server interface port gives : 20 Unknown protocol drops

[ibdah_osama]

Hello ...

i have 1 web server and the url that we accessing is much slow, i diganose the server itself ; but its till same, 

i found that the interface that is connecting to our cisco switch shows : 85 unknown protocol drops ..

what may cause the issue ?

any suggestion...

#show interfaces g1/0/48
GigabitEthernet1/0/48 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 28c7.ce9e.5830 (bia 28c7.ce9e.5830)
Description: ***Temp library system***
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:31, output never, output hang never
Last clearing of "show interface" counters 00:42:32
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 17000 bits/sec, 1 packets/sec
5 minute output rate 4000 bits/sec, 6 packets/sec
13914 packets input, 13306601 bytes, 0 no buffer
Received 472 broadcasts (202 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 202 multicast, 0 pause input
0 input packets with dribble condition detected
43038 packets output, 4661180 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
85 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

[Mark Malone]

Hi
thats unlikely the issue , whats the ping response to the server is it good from your source?


https://supportforums.cisco.com/t5/service-providers-documents/asr9000-xr-drops-for-unrecognized-upper-level-protocol-error/ta-p/3126096

[ibdah_osama]

Hi Mark ..

I read the article you posted before :) , but unfortenatly it didnt solve the issue ...

ping result :

ping 192.168.131.233 -t

Pinging 192.168.131.233 with 32 bytes of data:
Reply from 192.168.131.233: bytes=32 time=1ms TTL=127
Reply from 192.168.131.233: bytes=32 time=2ms TTL=127
Reply from 192.168.131.233: bytes=32 time=1ms TTL=127
Reply from 192.168.131.233: bytes=32 time=2ms TTL=127
Reply from 192.168.131.233: bytes=32 time=2ms TTL=127
Reply from 192.168.131.233: bytes=32 time=2ms TTL=127
Reply from 192.168.131.233: bytes=32 time=2ms TTL=127
Reply from 192.168.131.233: bytes=32 time=1ms TTL=127
Reply from 192.168.131.233: bytes=32 time=2ms TTL=127

normal, its a win2012 physical server, and we can access it remotely normally, but this unknown packets come when trying to access the portal on that server ...

any suggestion 

[Mark Malone]

Hi
If its windows server why not capture the nic output through wireshark or span and base it against a working capture and see what packets is causing it at that time you see the issue, you should be able to narrow down what it is and where its coming from in wireshark , it sounds as its an issue at a higher layer maybe app layer issue , you may not be able to see it through the switch outputs