Until we ran into the issues with Discards from Cisco routers being the only fingerprint for (1) defective ATM-IMA circuits and (2) Firewalls that where hosed we were inclined to agree with you. Now we find we are forced to pay attention to them.
-----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Monday, October 08, 2007 11:32 AM To: InterMapper Discussion Subject: Re: [IM-Talk] "Good" reasons for discards (was: Question about snmp probe counter makeup) In my experience with Nortel and Cisco switches we have so many interface discards being reported that we tend to ignore interface discards whenever and wherever they surface (by setting the "ignore interface discards" behaviour). The discards happen in all situations including under extremely light load. I've opened cases with Cisco about this, and was told that the reason discards were incrementing was a "cosmetic bug". That is, it didn't reflect a lack of resources in the switches or dropped packets. Our network performance tests indicate no packets are being dropped. I think the discards may correspond to flooded packets where the recipient switch believes that the egress port is the ingress port (based on its forwarding table) and so drops the packet, although I have no way of confirming this. At 12:21 PM -0400 10/8/07, Richard E. Brown wrote: >--- Doug Veldhuisen wrote: >>I am guessing since we are using Qos policies on these routers, I'm >>seeing QoS drops, but not sure. > >--- Christopher Sweeney wrote: >It's ifOutDiscards in the ifTable. In theory, I think, the discards >should indicate packets discarded because of things like resource >limitations. In practice, we have seen some SNMP implementations >which count other types of discards, such as discards due to firewall >rules, in this number. >--- end of quote --- > >Yes, I have heard that some equipment may discard packets for "good >reasons" yet >count them in the MIB-II statistic ifOutDiscards. This could make >you think that >there's a problem, even though there isn't. Here are some examples: > >- As Doug Veldhuisen notes above, a router may drop a packet >that's otherwise OK >because of a QoS policy. For example, if a stream of higher priority packets >needs to be transmitted, the router may drop the lower priority ones. These >packets could appear as discarded packets in MIB-II statistics. > >- A firewall may also choose to count firewalled packets as >drops. This is an >explicit policy decision, not a lack of buffer space, but still >might be counted >as a MIB-II discard. > >- Spanning Tree. Switches can (by design) ignore spanning tree >updates, because >they are not interesting or because spanning tree has been shut off. Certain >brands of switches can count these as MIB-II discards. > >- Committed Information Rate. With permanent virtual circuits and similar >technologies, normal behavior of a customer device may be to attempt to send >data faster than the Committed Information Rate they have contracted for. The >router will drop those packets, and the drops may be counted in the >SNMP MIB-II >stats. > >Any comments from the list on these or other situations? Thanks! > >Rich Brown [EMAIL PROTECTED] >Dartware, LLC http://www.dartware.com >10 Buck Road, PO Box 130 Telephone: 603-643-9600 >Hanover, NH 03755-0130 USA Fax: 603-643-2289 >____________________________________________________________________ >List archives: >http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ >To unsubscribe: send email to: [EMAIL PROTECTED] ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED] ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED]
