another www.yapchinhoong.com production
Thursday, August 2, 2012
Cisco Router «unknown protocol drops»
Introduction
Unknown protocol drops is a counter on the Cisco router interface.
It is caused by protocols that are not understood by the router.
The unknown protocol drops counter was first introduced in Cisco IOS 12.4(15)T8 release, but it was buggy; in which there are 2 duplicating lines and the counter increments by 1 whenever the show interfaces [type num] command is issued, even with the interface is administratively shutdown. 🙂
Below shows that the counter was not there in Cisco IOS 12.4(15)T7.
Below shows that the counter was introduced in Cisco IOS 12.4(15)T8 release, and illustrates the bug as mentioned above.
The counter seems OK after Cisco IOS 12.4(15)T9 release.
Root Causes of Unknown Protocol Drops
Unknown protocol drops are normally dropped because the interface where these packets are received is not configured for this type of protocol, or it can be any protocol that the router does not recognize.
The common root causes are DTP, CDP, and LLDP (new in Cisco IOS 15.2T releases).
Below illustrates a problem scenario due to DTP:
Below illustrates a problem scenario due to CDP:
Below illustrates a problem scenario due to LLDP (Cisco IOS 15.2T):
Note: «unknown protocol drops» does not applicable for LLDP packets on Cisco IOS 15.1T releases.
Спустя несколько дней после подключения дополнительного провайдера на Cisco 2821 по всем внешним IP на этом интерфейсе начались жуткие потери. Не уверен что из-за провайдера, но все же.
Схема подключения
ISP1 -> Свич Untag Vlan 668 (11 port) -> Tag port 48 -> GE0/0.668
ISP2 -> Свич Untag Vlan 700 (12 port) -> Tag port 48 -> GE0/0.700
.
Проблема с очередями на интерфейсе (IHQ/IQD).
После применения на интерфейсе ‘hold-queue 4096 in’ — пинги стабилизировались, но через пол часа подключится по ssh уже не удалось (я так понимаю проблема не соответствия исходящей очереди и входящей) но это дело десятое, хотелось бы разобраться в первопричине.
- Вопрос задан более трёх лет назад
- 4024 просмотра
Спасибо за ваш комментарий. В тот день, когда писал данный вопрос — выполнил reload поздней ночью и несколько дней подряд счетчики очередей и дропов стабильно держались на ноле.
Пока потерь не наблюдается. Но уже снова начали наблюдаться дропы в очереди.
Вот статистика интерфейса спустя 10 минут после clear counters (до сброса было 18 дропов)
vpn#show interface gi0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 6073.5cac.8d40 (bia 6073.5cac.8d40)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 2/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
Keepalive set (10 sec)
Full Duplex, 1Gbps, media type is RJ45
output flow-control is XON, input flow-control is XON
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of «show interface» counters 00:26:18
Input queue: 12/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 8872000 bits/sec, 872 packets/sec
5 minute output rate 575000 bits/sec, 560 packets/sec
1321101 packets input, 1657404955 bytes, 0 no buffer
Received 30678 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 345 multicast, 0 pause input
852001 packets output, 106901875 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
398 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
2) В отот раз, когда были проблемы смотрел статистику процессора, роутер просто отдыхал. Почти все процессы 0.01, жрущий IP-Input разве что был 0.14%
I have several routers running DMVPN to connect our sites together, and recently the network has seemed sluggish. In looking at the routers, I see the internal lan interface has what seems to me an extremely large number of unknown protocol drops. The attached code of the show interfaces output shows this particular router has over 24 million.
Is this most likely a broadcast storm? Any ideas?