From: Church, Chuck (cchurch@netcogov.com)
Date: Thu Aug 05 2004 - 10:56:59 GMT-3
True, the buffer misses to hits ratio isn't 'too' bad. But looking back
at that ethernet interface, it's ignored 42 million packets, and
accepted only 11 million. That's a pretty terrible ratio. And that's
only over a 9 hour period. Based on the serial0/0 misses and that
interface being tracked, I'd guess that interface is seeing a lot of
traffic also. If the other sites have a similar user base and load, but
only this one is having this amount of traffic, I'd be concerned about
what's happening there that's unique. My guesses:
Large inter-vlan file transfers or tape backups occurring
Virus or worm type issue on workstations there
P2P file sharing occurring there
Since you've got a trunk to a switch, that switch must be
manageable. I'd take a look at the switch, and figure out the top
talkers per port, and hopefully narrow it down to a few devices. Then
have a tech check for P2P or worms on those. NBAR on the router might
help down the road, but at this traffic level, I don't think the router
would like having that additional load. You'd need a 12.2T image with
additional PDLMs to see the current P2P apps anyway.
Chuck Church
Wam!Net Government Services - D&I Team
Lead Design Engineer
CCIE #8776, MCNE, MCSE
1210 N. Parker Rd.
Greenville, SC 29609
Office: 864-335-9473
Cell: 703-819-3495
cchurch@wamnetgov.com
PGP key:
http://pgp.mit.edu:11371/pks/lookup?op=index&search=cchurch%40wamnetgov.
com
-----Original Message-----
From: wing_lam@jossynergy.com [mailto:wing_lam@jossynergy.com]
Sent: Thursday, August 05, 2004 7:46 AM
To: Scott Morris
Cc: Church, Chuck; ccielab@groupstudy.com; 'David Duncon'
Subject: RE: High Ignored Packet Errors
Hi Scott,
How many of failures would regard as high? I can see that the failure
numbers compare to the hit is still low in David's figure?
Do you mean "high" only for Large & Huge buffers in David's figure? If I
have the same case, how can I tune only these two buffers?
Thanks,
BBD
"Scott Morris"
<swm@emanon.com> To: "'David
Duncon'" <david_ccie@hotmail.com>, <cchurch@netcogov.com>,
Sent by: <ccielab@groupstudy.com>
nobody@groupstudy cc:
.com Subject: RE: High
Ignored Packet Errors
08/04/2004 08:48
PM
Please respond to
"Scott Morris"
Wowsa! That's a LOT of failures across the board there!!! I would
seriously take the time to create extra buffers on your router.
http://www.cisco.com/en/US/products/hw/routers/ps259/products_tech_note0
9186
a0080094e92.shtml#memory_overview
Buffers are used to break things apart and determine what to do with
them next. First, make sure you aren't process switching too much.
(Fa0/1 seems to have more cache misses) Using CEF may assist with this
as well.
HTH,
Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713,
CISSP, JNCIP, et al.
IPExpert CCIE Program Manager
IPExpert Sr. Technical Instructor
swm@emanon.com/smorris@ipexpert.net
http://www.ipexpert.net
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
David Duncon
Sent: Wednesday, August 04, 2004 1:19 AM
To: cchurch@netcogov.com; ccielab@groupstudy.com
Subject: RE: High Ignored Packet Errors
Thanks for your response , Chuck.
Here are my "sh buffers" and "sh run int fa0/0" outputs.
Router01#sh buffers
Buffer elements:
998 in free list (500 max allowed)
2727789782 hits, 0 misses, 500 created
Public buffer pools:
Small buffers, 104 bytes (total 50, permanent 50, peak 185 @ 2w4d):
45 in free list (20 min, 150 max allowed)
1376927835 hits, 17724 misses, 6045 trims, 6045 created
7429 failures (0 no memory)
Middle buffers, 600 bytes (total 25, permanent 25, peak 196 @ 7w0d):
23 in free list (10 min, 150 max allowed)
990639003 hits, 596896 misses, 1724 trims, 1724 created
493890 failures (0 no memory)
Big buffers, 1536 bytes (total 50, permanent 50, peak 77 @ 2w4d):
50 in free list (5 min, 150 max allowed)
12327055 hits, 483387 misses, 49 trims, 49 created
482393 failures (0 no memory)
VeryBig buffers, 4520 bytes (total 10, permanent 10, peak 15 @ 2w4d):
10 in free list (0 min, 100 max allowed)
3798 hits, 481824 misses, 9 trims, 9 created
481824 failures (0 no memory)
Large buffers, 5024 bytes (total 1, permanent 0, peak 7 @ 2w4d):
1 in free list (0 min, 10 max allowed)
208 hits, 481722 misses, 3433 trims, 3434 created
481722 failures (0 no memory)
Huge buffers, 18024 bytes (total 1, permanent 0, peak 13 @ 7w0d):
1 in free list (0 min, 4 max allowed)
5384 hits, 481673 misses, 3473 trims, 3474 created
