02-08-2007 03:50 PM - edited 03-05-2019 02:15 PM
What would cause two 54503 switches to show high traffic output onn all monitored ports at the same time?
Broadast traffic does not seem to be the culprit, no multicasts are showing as the problem.
But the ports show a high traffic spike and causin8 some problems.
Any one have any ideas?
Solved! Go to Solution.
02-08-2007 03:54 PM
1st gut thoughts, if CPU is railed as well, and attached router is high as well... check for bridging loops, check spanning tree, look for UDLD failures, debug spanning tree messages.. that would be a thing I would check immediatedly
02-08-2007 03:54 PM
1st gut thoughts, if CPU is railed as well, and attached router is high as well... check for bridging loops, check spanning tree, look for UDLD failures, debug spanning tree messages.. that would be a thing I would check immediatedly
02-08-2007 04:33 PM
thanks for the reply, i have a few follow up points:
1. If it were bradcasts, wouldnt i be able to see that in the counters on each interface? They do not show incrementing in excessive amounts.
2. I am monitoring some of the ports on both switches with Solarwinds, it shows the ports going to about 40Mbps and dropping back down, not a huge amount but a problem.
3. sh process, does not show high cpu or memory usage and does not show up in Solarwinds, CPU only at 20%peak for entire time i have monitored. Memory the same.
4. Multicast traffic also does not show up in excessive amounts on any of the interfaces.
5. Even though STP does not show up in process in excessive amounts, i did a debug on spanning tree on one of the switches once and the process railed on the switch. But wouldnt it show up in the processes as a problem or the logs?
02-08-2007 05:06 PM
Richard,
First, you would want to determine if it's legit or malignant traffic that's driving the interface utilization high. My suggestion would be to identify the layer 3 interface(s), very likely VLAN interface (SVIs) on this switch, that show high utilization. Then enable netflow switching or IP accounting on the layer 3 interface to check what kind of traffic it is and who are the top talkers. At this point, you would know whether you need to initiate any action or not. I don't know how familiar you are with netflow but here's very good link that explains this feature.
http://www.cisco.com/en/US/products/ps6601/products_white_paper0900aecd80406232.shtml
HTH
Sundar
02-08-2007 05:43 PM
Thanks sundar, i appreiate the reply.
02-08-2007 05:48 PM
One thing Sundar, I am sure that the traffic is real,
There is a device that is 10Mbps/half duplex directly on one of the 4503 switches and it cant handle the flood of traffic and looses connectivity causing alerts.
And it I do do see the interface that has the high utilization
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide