Description

This article provides steps to determine high traffic rate.

Symptoms

1.High PFE CPU usage

2.Degraded performance

3.Packet loss

 

Solution

1. First check the traffic utilization on the interface using the below commands.

Monitor interface traffic- This command will give a real time traffic rate for all device interfaces. It shows output in bps and PPS format.

Monitor the traffic and determine the rate.

2. We can also check the traffic utilization on all interfaces using the below command. This will provide bps/PPS rate at the time the command was executed.

show interfaces * extensive 

Note: Add the bps/PPS on all interfaces to get the total throughput.

3. We can check the PPS rate also using the "show PFE statistics traffic" command.

4. To further understand the traffic patterns, it would be advisable to do a packet capture. It would be ideal if packet captures can be taken externally on the peer interfaces of all revenue ports. 

5.We can follow the below steps to locate the traffic rate using wireshark. 

Statistics--->Capture file properties (Summary).

Below is a sample output.

Measurement

Captured

Displayed

Marked

Packets

66

66 (100.0%)

—

Time span, s

164.913

164.913

—

Average pps

0.4

0.4

—

Average packet size, B

166

166

—

Bytes

10968

10968 (100.0%)

0

Average bytes/s

66

66

—

Average bits/s

532

532

—

The general formula to calculate the traffic rate is 

Traffic rate = Total bytes/ Total time (in seconds)

In the above example, the total bytes captured are 10968 and the total time in seconds is 164.913, so, 10968/164.913 gives a rate of 66 bytes per second.

Once the traffic rate is determined, verify if the traffic rate is legitimate.

If the traffic rate is legitimate, compare the numbers with device datasheet. If the numbers are exceeding, suggest customer to upgrade to bigger models.

If the traffic rate is not legitimate and excedding, troubleshoot further to locate the cause and block the unwanted traffic.

Below are few of the options to block unwanted traffic,

Configure stateless filters to block the suspicious traffic.

Configure security policy to block the suspicious IPs/Ports

Configure screen options to protect the device against such attacks.

 

 

 

Modification History

Draft