481651 failures (0 no memory)
Interface buffer pools:
CD2430 I/O buffers, 1536 bytes (total 0, permanent 0):
0 in free list (0 min, 0 max allowed)
0 hits, 0 fallbacks
Header pools:
Header buffers, 0 bytes (total 434, permanent 128, peak 434 @ 7w0d):
306 in free list (10 min, 512 max allowed)
39121 hits, 268 misses, 0 trims, 306 created
29 failures (0 no memory)
128 max cache size, 128 in cache
2684203733 hits in cache, 39025 misses in cache
Particle Clones:
1024 clones, 807290403 hits, 0 misses
Public particle pools:
F/S buffers, 256 bytes (total 384, permanent 384):
128 in free list (128 min, 1024 max allowed)
256 hits, 0 misses, 0 trims, 0 created
0 failures (0 no memory)
256 max cache size, 256 in cache
1602224646 hits in cache, 0 misses in cache Normal buffers, 1548
bytes (total 512, permanent 512):
368 in free list (128 min, 1024 max allowed)
304304773 hits, 605 misses, 126 trims, 126 created
1 failures (0 no memory)
128 max cache size, 128 in cache
0 hits in cache, 0 misses in cache
Private particle pools:
FastEthernet0/0 buffers, 1548 bytes (total 192, permanent 192):
0 in free list (0 min, 192 max allowed)
192 hits, 0 fallbacks
192 max cache size, 128 in cache
1050384350 hits in cache, 1657494 misses in cache
FastEthernet0/1 buffers, 1548 bytes (total 192, permanent 192):
0 in free list (0 min, 192 max allowed)
192 hits, 0 fallbacks
192 max cache size, 128 in cache
1683380742 hits in cache, 282 misses in cache Serial0/0 buffers,
1548 bytes (total 32, permanent 32):
0 in free list (0 min, 32 max allowed)
32 hits, 0 fallbacks
32 max cache size, 16 in cache
2648556287 hits in cache, 302646710 misses in cache
Serial0/1 buffers, 1548 bytes (total 32, permanent 32):
0 in free list (0 min, 32 max allowed)
32 hits, 0 fallbacks
32 max cache size, 32 in cache
0 hits in cache, 0 misses in cache
.......................................................................
...
............................
Router01#sh run int fa0/0
Building configuration...
Current configuration : 90 bytes
!
interface FastEthernet0/0
no ip address
load-interval 30
speed 100
full-duplex
end
.......................................................................
...
..........................
Router01#sh run int fa0/0.2
Building configuration...
Current configuration : 491 bytes
!
interface FastEthernet0/0.2
encapsulation dot1Q 2
ip address 10.3.1.2 255.255.254.0
standby 2 ip 10.3.1.1
standby 2 timers 1 4
standby 2 priority 110
standby 2 preempt
standby 2 track Serial0/0.200 40
Router01#sh run int fa0/0.3
Building configuration...
Current configuration : 321 bytes
!
interface FastEthernet0/0.3
encapsulation dot1Q 3
ip address 10.3.7.2 255.255.255.0
standby 2 ip 10.3.7.1
standby 3 timers 1 4
standby 3 priority 110
standby 3 preempt
standby 3 track Serial0/0.200 40
end
Router01#sh run int fa0/0.4
Building configuration...
Current configuration : 321 bytes
!
interface FastEthernet0/0.4
encapsulation dot1Q 4
ip address 10.3.2.2 255.255.255.0
standby 2 ip 10.3.2.1
standby 4 timers 1 4
standby 4 priority 110
standby 4 preempt
standby 4 track Serial0/0.200 40
end
David.
>From: "Church, Chuck" <cchurch@netcogov.com>
>To: "David Duncon" <david_ccie@hotmail.com>, <ccielab@groupstudy.com>
>Subject: RE: High Ignored Packet Errors
>Date: Tue, 3 Aug 2004 08:49:45 -0500
>
>From CCO:
>
>"Ignored Packets
>
>router#show interfaces ethernet 0
>Ethernet0/0 is up, line protocol is up
>..
> 21 input errors, 0 CRC, 0 frame, 0 overrun, 21 ignored
>
>Packets are ignored if there are no free buffers to accept the new
>packet. This can happen if the router is overloaded with traffic, but
>can also happen if the interface is faulty. If "ignores" are present on
>all interfaces, then the router is probably overloaded with traffic, or
>doesn't have sufficient free buffers in the pool that match the maximum
>transmission unit (MTU) on interfaces. In the latter case, an increment
>of the ignored counter is followed by an increment of the no buffer
>counter:"
>
>What does 'sh buf' tell you? And what's your config look like for this
>ethernet interface?
>
>
>Chuck Church
>Wam!Net Government Services - D&I Team
>Lead Design Engineer
>CCIE #8776, MCNE, MCSE
>1210 N. Parker Rd.
>Greenville, SC 29609
>Office: 864-335-9473
>Cell: 703-819-3495
>cchurch@wamnetgov.com
>PGP key:
>http://pgp.mit.edu:11371/pks/lookup?op=index&search=cchurch%40wamnetgov
This archive was generated by hypermail 2.1.4 : Fri Sep 03 2004 - 07:02:33 GMT-3