Packet Loss

[Brandon Buffin]

I suddenly started having packet loss and long ping times yesterday morning. No configuration changes to my knowledge. There is a 3750 acting as a core switch and default gateway. It is connected to several 3560s via fiber. Loss/delay is throughout the network, not just on one access switch. I see the loss/delay even if I connect 2 devices directly to the 3750. However, I have replaced this switch with a 3560 and still see the same issue. I have a TAC case open, but no progress to this point. Any help is greatly appreciated.

Brandon

[kplunkett512]

I'm sure you've already looked, but have you run a show process cpu history on the devices to see if they're being taxed?

[Brandon Buffin]

Yes, CPU looks good.

[Jon Marshall]

Brandon

Do you have any network monitoring software which would show you how much traffic is on the network ?

You say you see the loss/delay even when connecting 2 devices directly to the 3750. Did you see the same with the 3560.

How are you connecting the devices ie. are they connected via patch-panel and cable runs. If so is it possible to literally connecting 2 end devices straight into the switch and see if you still get delay.

The other thing to check would be switch resources which is related to how much traffic. If you look at the arp table/mac-address table on the switches is there anything out of the ordinary. Have you got logging on the switches turned on.

Apologies for all the questions but need a bit more info.

Jon

[Amit Singh]

Brandon,

Have you tried sniffing/port mirroring on the switches. It might be that some PC is sending unusual traffic and we are not able to trace it. I wouldnot agree with this as the CPU is not hiking but I would certainly try to sniff the switch and see if we could find something.

regards,

[Joseph W. Doherty]

Have you check port usage stats? I'm wondering if there's some type of high traffic load, that the ASICs keep the CPU load reasonable, but the ports are queuing causing both inceased latency and drops.

Any chance of any type of flooding issue, such as unicast flooding, that a high bandwidth flow between two hosts might load up many other ports?

Software IOS on the devices recent and/or lastest release of that train?

No other "resouce" shortage, especially if you suboptimal SDM template? (I think most of these would spike the CPU, though.)

[glen.grant]

Look for ports that have high utilization using the show controllers utilization command .

[Brandon Buffin]

Everyone was pointing to the same issue - a large amount of traffic. Ended up being a Windows domain controller that was flooding the network with traffic. I have a packet capture, so I'm going to go back and see what the traffic was related to. A reboot solved the problem. Thanks for all of the help.

Brandon