Packet drops

[kiku47001]

Hi,

We have a lot of packet drops at our end user.

Our ISP has no packet drops when connected directly.

We have 0% loss in LAN.

Please help.

Please find the attached screenshots for understanding.

[Mark Malone]

is only 1 user effected or multiple ?

did you check the user port ?

If its multiple users same switch effected ,is it every location they see drops or just the internet ?

If its just the internet [pings seeing drops post the show interface off the ISP internet circuit port on your router

check the interfaces of effected users at switch level , check the wan port , try and find the common problem whether its same location ,server or internet the problem is at, check the switch cpu is not maxing out

[kiku47001]

Hey Mark,

Thank you for your reply.

Every user in the network is effected,LAN is working fine(as you can see in the attached screenshots).

i tried pinging to 8.8.8.8 from my ASA, and i found packet drops there too.

same in the case of pinging to switch.

please find the attached screenshots for understanding.

[Mark Malone]

Is this the same circuit that you posted earlier off , the ? is not dropped packets its unknown type packets being sent  , if the packet loss is only on wan ip addresses then the issue is with the provider or the local interface the circuit is connected too. Have youc hecked the connecting port of the circuit for errors

[kiku47001]

Hey Mark,

The problem is not only with ISP,but everywhere else.

I get packet drops everywhere(as i shared the attached screenshots above).

[Mark Malone]

Hi G0/0 i see massive amount of collisions which would cause drops and G0/3 load of underruns which would suggest the box is being oversubscribed on that int

You need to clear these interfaces counters and monitor to see if there incrementing live , if they are thats where the issue is 

[kiku47001]

Hey Mark,

I think you are right.

I cleared the interface counters and monitored, I find the increment in the drops.

What is the solution for this.

[Mark Malone]

The underruns are a subscription issue you need a more powerful ASA , the collisions could be due to the box being oversubscribed as well , thats if the ISP airtel is clean circuit

[kiku47001]

Mark,

Can i get instant solution.

Subscription may take long time . Cant we troubleshoot or modify something.

[Mark Malone]

Oversubscription is an issue with too much traffic being sent through a device, theres not much you can do apart from stop sending so much traffic , everytime the buffers or queues fill up it will start dropping packets , or else try identify what the biggest senders of traffic are and implement a qos service-policy on the lan side before it hits the ASA and police some of the non essential traffic if there is a layer 3 capable device behind it

Unfortunatly there is no real instant fix for oversubscription apart from stop oversubscribing the device or provide something with more throughput

[pwwiddicombe]

I would check with the other device you are connected to on gi 0/0 for it's configuration as well (the provider?).  There are a lot of collisions, and it looks like the interface is configured for auto, and has negotiated half duplex. 

This is typically the situation when the provider has set full duplex, and you are negotiating.  BOTH sides need to run auto, or BOTH need to be set to full !

[kiku47001]

Hey pwwiddicombe

Yes, the other interface is connected to the ISP, I've now the changed the interface to Fullduplex and still getting the collisions.

[Mark Malone]

All the deferred packets indicate a capacity issue with load on Airtel ISP interface too much coming in/out etc , good spot by pwiddi on half-duplex as well should always be full these days unless specified for a reason

Not really a recommended fix for but you could try flowcontrol see if it helps under the interfaces slow down the pace of traffic , under an ASA interface its just flowcontrol , this will tell the senders to slow down with the amount of traffic , its usually for overruns but may help

Flow control is the management of data flow between computers or devices or between nodes in a network so that the data can be handled at an efficient pace. Too much data arriving before a device can handle it causes data overflow, meaning the data is either lost or must be retransmitted.

Other than that take a look at this you could try rate limit on the ASA itself stop it getting overloaded , this article shows an example

http://www.petenetlive.com/KB/Article/0001001

[kiku47001]

Hey Mark,

I have already changed the duplex to FULL and still facing the same.see the attached screenshots shared with  pwwiddicombe

Thanks for the given link, I don't know that it really works.because we have 3 ISP's running PBR and we also VPN with failover.

Please suggest.

[pwwiddicombe]

You did clear the counters afterwards, as most of these totals don't clear unless you restart, or clear them manually?

By the way, no funny intermediate devices between the ISP and your interface?  Some repeaters, converters, hubs, and taps can also have an impact.