 3560 and 2950 catalyst switches.

I think that none of them support mac accounting or netflow and i was wondering if there is any other way to find out.

I think the best way to find out is to disconnect port by port the hosts attached on the neighboring switch when the congestion occurs(because it occurs for several minutes) until the traffic returns to normal.

Thanks again.

[balaji.bandi · Accepted solution]

SPAN the Port and find out with Wireshark.

[Leo Laohoo]

Post the complete output to the following commands:
1. sh interface <PORT>;
2. sh controll u <PORT>

[themizzz21]

Ηι,

They installed a server for storing-archiving x-rays(PACS) just for testing.

The traffic was due to uploading/downloading huge amounts of pictures.

Thank you very much.

[Joseph W. Doherty]

BTW, now that you know that, and assuming they want to keep doing this (at least for a little while), if the congestion is adverse to other traffic, QoS could place this traffic behind other traffic. I.e. For most purposes, other traffic wouldn't be impacted by this traffic.

[balaji.bandi]

make sense, PACS need huge --seen in the Hospital network.