internet slow and isp replying me with this email ... what does it mean?

[amralrazzaz]

dear all 

i have internet problem and after checking with isp they replying me with below email ...i need to know which line is abnormal and i can know from it that packets drop and network slow?

Dear Sir,

Please be informed that, after investigation we see the path is stable physically as no logs has been detected till the site router

Also we see your current Traffic now exceed 4Mbps which cause the exists packet drop and latency.

Kindly check the below output from the site router.

CE-FriesLand-CITYCNTR#sh  int GigabitEthernet0/1

GigabitEthernet0/1 is up, line protocol is up 

  Hardware is CN Gigabit Ethernet, address is 54a2.746a.1b21 (bia 54a2.746a.1b21)

  Internet address is 41.33.42.169/29

  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full Duplex, 1Gbps, media type is RJ45

  output flow-control is XON, input flow-control is XON

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 00:00:00, output 00:00:00, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 464000 bits/sec, 422 packets/sec

  5 minute output rate 4554000 bits/sec, 420 packets/sec

[amralrazzaz]

what does that mean ? 

MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

5 minute input rate 464000 bits/sec, 422 packets/sec

  5 minute output rate 4554000 bits/sec, 420 packets/sec

[Georg Pauwen]

Hello,

on a side note, you could implement a simple traffic shaping policy. This would average out the traffic and probably reduce the drops:

policy-map SHAPE_4MB
 class class-default
  shape average 4000000

interface GigabitEthernet0/0

description WAN to ISP
 service-policy SHAPE_4MB out

[Tinashe Ndhlovu]

policy-map SHAPE_4MB
 class class-default
  shape average 4000000

interface GigabitEthernet0/0

description WAN to ISP
 service-policy SHAPE_4MB out

---

oh dear me... oh goodness gracious me... i believe you did not read the actual issue in full... 

[Tinashe Ndhlovu]

It means your 4Mb link is saturated in this case you have download traffic from your perspective that is maxing out your 4Mb internet connection. That would explain why the internet is slow.. you have a bandwidth hog.. but at 4Mbps.. it's a bit rough callin em a bandwidth hog.. ;) T

[amralrazzaz]

Dear

Thanks for that , but now the connection will be stable if I manage and decrease the traffic from my side ?

for example ill cut the internet connection for some users ,, it will help ?

[Joseph W. Doherty]

It might help if you select the user(s) causing link saturation.

Otherwise, you might do one of three things (which aren't mutually exclusive).

You might obtain more bandwidth from your ISP.

You might have your ISP implement QoS (which they generally are unwilling to do).

You might obtain a traffic management appliance.

[amralrazzaz]

what does that mean ? 

MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

5 minute input rate 464000 bits/sec, 422 packets/sec

  5 minute output rate 4554000 bits/sec, 420 packets/sec

[DaSt-1986]

5 minute input rate 464000 bits/sec, 422 packets/sec

This means that you had an average of 422 packets per second at 464Kbit/s in the last five minutes coming into the ISP interface (meaning uploads from your site to the ISP).

5 minute output rate 4554000 bits/sec, 420 packets/sec

This means that you had an average of 420 packets/sec at 4.5Mbit/s in the last five minutes coming from the ISP network to you (meaning downloads).

The best way to track what is hogging this bandwidth is by checking your own local router that is connecting to the ISP. I would use a NetFlow (ip cache flow) to see what network devices are trying to retrieve so much data and investigate on those clients.

[amralrazzaz]

netflow is a software and it need configuration on router ?

[DaSt-1986]

NetFlow Collector is software. On a device, you can enable ip flow ingress or ip flow egress on the Interface and use show ip flow to see which devices are using the most bandwidth. Both use NetFlow.

[amralrazzaz]

so i can configure the ports on router to capture traffic and monitor it from software.exe ?

[Georg Pauwen]

Hello,

you can identify top users by configuring the below (you might need to adapt this to reflect your input interface):

ip flow-top-talkers
 top 100
 sort-by bytes

!

interface Vlan1
 ip flow ingress
 ip flow egress

[amralrazzaz]

i did the below configuration on my default gateway port router to watch and capture the traffic in and out ,just need to know whats the standard parameters for packets and bytes value and from which value i should say there is large packets generating from this user or that ?

thanks

[Georg Pauwen]

Hello,

can you post the output ?