11-12-2009 09:46 AM - edited 03-06-2019 08:35 AM
Hello Everyone. I have noticed on one of my 2811 routers interface has a ton of throttles and RP drops. Does this mean it received throttles or this interface is sending throttles?
show int fa0/0 switching
FastEthernet0/0
Throttle count 784950
Drops RP 1342114 SP 0
SPD Flushes Fast 0 SSE 0
SPD Aggress Fast 0
SPD Priority Inputs 172908 Drops 0
11-15-2009 12:20 AM
Hello Daniel,
I tried to find the command in the command references but I couldn't find it.
only possible hint is that SPD refers to treatment of received packets and should give better treatment to routing protocol messages, CDP hellos and so on.
so we can see that
SPD Priority Inputs 172908
drops RP should be packets destinated to main cpu but dropped.
so all this leads to think that throttle count could refer to received frames.
Hope to help
Giuseppe
11-15-2009 04:46 AM
I believe Giuseppe is correct, in that you might be looking at input queue drops for traffic that needs additional processing by the CPU (RP - route processor).
Additionally confirmation might be seen if you show the interface's stats and you see input queue drop and/or flushes recorded there. Also, if supported by your 2811, showing SPD stats might show this too.
11-15-2009 10:35 AM
Throttling is a term used in different contexts to refer to mechanisms used for rate regulation. In the context of device driver development a throttle is not something that a device sends or receives. A throttle state is typically a situation a device driver enters when there are insufficient resources either when sending or receiving frames. In this situation the driver can disable frame reception or stop the egress transmission queue for a short period of time.
The command "sh int fa0/0 switching" is a hidden command, so support and documentation could be less than usual, especially if you consider that interface throttling mechanisms (and corresponding counters) depend not only on what mechanisms the software implements, but also on the hardware architecture of the system. According to the book "Inside Cisco IOS Software Architecture", in shared memory systems (such as the 2500, I am speculating it could apply to the 2800), when the CPU responds to a receive interrupt, it attempts to remove the new buffer from receive ring and replenish the ring. If it cannot find a buffer at all, incoming packet is dropped, ignore counter is incremented, and interface is throttled (all incoming traffic ignored on this interface for a short period of time). I do not see any information about throttling the transmit direction in this type of architecture.
In my opinion, an RP can drop packets for many more reasons (e.g. you have an ACL that denies packet) than the reasons a NIC driver has to ignore packets and throttle interface. On the other hand, a packet that is ignored in the first place cannot be later dropped by say an ACL. Your counters show many more drops on the RP than there are throttles.
I would check the traffic levels in the network, to see if they are normal (e.g. exclude some type of attack, in which case throttles are commonly observed). What is the utilization of this fastethernet both in terms of bandwidth and in terms of packets/second? Still, temporary bursts could cause throttles and might not be caught when monitoring. Do you have any backup being performed that utilizes this interface? Analysis of the traffic patterns in your network might help to find the root cause of why the interface is being stressed.
11-15-2009 02:26 PM
Hello Maria,
thanks for filling this knowledge gap.
throttling, throttles are used in a lot of contexts for example in voip call manager can perform call throttling that is if it detects that it takes too much time to serve calls (more then a specified threshold) it can decide to stop serving calls for some time.
I had also thought of some relation to ethernet collisions but they shouldn't happen on full duplex links.
I tried to give an answer but I was not convinced of what I was trying to say.
Hope to help
Giuseppe
11-16-2009 10:54 AM
Giuseppe, I sense an apologetic tone in your previous post, so I think I have to remind you that you are cool man (by the way, nice interview in NetPro page)! Engineers make some good guesses every now and then, since it is clearly impossible to have detailed knowledge of everything. In my current work I realized what the problem I was facing was only after I did something that improved things :-)
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: