You'd first need to identify the VLAN where most traffic is coming from. On your layer 3 switch check the VLAN interfaces and identify the interface (VLAN), you can look at txload/rxload or 5 min input/output rate to do that, and then SPAN that VLAN to see which host(s) or sending large volume of traffic and if all that's legit.

HTH

Sundar

We are a big citrix and EMC shop. We are seperated from the citrix admins and the EMC admins. 50% to 60% of the traffic that I see are SMB which is our fileserver we use for profiles and users home directory. All the servers communicating to the fileserver has too many retransmission and I pointed this out to them but again they said there is no problem and this is normal since all their profiles and user directories are located in the fileserver. I believe that our bottleneck is with EMC. Imagine all those traffic going to 1 fiber to EMC? I would try to attach some images tomorrow when I get to work. We have been doing this blame game with the citrix, microsoft, emc admins. They always say it's the network.

All the VLANS that I spanned are all VLAN servers and they are all in the 6513. I first span each VLAN and each VLAN was ok not hitting 50% utilization. But after I tried spanning all the VLAN on the 6513, I saw the spike 20, 80 and 100% Most of the traffic was also from SMB which has a lot of retransmission.

I'm seeing 100% network utilization when I span all the VLANs on the 6513. The VLANS are all server VLANS and only enabled in the 6513.

Do you have a basline utilization that you can compare with what you are seeing now.

I am not able to make up much from the utilization chart that you had posted. However, if you think the traffic level you see is way out of proportion I recommend check the traffic of top talkers on the network to see if all the traffic they are sending out is legit.

Another thing you can try is if any new application was added to the network try to disable it and check the utilization. I have seen some issues with some applications, when not fine tuned, causing serious problems on the network.

HTH

Sundar

They are legit traffic microsoft-ds, citrix, SMB. Microsoft-ds is the no 1 top talkers in our network that makes 55 to 65% of the traffic. What I need to accomplish is to be able to tell them that the bottle neck is from EMC.

That sounds logical to me.

Good luck.

I'm not sure how I'm going to approach them. The last time I aproach them with all the graphs and finding that I have found, they started emailing me with spanning-tree, duplex mismatch, errors taken from cisco website. I thought it was funny.

I hear you. Networks inherently would have some minor things going on and some folks would try to present that to be the trigger or reason for something much more serious that's happening. It's funny I just got done working on something similar yesterday. Anyway, all I can say is good luck with that.

Another possibility is that the servers are all connected to a line card where the ports share the same bus or ASIC. Until we moved to a 6748 line card we were experiencing lots of retransmissions on some of the ports. I think the 65xx line cards share 8 ports to one ASIC, and one server can choke out the other severs.

Do you have a 6748 line cards in place already? I believe this card is only compatible with sup720's. I hope there is somebody out there that can tell us that getting a new sup720 with those line cards fix their problem. :-) I was also thinking of those issue with port asics and their shared buffers among the 8 ports.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801751d7.shtml#ASIC

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper09186a0080131086.html