4503 etherchanneled shows high traffic on all ports

Answered Question
Feb 8th, 2007

What would cause two 54503 switches to show high traffic output onn all monitored ports at the same time?

Broadast traffic does not seem to be the culprit, no multicasts are showing as the problem.

But the ports show a high traffic spike and causin8 some problems.

Any one have any ideas?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
richmorrow624 Thu, 02/08/2007 - 16:33

thanks for the reply, i have a few follow up points:

1. If it were bradcasts, wouldnt i be able to see that in the counters on each interface? They do not show incrementing in excessive amounts.

2. I am monitoring some of the ports on both switches with Solarwinds, it shows the ports going to about 40Mbps and dropping back down, not a huge amount but a problem.

3. sh process, does not show high cpu or memory usage and does not show up in Solarwinds, CPU only at 20%peak for entire time i have monitored. Memory the same.

4. Multicast traffic also does not show up in excessive amounts on any of the interfaces.

5. Even though STP does not show up in process in excessive amounts, i did a debug on spanning tree on one of the switches once and the process railed on the switch. But wouldnt it show up in the processes as a problem or the logs?

sundar.palaniappan Thu, 02/08/2007 - 17:06

Richard,

First, you would want to determine if it's legit or malignant traffic that's driving the interface utilization high. My suggestion would be to identify the layer 3 interface(s), very likely VLAN interface (SVIs) on this switch, that show high utilization. Then enable netflow switching or IP accounting on the layer 3 interface to check what kind of traffic it is and who are the top talkers. At this point, you would know whether you need to initiate any action or not. I don't know how familiar you are with netflow but here's very good link that explains this feature.

http://www.cisco.com/en/US/products/ps6601/products_white_paper0900aecd80406232.shtml

HTH

Sundar

richmorrow624 Thu, 02/08/2007 - 17:48

One thing Sundar, I am sure that the traffic is real,

There is a device that is 10Mbps/half duplex directly on one of the 4503 switches and it cant handle the flood of traffic and looses connectivity causing alerts.

And it I do do see the interface that has the high utilization

Actions

This Discussion