12-20-2008 08:34 AM - edited 03-06-2019 03:04 AM
I have a increased utilisation of routers in my network (7200). In debuging process I've found out increased unicast number of packets. TReffic expressed in bps is the same as before, but number of packets is increased. Any advice on how could I try to find out what is the problem?
12-21-2008 03:17 AM
Hello Dragan,
you need to track ip flows and to find out the ones using small packets I would suggest to enable netflow.
see
Another idea is to see if there has been any change on the application servers and clients software in last times.
I suppose you are using DLSW and other CPU intensive traffic types.
DLSW over TCP encapsulation can send multiple frames inside a single IP packet for example.
Hope to help
Giuseppe
12-21-2008 03:25 AM
hi
I have netflow enabled, but my netflow collector does not show me much about packet per flow analysis. I can see drastic increase of unicast packets with traffic amount on same level.
br
12-21-2008 03:32 PM
PMTUD broke?
12-21-2008 11:01 PM
and how can I verify that?
12-22-2008 04:07 AM
If it's just one host, not easily.
You might check average packet sizes on your various interfaces.
You might look at IP flow cache summary stats.
You might be able to tell via netflow stats.
Don't recall for sure, but also IP accounting stats might help too.
In all the above you're looking for flows that don't get above a packet size of about 576. If they don't bulk TCP transmissions will send about 3x the number of packets for each 1500 byte [std.] Ethernet packet.
12-24-2008 12:44 AM
anyhow, I've found source of problem, using netflow to pinpoint suspect source of unicast packets increase, the using net capture to analyse traffic, found it, solve it. Thanks for your replys, to both of you
br
12-24-2008 05:34 AM
Hello Dragan,
it is kind of you to report the happy end of the case and the methodology you used to find out the source of small packets.
This can help somebody else with a similar issue.
There is also an optional flag to mark as solved a question that can help to show the case is a complete story when looking at the list of threads
Its usage is discretionary but it is meaningful.
Best Regards
Giuseppe
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide