Throttle Count

Unanswered Question
Nov 12th, 2009
User Badges:

Hello Everyone. I have noticed on one of my 2811 routers interface has a ton of throttles and RP drops. Does this mean it received throttles or this interface is sending throttles?


show int fa0/0 switching

FastEthernet0/0

Throttle count 784950

Drops RP 1342114 SP 0

SPD Flushes Fast 0 SSE 0

SPD Aggress Fast 0

SPD Priority Inputs 172908 Drops 0


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Giuseppe Larosa Sun, 11/15/2009 - 00:20
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Daniel,

I tried to find the command in the command references but I couldn't find it.


only possible hint is that SPD refers to treatment of received packets and should give better treatment to routing protocol messages, CDP hellos and so on.

so we can see that

SPD Priority Inputs 172908


drops RP should be packets destinated to main cpu but dropped.

so all this leads to think that throttle count could refer to received frames.


Hope to help

Giuseppe


Joseph W. Doherty Sun, 11/15/2009 - 04:46
User Badges:
  • Super Bronze, 10000 points or more

I believe Giuseppe is correct, in that you might be looking at input queue drops for traffic that needs additional processing by the CPU (RP - route processor).


Additionally confirmation might be seen if you show the interface's stats and you see input queue drop and/or flushes recorded there. Also, if supported by your 2811, showing SPD stats might show this too.

marikakis Sun, 11/15/2009 - 10:35
User Badges:
  • Gold, 750 points or more

Throttling is a term used in different contexts to refer to mechanisms used for rate regulation. In the context of device driver development a throttle is not something that a device sends or receives. A throttle state is typically a situation a device driver enters when there are insufficient resources either when sending or receiving frames. In this situation the driver can disable frame reception or stop the egress transmission queue for a short period of time.


The command "sh int fa0/0 switching" is a hidden command, so support and documentation could be less than usual, especially if you consider that interface throttling mechanisms (and corresponding counters) depend not only on what mechanisms the software implements, but also on the hardware architecture of the system. According to the book "Inside Cisco IOS Software Architecture", in shared memory systems (such as the 2500, I am speculating it could apply to the 2800), when the CPU responds to a receive interrupt, it attempts to remove the new buffer from receive ring and replenish the ring. If it cannot find a buffer at all, incoming packet is dropped, ignore counter is incremented, and interface is throttled (all incoming traffic ignored on this interface for a short period of time). I do not see any information about throttling the transmit direction in this type of architecture.


In my opinion, an RP can drop packets for many more reasons (e.g. you have an ACL that denies packet) than the reasons a NIC driver has to ignore packets and throttle interface. On the other hand, a packet that is ignored in the first place cannot be later dropped by say an ACL. Your counters show many more drops on the RP than there are throttles.


I would check the traffic levels in the network, to see if they are normal (e.g. exclude some type of attack, in which case throttles are commonly observed). What is the utilization of this fastethernet both in terms of bandwidth and in terms of packets/second? Still, temporary bursts could cause throttles and might not be caught when monitoring. Do you have any backup being performed that utilizes this interface? Analysis of the traffic patterns in your network might help to find the root cause of why the interface is being stressed.

Giuseppe Larosa Sun, 11/15/2009 - 14:26
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Maria,

thanks for filling this knowledge gap.


throttling, throttles are used in a lot of contexts for example in voip call manager can perform call throttling that is if it detects that it takes too much time to serve calls (more then a specified threshold) it can decide to stop serving calls for some time.


I had also thought of some relation to ethernet collisions but they shouldn't happen on full duplex links.


I tried to give an answer but I was not convinced of what I was trying to say.


Hope to help

Giuseppe


marikakis Mon, 11/16/2009 - 10:54
User Badges:
  • Gold, 750 points or more

Giuseppe, I sense an apologetic tone in your previous post, so I think I have to remind you that you are cool man (by the way, nice interview in NetPro page)! Engineers make some good guesses every now and then, since it is clearly impossible to have detailed knowledge of everything. In my current work I realized what the problem I was facing was only after I did something that improved things :-)

Actions

This Discussion