Encapsulation failed, fragmentation issues

rblankers · ‎04-15-2008

I am working with a Sprint engineer and we have a protocol analyzer attached to our 2621, IOS 12.0(7). Using 2 full T1's multilinked. He is telling me that he see's fragmentation coming from my router, but 'show ip traffic' displays the following. Am I looking in the wrong place? What about the high number of 'encapsulation failed'? I restarted this router 2 days ago to clear the stats. Thanks

IP statistics:

Rcvd: 50619811 total, 10845 local destination

0 format errors, 0 checksum errors, 4177 bad hop count

0 unknown protocol, 0 not a gateway

0 security failures, 0 bad options, 0 with options

Opts: 0 end, 0 nop, 0 basic security, 0 loose source route

0 timestamp, 0 extended security, 0 record route

0 stream ID, 0 strict source route, 0 alert, 0 cipso

0 other

Frags: 0 reassembled, 0 timeouts, 0 couldn't reassemble

0 fragmented, 0 couldn't fragment

Bcast: 865 received, 16 sent

Mcast: 0 received, 0 sent

Sent: 14293 generated, 50563979 forwarded

Drop: 40800 encapsulation failed, 0 unresolved, 0 no adjacency

44 no route, 0 unicast RPF, 0 forced drop

ICMP statistics:

Rcvd: 0 format errors, 0 checksum errors, 0 redirects, 2 unreachable

6457 echo, 0 echo reply, 0 mask requests, 0 mask replies, 0 quench

0 parameter, 0 timestamp, 0 info request, 0 other

0 irdp solicitations, 0 irdp advertisements

Sent: 0 redirects, 245 unreachable, 0 echo, 6457 echo reply

0 mask requests, 0 mask replies, 0 quench, 0 timestamp

0 info reply, 4172 time exceeded, 0 parameter problem

0 irdp solicitations, 0 irdp advertisements

UDP statistics:

Rcvd: 3120 total, 0 checksum errors, 524 no port

Sent: 2603 total, 0 forwarded broadcasts

TCP statistics:

Rcvd: 1264 total, 4 checksum errors, 1 no port

Sent: 821 total

Probe statistics:

Rcvd: 0 address requests, 0 address replies

0 proxy name requests, 0 where-is requests, 0 other

Sent: 0 address requests, 0 address replies (0 proxy)

0 proxy name replies, 0 where-is replies

EGP statistics:

Rcvd: 0 total, 0 format errors, 0 checksum errors, 0 no listener

Sent: 0 total

IGRP statistics:

Rcvd: 0 total, 0 checksum errors

Sent: 0 total

OSPF statistics:

Rcvd: 0 total, 0 checksum errors

0 hello, 0 database desc, 0 link state req

0 link state updates, 0 link state acks

Sent: 0 total

IP-IGRP2 statistics:

Rcvd: 0 total

Sent: 0 total

PIMv2 statistics: Sent/Received

Total: 0/0, 0 checksum errors, 0 format errors

Registers: 0/0, Register Stops: 0/0, Hellos: 0/0

Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0

Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0

IGMP statistics: Sent/Received

Total: 0/0, Format errors: 0/0, Checksum errors: 0/0

Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0

DVMRP: 0/0, PIM: 0/0

ARP statistics:

Rcvd: 4260 requests, 186 replies, 0 reverse, 0 other

Sent: 36729 requests, 4251 replies (0 proxy), 0 reverse

Richard Burts · ‎04-15-2008

Robert

I am not sure that I have an answer about the fragmentation question, but I believe that I do have an answer for the encapsulation failed question. If you do a show arp on the router several times over a period of time I suspect that you will see some entries (perhaps an entry over and over for the same address) that show as incomplete. This is caused when some packet comes to the router to be forwarded, the address is in a connected subnet on the router, so the router does an arp for the address so that it can forward the packet. But there is no response to the arp request. Since the router can not build a layer 2 header to forward the packet it drops the packet with an encapsulation failed error.

So my guess is that your high count of encapsulation failed represents the fact that someone is trying to send something to an address that is not responding. Perhaps someone got the address wrong, or perhaps that machine is off line for some reason.

I see this happen sometimes on routers that I support. I do not believe that it represents a particular problem.

HTH

Rick

HTH

Rick

rblankers · ‎04-15-2008

Makes sense. I just did several sh arp's and see random addresses from my range of public ip's that are not currently in use... interesting.

rblankers · ‎04-16-2008

I used 'sh ppp multi' and got the following:

Multilink1, bundle name is sl-gw9-kc

1477 lost fragments, 11756873 reordered, 0 unassigned, sequence 0x56D420/0x9D055F rcvd/sent

0 discarded, 1068 lost received, 34/255 load

Member links: 2 active, 0 inactive (max not set, min not set)

Serial0/0

Serial0/1

So the fragmentation is still active. Anyone know how I can disable the fragmentation on this link? I have issued 'no ppp multilink fragmentation' on the multilink interface and restarted both the interface and the router, no dice. IOS is 12.0(7).