Hi All,

I had a problem today with a Catalyst 3750 (100mb Version) that is connected via a single uplink to a stack of Gigabit 3750's, the uplink is a trunk (802.1q) default settings, no vlan pruning, both switches are in the same VTP Domain and the management interface is in a common vlan.

All devices on the 100Mb 3750 we're either loosing packets or reporting response times of >50ms, upon examination of the uplink between the switches I found the below:

5 minute input rate 98508000 bits/sec, 8941 packets/sec (Based on my calculations this is 92Mb/11.5MB/s which would saturate a 100Mb link).
5 minute output rate 63000 bits/sec, 47 packets/sec

That's the output from the 100Mb 3750 side of the link the output from the Gigabit Core (Stack) is as below:

5 minute input rate 60000 bits/sec, 60 packets/sec
5 minute output rate 98093000 bits/sec, 8888 packets/sec

My question is how in future can I find out easily what's generating the bandwidth? I went through every interface on the 100Mb 3750 and the 5 minute input/output rate for all interfaces was nothing like that of what was flowing through the uplink.

Is it just a case of getting some network monitoring software to monitor input/output of each interface or is there a smart way of tracking down the heavy users/generators of traffic?

Obviously with the trunk carrying all Vlan's I suppose it's possible that a machine in a given Vlan was generating a large amount of broadcast traffic that was going up/down the link.

I presume pruning unused Vlan's from the link would be a prudent idea going foward to recude uncessary traffic to that switch? Manual or Automatic pruning?

Kind Regards,

Duncan.