Unknown protocol drops

[Sai Paritala]

Hello Friends,

We have a WS-C3650-12X48FD L3 Switch, we were experiencing packet discards in the switches on few ports across the organisation, as per Cisco's recommendation we have upgraded the IOS from 16.06.03 to 16.06.05. With 16.06.03 version, port channel was failing and hence we had to rely on the spanning tree election (rapid PVST). Now the switch is upgraded to 16.06.05 and the port-channel is successful. Yet we see Unknown protocol drops on the port and also packet discards on that port. Kindly advise, how do we mitigate the issue. Thanks!

Port     Align-Err    FCS-Err       Xmit-Err           Rcv-Err          UnderSize       OutDiscards
Gi1/0/5    0              0                 0                      0                    0                 180432633

Note - The uplinks to the core are 10Gigs, as they are now in port-channel its a 20Gig pipe. I tried clearing the counters, yet I get the Unknown protocol drops and packet discards after sometime. 

[Giuseppe Larosa]

Hello Sai,

what routing protocol are you running on the core device(s) ?

If you use IS-IS that does not use IP packets but its own packets the neighbor can see IS-IS hellos as unknown protocol packets and they are discarded inbound not outbound as unknown protocol drops.

This should not cause any issue to your network environment.

I have seen this in the past.

These unknown protocol drops should be inbound and not related to the outbound output drops that can be caused by bursts or micro bursts of traffic.

Hope to help

Giuseppe

[Sai Paritala]

Hello Giuseppe,

Thank you for your response, we are using C6880 as our core and we are not using any dynamic routing. its just static routing. The switch which I mentioned is an access switch uplinked to the core with port-channel. Thanks!

[Mark Malone]

Hi
Do you have a router an stick setup with sub interfaces ? unknown drops can be from DTP as the router end cant process them so they build up ,can also be from cdp setup one end and not on the other or from IGPs too , easiest way to find it is sniff the line with wireshark

for the output discards which may be a separate issue please post the full show interface of the physical interface of the PO. G1/0/5

sh int g0/0/0 | i unkn
225767 unknown protocol drops
#

[Sai Paritala]

Hi Mark,

Thank you for your response. No, we don't have router on a stick setup, it's a dist/core C6880 pair with VSS connectivity connecting to number of access switches via port-channel after upgrading the IOS to 16.06.05 from 16.06.03, earlier it was just one 10Gig connection uplink to core. Now we have upgraded to 20gig with the port-channel. Please see the below int status. Please let me know if you need any more info.

Note - Once I clear the counters, both the OutDiscards and Unknown protocol drops will be gone and it appears back after sometime.

sh int Gi1/0/32 | in unk|rate
Queueing strategy: fifo
5 minute input rate 3000 bits/sec, 1 packets/sec
5 minute output rate 68000 bits/sec, 3 packets/sec
79 unknown protocol drops

#sh int po1 | in rate|BW|De
Description: * UPLINK to c6880 *
MTU 1500 bytes, BW 20000000 Kbit/sec, DLY 10 usec,
Queueing strategy: fifo
5 minute input rate 5160000 bits/sec, 780 packets/sec
5 minute output rate 1007000 bits/sec, 345 packets/sec

[Giuseppe Larosa]

Hello Sai,

are you using PAGP+ on the C6880 VSS (if you have a VSS) ?

This might be another candidate for unknown protocol drops if PAGP+ is not supported on the access switch.

Hope to help

Giuseppe

[Sai Paritala]

Hi  Giuseppe,

We use LACP. 

in the access switch->

sh etherchannel summary | sec 1
Number of channel-groups in use: 1
Number of aggregators: 1
1 Po1(SU) LACP Te1/1/1(P) Te2/1/3(P)

--> in the core side

sh etherchannel summary | sec 4
4 Po4(SU) LACP Te1/1/1(P) Te2/1/1(P)

[Giuseppe Larosa]

Hello Sai,

ok what the protocol is it is not really important.

if these unknown protocol drops are only a few and they increase over time regurarly like 10 every ten minutes this is not a real issue for the C3850 catalyst switch.

Output drops may need to be checked with more attention

compare the following counters taken from show interface:

ratio : output drops / (output drops + output packets )   if this ratio is less equal then 10^-4 output drops are not an issue for TCP traffic as they do not cause excessive TCP retransmissions.

Hope to help

Giuseppe