(17) Queue message
For output and input queues, a queue of numbers are displayed in m/n form, followed by the number of packets lost because the queue is full. Here, the value of m is used to represent the number of packets in the queue, while the value of n is used to represent the maximum queue size by grouping. By checking the number of missing packets and the relationship between m and n over a period of time, it is possible to determine whether it is necessary to recommend adjustments to the queue length of a specific interface to reduce missing packets. However, the media and usage level connected to the interface should also be considered to determine whether debugging the output queue length is beneficial. Media with high usage is most likely to cause the loss of packets in the queue: the router will encounter difficulties when transmitting data, resulting in the queuing of output packets, which in turn leads to packet loss when the output queue is full and other packets arrive for transmission to the media through the interface. On the input side, the larger ratio of missing packets to m and n means that the router is busy with other work and cannot process in time for incoming packets. If the sub-case lasts longer, it usually means that a more powerful router is needed to meet the work needs. Typically, this situation can be observed by a large number of lost packets in the entry direction of many router interfaces.
The queue information field value in the show interfaces above shows that there is currently no grouping in any queue. Moreover, although the output queue is full and 63 packets are lost, no packets are lost due to the input queue. The latter is a common situation because most routers (unless over-configured) should not have problems with handling incoming data.
(18) 5-min I/O rate
The next field displays the average number of bits and average number of packets sent and received through the interface in the first 5 minutes. Several factors must be considered when interpreting the data displayed in this field. First, the operating mode of the interface and the configuration of the network to which the interface is connected must be considered. For example, if the interface is a LAN interface, it can run in chaotic mode, so that each detector on the LAN can run in non-chaotic mode, that is, only broadcasting and frames delivered directly to the interface can be read.
If the port is in chaotic mode, all packets are read and a way to test data flowing across the network. If the interface is not in a mess, there is only a sense of the traffic she sends and receives, which may only account for a small portion of all traffic in the network.
Considering the network configuration, if the interface is connected to a LAN with only one station, such as a WEB server, then all traffic will flow through the router's interface. This means that a relatively accurate method of testing network activity can be obtained without considering the pattern in which the interface is located.
Another factor to consider is the fact that the 5-minute I/O rate represents one of the power averages of the 5-minute time constant. Therefore, any 5-minute I/O rate is the approximate value of the flow per second during this period. But the average generated by the four 5-minute time spans will be within 2% of the instant rate of the 20-minute unified flow rate.
Because the length of the packet is variable, the bit rate per second is usually more useful than checking activity on the interface from the perspective of the transmission medium. In the above example, the input rate of 1540000bps represents approximately 1/6 of the interface running rate. You may find it strange that why the input rate is nearly an order of magnitude higher than the interface output rate, the answer lies in the connection of the interface. In this particular router usage environment, the Ethernet interface is connected to a 10BASE-TLAN with only one additional station (ie, the company WEB server). WEB page requests flow in the form of a unified resource locator (URL), and the response to the URL request is a WEB page; this explains why the traffic level in the input and output directions is not proportional. Now that we understand the 5-minute I/O rate, let's introduce the input and output information of a specific packet that can be displayed for an interface.
(19) Packet and byte input
This field first represents the total number of error-free packets received by the router. Secondly, it also represents the total number of bytes of error-free packets received by the router.
If you divide the number of bytes by the number of packets, you can obtain the average packet length represented by bytes. This information can be used to provide a general representation of the type of traffic flowing on the interface. For example, relatively short packets typically transmit interactive query/response traffic, while relatively long packets typically transmit files including WEB pages and graphics contained in most of these pages.
(20) No buffering
The unbuffered field represents the number of packets received by the interface that have to be discarded due to the lack of buffer space by the router. Do not confuse this buffer space with the internal buffer of the interface. When there is a continuous "unbuffered" situation, it usually means that the router needs more memory. However, if no buffers values are encountered regularly, it may be due to broadcast storms on the LAN or noise on the serial port. You can check the next field to determine whether the cause of the unbuffered value is caused by a broadcast storm.
