Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
10193
Views
0
Helpful
10
Replies

Valid frames, too large

dnoc43
Level 1
Level 1

‎10-27-2009 06:43 AM - edited ‎03-06-2019 08:19 AM

I ran a #show controllers ethernet-controller gi1/0/47 and noticed a large amount of valid frames, too large. This counter is actively incrementing. This is on a Cisco 3750G-48TS. Any ideas why this would be incrementing?

Transmit GigabitEthernet1/0/47 Receive

2602709159 Bytes 3406571803 Bytes

506380833 Unicast frames 1845219495 Unicast frames

168755 Multicast frames 82689595 Multicast frames

7782 Broadcast frames 16653903 Broadcast frames

0 Too old frames 1070926140 Unicast bytes

0 Deferred frames 1387623328 Multicast bytes

0 MTU exceeded frames 1775188696 Broadcast bytes

0 1 collision frames 0 Alignment errors

0 2 collision frames 3 FCS errors

0 3 collision frames 0 Oversize frames

0 4 collision frames 0 Undersize frames

0 5 collision frames 0 Collision fragments

0 6 collision frames

0 7 collision frames 2511413 Minimum size frames

0 8 collision frames 408322611 65 to 127 byte frames

0 9 collision frames 8506293 128 to 255 byte frames

0 10 collision frames 7761467 256 to 511 byte frames

0 11 collision frames 56189463 512 to 1023 byte frames

0 12 collision frames 73921614 1024 to 1518 byte frames

0 13 collision frames 0 Overrun frames

0 14 collision frames 475912 Pause frames

0 15 collision frames

0 Excessive collisions 0 Symbol error frames

0 Late collisions 0 Invalid frames, too large

0 VLAN discard frames 1387826047 Valid frames, too large

0 Excess defer frames 0 Invalid frames, too small

568105 64 byte frames 0 Valid frames, too small

26821639 127 byte frames

19506439 255 byte frames 0 Too old frames

7915924 511 byte frames 0 Valid oversize frames

17330690 1023 byte frames 0 System FCS error frames

52054055 1518 byte frames 0 RxPortFifoFull drop frame

382360518 Too large frames

0 Good (1 coll) frames

0 Good (>1 coll) frames

Labels:
0 Helpful
10 Replies 10

lgijssel
Level 9
Level 9

‎10-27-2009 06:48 AM

You may have a host that's incorrectly configured to use jumbo-frames.

Or if you want jumbo's to be used, you must configure it on the switch:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a008010edab.shtml

regards,

Leo

0 Helpful

dnoc43
Level 1
Level 1
In response to lgijssel

‎10-27-2009 07:24 AM

I ran a wireshark trace on the traffic inbound to that port. I don't see any frames larger than 1514. This interface is part of an etherchannel. Both internfaces in the etherchannel have the same too large frames

0 Helpful

lgijssel
Level 9
Level 9
In response to dnoc43

‎10-27-2009 07:27 AM

How did you attach the wireshark monitor?

If you did this via a monitor port, you will not packets that are not allowed in.

It may also be that the monitor itself is not configured to use jumbo frames.

0 Helpful

dnoc43
Level 1
Level 1
In response to lgijssel

‎10-27-2009 07:34 AM

This is a switch connect to our core. I configured a monitor port on the core. This should capture all traffic to the switch. I will check on the wireshark. I am gussing I have to configure the linux machine to accept jumbo frames too.

0 Helpful

lgijssel
Level 9
Level 9
In response to dnoc43

‎10-27-2009 07:39 AM

The problem with your setup is that you will only see the traffic that's accepted by the port.

It will not help you in this case because the too-large frames are discarded on input.

0 Helpful

dnoc43
Level 1
Level 1
In response to lgijssel

‎10-27-2009 07:43 AM

My setup is

CORE -> Problem Switch

I have the monitor port on our core switch. So I am capturing everything outbound on that port on the core to the problem switch. The inbound on the problem switch is where I am seeing the errors. So the core is forwarding these large frames to the problem switch. Sound right?

0 Helpful

dnoc43
Level 1
Level 1
In response to dnoc43

‎10-27-2009 07:56 AM

I just noticed a port that seems to be sending the jumbo frames. Am I reading the counter correctly down bottom. The "Too large frames"? Does this counter mean this host is sending large frames?

Transmit GigabitEthernet1/0/4

250519269 Bytes

11087485 Unicast frames

27074494 Multicast frames

20667232 Broadcast frames

0 Too old frames

0 Deferred frames

0 MTU exceeded frames

0 1 collision frames

0 2 collision frames

0 3 collision frames

0 4 collision frames

0 5 collision frames

0 6 collision frames

0 7 collision frames

0 8 collision frames

0 9 collision frames

0 10 collision frames

0 11 collision frames

0 12 collision frames

0 13 collision frames

0 14 collision frames

0 15 collision frames

0 Excessive collisions

0 Late collisions

0 VLAN discard frames

0 Excess defer frames

3003994 64 byte frames

43867440 127 byte frames

2789208 255 byte frames

377680 511 byte frames

157135 1023 byte frames

199063 1518 byte frames

8434691 Too large frames

0 Good (1 coll) frames

0 Good (>1 coll) frames

0 Helpful

dnoc43
Level 1
Level 1
In response to dnoc43

‎10-27-2009 08:47 AM

If I have too large packets on transmit and recieve, does that mean it is forwarding the traffic and just keeping a counter?

0 Helpful

Mohamed Sobair
Level 7
Level 7

‎10-27-2009 08:58 AM

Hi,

There is exessive hosts sending broadcast requests .

what type of traffic is going through this port of the switch?

HTH

Mohamed

0 Helpful

dnoc43
Level 1
Level 1
In response to Mohamed Sobair

‎10-27-2009 12:13 PM

This is an uplink port.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card