cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
553
Views
10
Helpful
9
Replies
themizzz21
Beginner

MAC responsible for congestion

Hello,

A gigabit uplink interface of a C3560 switch is congested.

Broadcast and multicast traffic is low.

Is it possible to find which MAC address congests this interface?

 

Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions

SPAN the Port and find out with Wireshark.

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help

View solution in original post

9 REPLIES 9
Sergey Lisitsin
Collaborator

Hello,

 

Is it a trunk or an access port? If it is access, just look what MAC address is learned on it.

 

show mac address interface GiX/XX

 

Hello Sergey,

It's a trunk port.

Something consumes the 100% of the  gigabit uplink (trunk) interface from time to time during the day and need to find who causes this.

Thanks.

 

balaji.bandi
VIP Master

You can find that way what IP using bandwidth until you have any NetFlow configured here. or enable ip accounting on the interface (not sure C3560 support check - have used long back those models)

 

if the each device connected to each port. check the utilization port based on the counters of the interface.

do you have any NMS in place so you can monitor the port?

 

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help

Hi Balaji,

Thank you for your reply. This is an old network with old 3560 and 2950 catalyst switches.

I think that none of them support mac accounting or netflow and i was wondering if there is any other way to find out.

I think the best way to find out is to disconnect port by port the hosts attached on the neighboring switch when the congestion occurs(because it occurs for several minutes) until the traffic returns to normal.

 

Thanks again.

SPAN the Port and find out with Wireshark.

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help

View solution in original post

Leo Laohoo
VIP Community Legend

Post the complete output to the following commands:
1. sh interface <PORT>;
2. sh controll u <PORT>

Ηι,

They installed a server for storing-archiving x-rays(PACS) just for testing.

The traffic was due to uploading/downloading huge amounts of pictures.

 

Thank you very much.

BTW, now that you know that, and assuming they want to keep doing this (at least for a little while), if the congestion is adverse to other traffic, QoS could place this traffic behind other traffic. I.e. For most purposes, other traffic wouldn't be impacted by this traffic.

make sense, PACS need huge --seen in the Hospital network.

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help