(21) Received broadcast
This field represents the total number of broadcast or multicast packets received by the interface. The important thing to note is that many broadcasts are part of the natural communication process. For example, the ARP used to resolve the Layer 3 IP address to a Layer 2 Mac address depends on sending a broadcast to query each station of the Layer 2 address associated with the Layer 3 address that must be obtained, so that the detection can be correctly formed to deliver the packet. Similarly, in a Novell IPX environment, servers broadcast service declaration protocol (SAP) packets every 30 seconds. These define the services provided by the server.
If you are in a strict IP environment, you are more likely to get a portion of the broadcast from an ARP request. If you have an application from time, you can really solve two problems with one action by setting the fixed item to the router's ARP cache for the application from time to time. This not only prevents the router from having to perform ARP operations, but also allows the parsing process to occur by checking memory, which is much faster than waiting for the response of the broadcast. Because data traffic is interrupted during ARP broadcasting, reducing ARP broadcasting can improve the information transmission function of the interface. Because ARP tables are maintained inside the router.
(22)Runts
Runt is an error case term, and the packet length associated with it is less than the minimum length associated with a certain protocol. In an Ethernet environment, the minimum packet length is 64 bytes on the adapter card and 72 bytes on the LAN. Therefore, if an interface receives an Ethernet packet less than 72 bytes, it will be an error case and the packet will be discarded. Generally, conflicts can cause the occurrence of Runt, and a failed adapter card can also cause this situation to occur.
(23)Giants
Giants is another error situation. It indicates that the packet exceeds the protocol maximum packet length. In an Ethernet environment, the maximum packet length of the adapter card is 1518 bytes, while the maximum packet length of the flowing in the network is 1526 bytes. Therefore, a packet with a length (including the preamble and the start boundary field) exceeding 1526 bytes is considered a Giant. Such packets are also discarded, and the Giant number represents the number of packets discarded due to this situation. The usual causes of Giant packets are lag conflicts or failures in adapter cards.
(24)Throttles
Although this happens rarely, if the router perceives buffering or processor overloading, its receiver will be turned off. This situation is called Throttles, and it is not actually a communication problem. Instead, it is a router function problem that requires you to check the status of the system buffer and processor. If the show interfaces command indicates that there are a large amount of "unbuffered" and Throttle, it is usually said that adding memory to the router should be considered. 【over】
Article entry: aaadxmm Editor in charge: aaadxmm
For output and input queues, a queue of numbers are displayed in m/n form, followed by the number of packets lost because the queue is full. Here, the value of m is used to represent the number of packets in the queue, while the value of n is used to represent the maximum queue size by grouping. By checking the number of missing packets and the relationship between m and n over a period of time, it is possible to determine whether it is necessary to recommend adjustments to the queue length of a specific interface to reduce missing packets. However, the media and usage level connected to the interface should also be considered to determine whether debugging the output queue length is beneficial. Media with high usage is most likely to cause the loss of packets in the queue: the router will encounter difficulties when transmitting data, resulting in the queuing of output packets, which in turn leads to packet loss when the output queue is full and other packets arrive for transmission to the media through the interface. On the input side, the larger ratio of missing packets to m and n means that the router is busy with other work and cannot process in time for incoming packets. If the sub-case lasts longer, it usually means that a more powerful router is needed to meet the work needs. Typically, this situation can be observed by a large number of lost packets in the entry direction of many router interfaces.
The queue information field value in the show interfaces above shows that there is currently no grouping in any queue. Moreover, although the output queue is full and 63 packets are lost, no packets are lost due to the input queue. The latter is a common situation because most routers (unless over-configured) should not have problems with handling incoming data.
(18) 5-min I/O rate
The next field displays the average number of bits and average number of packets sent and received through the interface in the first 5 minutes. Several factors must be considered when interpreting the data displayed in this field. First, the operating mode of the interface and the configuration of the network to which the interface is connected must be considered. For example, if the interface is a LAN interface, it can run in chaotic mode, so that each detector on the LAN can run in non-chaotic mode, that is, only broadcasting and frames delivered directly to the interface can be read.
If the port is in chaotic mode, all packets are read and a way to test data flowing across the network. If the interface is not in a mess, there is only a sense of the traffic she sends and receives, which may only account for a small portion of all traffic in the network.
Considering the network configuration, if the interface is connected to a LAN with only one station, such as a WEB server, then all traffic will flow through the router's interface. This means that a relatively accurate method of testing network activity can be obtained without considering the pattern in which the interface is located.
Another factor to consider is the fact that the 5-minute I/O rate represents one of the power averages of the 5-minute time constant. Therefore, any 5-minute I/O rate is the approximate value of the flow per second during this period. But the average generated by the four 5-minute time spans will be within 2% of the instant rate of the 20-minute unified flow rate.
Because the length of the packet is variable, the bit rate per second is usually more useful than checking activity on the interface from the perspective of the transmission medium. In the above example, the input rate of 1540000bps represents approximately 1/6 of the interface running rate. You may find it strange that why the input rate is nearly an order of magnitude higher than the interface output rate, the answer lies in the connection of the interface. In this particular router usage environment, the Ethernet interface is connected to a 10BASE-TLAN with only one additional station (ie, the company WEB server). WEB page requests flow in the form of a unified resource locator (URL), and the response to the URL request is a WEB page; this explains why the traffic level in the input and output directions is not proportional. Now that we understand the 5-minute I/O rate, let's introduce the input and output information of a specific packet that can be displayed for an interface.
(19) Packet and byte input
This field first represents the total number of error-free packets received by the router. Secondly, it also represents the total number of bytes of error-free packets received by the router.
If you divide the number of bytes by the number of packets, you can obtain the average packet length represented by bytes. This information can be used to provide a general representation of the type of traffic flowing on the interface. For example, relatively short packets typically transmit interactive query/response traffic, while relatively long packets typically transmit files including WEB pages and graphics contained in most of these pages.
(20) No buffering
The unbuffered field represents the number of packets received by the interface that have to be discarded due to the lack of buffer space by the router. Do not confuse this buffer space with the internal buffer of the interface. When there is a continuous "unbuffered" situation, it usually means that the router needs more memory. However, if no buffers values are encountered regularly, it may be due to broadcast storms on the LAN or noise on the serial port. You can check the next field to determine whether the cause of the unbuffered value is caused by a broadcast storm.
(21) Received broadcast
This field represents the total number of broadcast or multicast packets received by the interface. The important thing to note is that many broadcasts are part of the natural communication process. For example, the ARP used to resolve the Layer 3 IP address to a Layer 2 Mac address depends on sending a broadcast to query each station of the Layer 2 address associated with the Layer 3 address that must be obtained, so that the detection can be correctly formed to deliver the packet. Similarly, in a Novell IPX environment, servers broadcast service declaration protocol (SAP) packets every 30 seconds. These define the services provided by the server.
If you are in a strict IP environment, you are more likely to get a portion of the broadcast from an ARP request. If you have an application from time, you can really solve two problems with one action by setting the fixed item to the router's ARP cache for the application from time to time. This not only prevents the router from having to perform ARP operations, but also allows the parsing process to occur by checking memory, which is much faster than waiting for the response of the broadcast. Because data traffic is interrupted during ARP broadcasting, reducing ARP broadcasting can improve the information transmission function of the interface. Because ARP tables are maintained inside the router.
(22)Runts
Runt is an error case term, and the packet length associated with it is less than the minimum length associated with a certain protocol. In an Ethernet environment, the minimum packet length is 64 bytes on the adapter card and 72 bytes on the LAN. Therefore, if an interface receives an Ethernet packet less than 72 bytes, it will be an error case and the packet will be discarded. Generally, conflicts can cause the occurrence of Runt, and a failed adapter card can also cause this situation to occur.
(23)Giants
Giants is another error situation. It indicates that the packet exceeds the protocol maximum packet length. In an Ethernet environment, the maximum packet length of the adapter card is 1518 bytes, while the maximum packet length of the flowing in the network is 1526 bytes. Therefore, a packet with a length (including the preamble and the start boundary field) exceeding 1526 bytes is considered a Giant. Such packets are also discarded, and the Giant number represents the number of packets discarded due to this situation. The usual causes of Giant packets are lag conflicts or failures in adapter cards.
(24)Throttles
Although this happens rarely, if the router perceives buffering or processor overloading, its receiver will be turned off. This situation is called Throttles, and it is not actually a communication problem. Instead, it is a router function problem that requires you to check the status of the system buffer and processor. If the show interfaces command indicates that there are a large amount of "unbuffered" and Throttle, it is usually said that adding memory to the router should be considered. 【over】
Article entry: aaadxmm Editor in charge: aaadxmm