04-15-2008 12:17 PM - edited 03-03-2019 09:34 PM
I am working with a Sprint engineer and we have a protocol analyzer attached to our 2621, IOS 12.0(7). Using 2 full T1's multilinked. He is telling me that he see's fragmentation coming from my router, but 'show ip traffic' displays the following. Am I looking in the wrong place? What about the high number of 'encapsulation failed'? I restarted this router 2 days ago to clear the stats. Thanks
IP statistics:
Rcvd: 50619811 total, 10845 local destination
0 format errors, 0 checksum errors, 4177 bad hop count
0 unknown protocol, 0 not a gateway
0 security failures, 0 bad options, 0 with options
Opts: 0 end, 0 nop, 0 basic security, 0 loose source route
0 timestamp, 0 extended security, 0 record route
0 stream ID, 0 strict source route, 0 alert, 0 cipso
0 other
Frags: 0 reassembled, 0 timeouts, 0 couldn't reassemble
0 fragmented, 0 couldn't fragment
Bcast: 865 received, 16 sent
Mcast: 0 received, 0 sent
Sent: 14293 generated, 50563979 forwarded
Drop: 40800 encapsulation failed, 0 unresolved, 0 no adjacency
44 no route, 0 unicast RPF, 0 forced drop
ICMP statistics:
Rcvd: 0 format errors, 0 checksum errors, 0 redirects, 2 unreachable
6457 echo, 0 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
Sent: 0 redirects, 245 unreachable, 0 echo, 6457 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp
0 info reply, 4172 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements
UDP statistics:
Rcvd: 3120 total, 0 checksum errors, 524 no port
Sent: 2603 total, 0 forwarded broadcasts
TCP statistics:
Rcvd: 1264 total, 4 checksum errors, 1 no port
Sent: 821 total
Probe statistics:
Rcvd: 0 address requests, 0 address replies
0 proxy name requests, 0 where-is requests, 0 other
Sent: 0 address requests, 0 address replies (0 proxy)
0 proxy name replies, 0 where-is replies
EGP statistics:
Rcvd: 0 total, 0 format errors, 0 checksum errors, 0 no listener
Sent: 0 total
IGRP statistics:
Rcvd: 0 total, 0 checksum errors
Sent: 0 total
OSPF statistics:
Rcvd: 0 total, 0 checksum errors
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks
Sent: 0 total
IP-IGRP2 statistics:
Rcvd: 0 total
Sent: 0 total
PIMv2 statistics: Sent/Received
Total: 0/0, 0 checksum errors, 0 format errors
Registers: 0/0, Register Stops: 0/0, Hellos: 0/0
Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0
Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0
IGMP statistics: Sent/Received
Total: 0/0, Format errors: 0/0, Checksum errors: 0/0
Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0
DVMRP: 0/0, PIM: 0/0
ARP statistics:
Rcvd: 4260 requests, 186 replies, 0 reverse, 0 other
Sent: 36729 requests, 4251 replies (0 proxy), 0 reverse
04-15-2008 12:34 PM
Robert
I am not sure that I have an answer about the fragmentation question, but I believe that I do have an answer for the encapsulation failed question. If you do a show arp on the router several times over a period of time I suspect that you will see some entries (perhaps an entry over and over for the same address) that show as incomplete. This is caused when some packet comes to the router to be forwarded, the address is in a connected subnet on the router, so the router does an arp for the address so that it can forward the packet. But there is no response to the arp request. Since the router can not build a layer 2 header to forward the packet it drops the packet with an encapsulation failed error.
So my guess is that your high count of encapsulation failed represents the fact that someone is trying to send something to an address that is not responding. Perhaps someone got the address wrong, or perhaps that machine is off line for some reason.
I see this happen sometimes on routers that I support. I do not believe that it represents a particular problem.
HTH
Rick
04-15-2008 12:42 PM
Makes sense. I just did several sh arp's and see random addresses from my range of public ip's that are not currently in use... interesting.
04-16-2008 08:38 AM
I used 'sh ppp multi' and got the following:
Multilink1, bundle name is sl-gw9-kc
1477 lost fragments, 11756873 reordered, 0 unassigned, sequence 0x56D420/0x9D055F rcvd/sent
0 discarded, 1068 lost received, 34/255 load
Member links: 2 active, 0 inactive (max not set, min not set)
Serial0/0
Serial0/1
So the fragmentation is still active. Anyone know how I can disable the fragmentation on this link? I have issued 'no ppp multilink fragmentation' on the multilink interface and restarted both the interface and the router, no dice. IOS is 12.0(7).
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: