cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1007
Views
0
Helpful
5
Replies

DFM HighDiscardRate

yabilteryst
Level 1
Level 1

I'm receiving a lot of messages from DFM 3.0.3 about High Discard Rate on 2650 switches running 12.1.19.EA1 IOS or 12.1-22.EA11 IOS

Here below the message:

EVENT ID = 000032R

ALERT ID = 000015M

TIME = Thu 22-May-2008 13:07:38 CEST

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = EPE-C2950T-40

MANAGED OBJECT TYPE = Switches and Hubs

EVENT DESCRIPTION = HighDiscardRate::Component=PORT-EPE-C2950T-40/0.26 [Gi0/2] ["Lien 100TX vers C2950SX-30"];ComponentClass=Port;ComponentEventCode=1048;Type=ETHERNETCSMACD;OutputPacketDiscardRate=0.0 PPS;MaxSpeed=100000000;InputPacketRate=1.7896142E7 PPS;MinimumDisc

I checked and checked again on interface and there is no discard on interface.

Here below some indicators about interface :

EPE-C2950T-40#sh controllers ethernet-controller gi0/2

Transmit Receive

2753458867 Bytes 229595350 Bytes

165237242 Frames 2125895994 Frames

507279 Multicast frames 2 FCS errors

185977 Broadcast frames 2864901552 Multicast frames

0 Pause frames 268001458 Broadcast frames

0 Single defer frames 0 Control frames

0 Multiple defer frames 0 Pause frames

0 1 collision frames 0 Unknown opcode frames

0 2-15 collisions 0 Alignment errors

0 Late collisions 0 Length out of range

0 Excessive collisions 0 Symbol error frames

0 Total collisions 2 False carrier errors

0 Control frames 0 Valid frames, too small

0 VLAN discard frames 0 Valid frames, too large

0 Too old frames 0 Invalid frames, too small

160579422 Tagged frames 0 Invalid frames, too large

0 Aborted Tx frames 0 Discarded frames

Transmit and Receive

10362321 Minimum size frames

3229838505 65 to 127 byte frames

Any ideas?

Thanks in advance.

5 Replies 5

Joe Clarke
Cisco Employee
Cisco Employee

The discard rate is clearly bogus (1.79x10^7 PPS). The device could be reporting bogus data via SNMP. It would help to see a sniffer trace covering two polling intervals of DFM to see exactly the data DFM is seeing.

Please find a sniffer trace (attachment)between LMS and switch at the time LMS sent a message.

Here below message from LMS:

EVENT ID = 00004WL

ALERT ID = 000017M

TIME = Tue 27-May-2008 22:07:38 CEST

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = EPE-C2950T-40

MANAGED OBJECT TYPE = Switches and Hubs

EVENT DESCRIPTION = HighDiscardRate::Component=PORT-EPE-C2950T-40/0.26 [Gi0/2] ["Lien 100TX vers C2950SX-30"];ComponentClass=Port;ComponentEventCode=1048;Type=ETHERNETCSMACD;OutputPacketDiscardRate=0.0 PPS;MaxSpeed=100000000;InputPacketRate=1.7821884E7 PPS;MinimumDisc

This decode is corrupt. Please post the binary sniffer file.

For security reason, I prefer to send you the decode directly. Is it possible?

You should open a TAC service request with this information then. That way you can have more privacy for your data.