01-09-2012 06:32 AM - edited 03-04-2019 02:51 PM
I have a 2911 and a 1921 router, both are having unknown protocol drops only on the GE 0/0 interface. Both routers are connected to HP switches:
2911 -- E5406zl
1921 -- HP 2600 series
I disabled CDP on both routers, but the unknown protocol drops on the 2911 keep going up drastically. I have posted the config from the 2911 below.
Building configuration...
Current configuration : 3529 bytes
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone year
service password-encryption
!
hostname
!
boot-start-marker
boot-end-marker
!
card type t1 0 0
card type t1 0 1
card type t1 0 2
!
no aaa new-model
clock timezone gmt -5
clock summer-time cdt recurring
no network-clock-participate wic 0
no network-clock-participate wic 1
no network-clock-participate wic 2
!
no ipv6 cef
ip source-route
ip cef
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
license udi pid CISCO2911/K9 sn FTX1513ALLS
!
!
!
!
controller T1 0/0/0
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/0/1
clock source internal
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/1/0
clock source internal
cablelength long 0db
channel-group 3 timeslots 1-24
!
controller T1 0/1/1
clock source internal
cablelength long 0db
channel-group 2 timeslots 1-24
!
controller T1 0/2/0
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/2/1
clock source internal
cablelength long 0db
channel-group 0 timeslots 1-24
!
buffers middle permanent 200
buffers middle max-free 230
buffers middle min-free 50
buffers big permanent 75
buffers big max-free 200
buffers big min-free 15
buffers verybig permanent 20
buffers verybig max-free 20
buffers tune automatic
!
!
!
!
interface Multilink1
ip address 192.168.200.1 255.255.255.252
ip flow ingress
ip flow egress
load-interval 30
ppp multilink
ppp multilink group 1
ppp multilink fragment disable
no cdp enable
hold-queue 4000 out
!
interface GigabitEthernet0/0
ip address 10.10.3.1 255.255.240.0
ip flow ingress
ip flow egress
duplex full
speed auto
no cdp enable
hold-queue 3000 in
hold-queue 4096 out
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
hold-queue 40 out
!
interface Serial0/0/1:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
hold-queue 40 out
!
interface Serial0/1/0:3
ip address 192.168.1.2 255.255.255.0
ip flow ingress
ip flow egress
load-interval 60
no fair-queue
hold-queue 200 in
hold-queue 4000 out
!
interface Serial0/1/1:2
ip address 192.168.8.2 255.255.255.0
ip flow ingress
ip flow egress
load-interval 30
no fair-queue
hold-queue 200 in
hold-queue 4096 out
!
interface Serial0/2/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
!
interface Serial0/2/1:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
no fair-queue
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip flow-cache timeout active 1
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination
!
ip route 0.0.0.0 0.0.0.0 10.10.18.1
ip route 10.10.1.0 255.255.255.0 192.168.1.1
ip route 10.10.5.0 255.255.255.0 192.168.8.1
ip route 10.10.9.0 255.255.254.0 192.168.200.2
!
logging trap notifications
logging
!
!
snmp-server community
snmp-server community
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
session-timeout 60
privilege level 15
logging synchronous
login
transport input telnet
!
scheduler allocate 20000 1000
end
01-09-2012 06:43 AM
This problem will not be detectable by checking the config.
Likely there is a protocol on the LAN which the router does not recognize.
It could be ipv6 or some multicast protocol used on the LAN or some non-standard application, just to mention a few possibilities. Perhaps you can make a Wireshark trace to see what traffic is on the net?
Feel free to post the result if you like.
If there is a lot of non-ipv4 traffic, you are likely to have found the culprit.
regards,
Leo
01-09-2012 12:24 PM
Thanks, I'll run a wireshark scan tomorrow and let you know of the results.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: