Recently I noticed something odd in my Cacti bandwidth graphs at a customer location where we have a Cisco 891 and 3 Zyxel switches. The bandwidth graphs for all of the trunk ports on the 891 were almost always nearly identical. Specifically, the graph of outbound traffic (i.e., traffic to the Zyxel switches) was identical. The graph of the traffic coming into the 891 from the Zyxels was all different. What's more, the graph of outbound traffic to the switches was identical to the graph of inbound traffic in interface F8, the Internet-facing interface. In other words, the graphs suggested that the trunk ports were putting out exactly the same amount of traffic as was being taken in by the Internet connection, suggesting that the 891 was simply forwarding all the traffic it was bringing in from the Internet out to the switches.
Thinking this might be an anomaly in the Cacti graphs, I confirmed the results by monitoring the "show interface" stats.
Thinking that it might be something weird happening with the Zyxels, I set up a lab consisting of a similar Cisco 891 and two Cisco 2950s and have seen the same behavior.
Specifically, interface F8 is connected to the Internet. Interface F2 is configured as a trunk port to which one 2950 is connected. Interface F3 is configured as a trunk and connected to the second 2950. I have two laptop computers connected to one of the 2950s (the other 2950 has nothing connected to it). I have both laptops streaming video. My Cacti graphs show identical traffic on interfaces F8, F2, F3 and vlan 2. Attached is a PDF showing the Cacti graphs. The top left shows the interface to the 2950 to which no traffic should be going. The top right is to the other 2950.
The output of "show mac-address-table" shows the MAC address of one of the laptops only, even though both are streaming.
It doesn't happen every time, but if I leave it streaming for a while, this is what happens.
If I create a static MAC address entry on the 891 for the second laptop, the traffic pattern changes so that the bandwidth graph on the interface for the un-used 2950 drops to zero.
The 891 is running C890 Software (C890-UNIVERSALK9-M), Version 15.2(4)M6, RELEASE SOFTWARE (fc2).
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...