Cisco claims that you are running out of buffers which means that, just as
Jakob mentions below, there is too much traffic. Cisco tries to hold on to the
excess but eventually you run out of buffers. However…
Discards also happen when the pipe is no near full in the following situations
(at least on Cisco Routers):
Non-routable packets (TX Discards) caused by
– poorly implemented firewall and NAT devices
- Trojans and viruses
- Malformed packets
ATM AAL5 problems (TX Discards)
We have seen this frequently on ALL Cisco ATM router ATM-IMA ports.
We have a couple of open tickets with LECs because of such discards that seems
to be caused by Far End LoF (Loss of Frame) messages as seen by LEC switches
even though the CPE claims no LoF as locally reported.
VPN / firewall equipment (RX Discards)
We have a customer with two DS3s connecting to a Cisco 3662 Router
which them connects vi FastEthernet to a high end SonicWall Router. We are
seeing massive discards at the router because the firewall is refusing to take
traffic. (This is different from a firewall that takes and reject traffic (no
discards). This is a refusal of ANY packet on occasion before the firewall
would even have the ability to evaluate it. SonicWall admits this can happen
but blames customer equipment on the LAN fo overwhelming the firewall’s spec’s
(which isn’t happening in the case our customer currently is working).
From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of
Jakob Peterhänsel
Sent: Saturday, October 06, 2007 7:39 AM
To: InterMapper Discussion
Subject: Re: [IM-Talk] Question about snmp probe counter makeup
Hi All,
I have seen this on routers too, and on Cisco it happens, basic, when the line
can't handle more traffic and the router discards the packet.
Some bad routers, simply try to handle all packets and then at some point crash
in sted.. not what you want.. :-)
So, discards is an indication that your line might be oversaturated and (if it
hapens a lot) might need an upgrade.
Jakob Peterhänsel
"Be a part of the Love Generation - carry a smile, not a gun."
- JP, May 2006
Email: [EMAIL PROTECTED]
AIM: Marook
Phone: +45 29687104
On 05/10/2007, at 23.12, Christopher L. Sweeney wrote:
At 4:03 PM -0500 10/5/07, Doug Veldhuisen wrote:
I have intermapper installed, monitoring a large wide area network.
Several routers are showing TX Discards = xxxx/minute when using the snmp
traffic probe. Can someone please tell me what smnp variables make up the TX
Discard counter? I am trying to figure out what is happening because many
routers have large TX discards.
I am guessing since we are using Qos policies on these routers, I'm seeing QoS
drops, but not sure.
It's ifOutDiscards in the ifTable. In theory, I think, the discards should
indicate packets discarded because of things like resource limitations. In
practice, we have seen some SNMP implementations which count other types of
discards, such as discards due to firewall rules, in this number.
-- Christopher
--
================================================
Christopher L. Sweeney
Dartware, LLC
http://www.dartware.com/
____________________________________________________________________
List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/
To unsubscribe: send email to: [EMAIL PROTECTED]
____________________________________________________________________
List archives:
http://www.mail-archive.com/intermapper-talk%40list.dartware.com/
To unsubscribe: send email to: [EMAIL PROTECTED]
