I have researched this before and have never been able to get a definitive and authoritative answer, not even from Cisco TAC.
These oftentimes appear with absolutely no other indication that your network performance has been adversely effected.
If you cannot explain these errors, you can use a sniffer to indentify the unknown protocol.
HTH (It probably doesnt, but its the best I can do) :-)
What device is port F0/0 connected to?
Can you do a sniffer to see what packet is received when this count increments?
By the way, you can check your IOS version to see if you hit this bug CSCsx18388.
It's connected to a 2924-XL switch with
Unfortunately, we don't have a sniffer.
I'm trying to use nGenius to identify the protocol. Fortunately it doesn't appear to be affecting performance...
Some times you can get dropped packets
when one device is trying to negotiate ISL or dot1q trunks and the other device does not understand the trunking protocol.
Can you ensure that both the switch and router have the ports set to not trunk
Well, You're gonna love MIB. (grin)
: These are counted as unclassified errors.
The variables previously listed that do not say they appear in show interfaces are not available anywhere other than SNMP.
Please don't hesitate to check out this link.
Hi Fred, how fast that counter increments? If you see it increase by one everytime you type "show interface", it might be related to the bug I mentioned before.
UMB208R0#sh int fa0/0
FastEthernet0/0 is up, line protocol is up
Hardware is MV96340 Ethernet, address is 0013.8084.ae18 (bia 0013.8084.ae18)
Description: LAN interface at 700 E Santa Fe St Olathe
Internet address is 10.110.81.1/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters 05:58:49
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 2000 bits/sec, 3 packets/sec
5 minute output rate 2000 bits/sec, 2 packets/sec
108257 packets input, 22583077 bytes
Received 10522 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
94558 packets output, 38512505 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
6151 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
Here's the router Fa0/0:
description LAN interface at 700 E Santa Fe St Olathe
ip address 192.168.231.1 255.255.255.0 secondary
ip address 10.10.46.1 255.255.255.0 secondary
ip address 10.110.81.1 255.255.255.0
ip helper-address 192.168.48.50
ip helper-address 172.17.48.50
no ip redirects
no ip unreachables
ip directed-broadcast 143
no ip proxy-arp
no ip mroute-cache
no mop enabled
and the switch:
description Connection to Branch Router
UMB208SW11#show int fa 0/1 switchport
Administrative mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: isl
Operational Trunking Encapsulation: isl
Negotiation of Trunking: Disabled
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: NONE
Pruning VLANs Enabled: NONE
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none
Self Loopback: No
"Negotiation of Trunking: Disabled"
Well thats put a stop to that idea.
Can you put the switchport in to portfast mode.
I think you are going to need to install wireshark on a laptop and SPAN that port to look for the unknown protocol or during out of hours over a weekend look at using debug commands (ip packet detail - be carefull" on the router.
Have you got a hosts / printers on that switch with protocols like IPX DLC/LLC running?