Temporary High Discard Rate...

william.briere · ‎04-23-2010

Hello,

I have an interface on a 4948-48port that temporarily snmp's some high discard rate events, that always are short lived. I am going to open a case I think but I thought I would ask the question here what might be going on. Any help would be appreciated.

EVENT DESCRIPTION = HighDiscardRate::Component=PORT-xxx.xxx.xxx.xx/0.26 [Gi0/2];Type=ETHERNETCSMACD;InputPacketRate=1.7895722E7 PPS;MinimumDiscardRate=8333.328;DuplexMode=FULLDUPLEX;OutputPacketRate=1.4958334 PPS;DiscardThreshold=5;InputPacketDiscardPct=99.99986 %;InputPacketDiscardRate=1.7895698E7 PPS;MaxSpeed=1000000000;OutputPacketDiscardRate=0.0 PPS;OutputPacketDiscardPct=0.0 %;

rwagner · ‎05-03-2010

By temporary I take it that you mean it only occurs for a short period of time then stops.

There can be several reasons for this, but the most common reason is ipv6. If you have introduced windows 2008, Vista, Win7, or enabled ipv6 on another system then you will get temporary spikes during the day via ipv6 classless broadcasts.

There are other reasons you could get this, but the easiest way is check the logs, run packet sniffers, and all the other stuff you would normally do for high discard rates. The only additional difficulty you have is that you need to respond fast enough to start a trace, do something that will run all the time, or think of a way to kick off a job to run the packet trace.

If you are already dumping your logs onto a linux/unix server then you can run a cron/sql job every minute on the logs and have it kick off the packet sniffer when it detects the discards.

(edit)

it is probabally best that I say can and not will for ipv6 classless broadcast causing discards. That really depends on your settings, but by default they usually do not have the proper settings to handle ipv6 packet sizes.

(edit2)

I should of elaborated more on my assumption:

By temporary I take it that you mean it occurs for a short period of time then stops, but then resumes again later. Not temporary as has only happened a small handful of times.

Ganesh Hariharan · ‎05-03-2010

Hello,
I
have an interface on a 4948-48port that temporarily snmp's some high
discard rate events, that always are short lived. I am going to open a
case I think but I thought I would ask the question here what might be
going on. Any help would be appreciated.
EVENT
DESCRIPTION = HighDiscardRate::Component=PORT-xxx.xxx.xxx.xx/0.26
[Gi0/2];Type=ETHERNETCSMACD;InputPacketRate=1.7895722E7
PPS;MinimumDiscardRate=8333.328;DuplexMode=FULLDUPLEX;OutputPacketRate=1.4958334
PPS;DiscardThreshold=5;InputPacketDiscardPct=99.99986
%;InputPacketDiscardRate=1.7895698E7
PPS;MaxSpeed=1000000000;OutputPacketDiscardRate=0.0
PPS;OutputPacketDiscardPct=0.0 %

Hi ,

High discard rates may indicate that the device cannot keep up with traffic. Use Top broadcasts or L2 multicast flows with Units selector set to Frames/s to help identify sources of high broadcast or multicast traffic and other cause for high discard rate can be "The input packet queued rate is greater than the minimum packet rate, and the input packet discard percentage is greater than the Discard Threshold. The input packet queued rate is the rate of packets received without error. The input packet discard percentage is calculated by dividing the rate of input packets discarded by the rate of packets received.

"The output packet queued rate is greater than the minimum packet rate, and the output packet discard percentage is greater than the Discard Threshold. The output packet queued rate is the rate of packets sent without error. The output packet discard percentage is calculated by dividing the rate of output packets discarded by the rate of packets sent.

Check out the below link for troubleshooting switch ports

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008015bfd6.shtml#outlost

Hope to Help !!

Ganesh.H

Remember to rate the helpful post

Claire_Lai · ‎05-26-2023

Hey, thank you for your detail explaining.
the link is redirected to the product introduced, and I still do not know how to fix it.
the problem device: C9200L-24T-4G
I clean up the interface counts before, and it continuously raise the drop packet account.
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 590

the interface confi
interface GigabitEthernet1/0/2
switchport access vlan 101
switchport mode access
spanning-tree portfast

Sincerely asking
Claire

Giuseppe Larosa · ‎05-26-2023

Hello @Claire_Lai ,

to understand if you have a true issue you need to compare the total output packets with the total output drops

the drop probability is expressed as Output Drops / ( Output Drops + Output packets)

if the drop probability is less then 1% you are fine otherwise further investigation is needed.

Hope to help

Giuseppe

Joseph W. Doherty · ‎05-26-2023

Claire, firstly, rather than posting your issue to a 13 year old post, I suggest it's probably better to post new.

Secondly, insufficient information to determine whether your incrementing drop count is actually adverse to your traffic. BTW, sometimes, drops can be beneficial.

Whether your drops are beneficial, or not, @Giuseppe Larosa describes how to (correctly) calculate drop percentage (probability) and that if less than 1%, it's not a problem. Well, although the under 1% is often correct, there are a couple of things that need to be understood about 1%, which weren't explicitly mentioned.

First, we're interested in the drop percentage end-to-end, not just one interface.

Second, 1%, is generally not of consequence, when it's something like dropping every 100th packet. Unfortunately, actual drops tend to cluster during traffic bursts (e.g. https://en.wikipedia.org/wiki/Micro-bursting_(networking)), where a short time interval (often is milliseconds) the drop percentage can be much, much higher, but decreases over longer time (seconds to minutes) intervals. For example, if every 100th packet is dropped across 1,000 packets, i.e. 10 packet in all, that often goes unnoticed, but if 10 consecutive packets drop, in the 1,000 packets, you might have a very noticeable adverse impact, but one of which occurs "infrequently".

Again, from your posted information, insufficient information to determine if your drops are truly adverse, and if they are, what's the cause and possible mitigation approaches.