[c-nsp] routed via RIB, Cisco 3640 VoIP Problem

[Rodney Dunn]

That simply means a packet from process level is being
forwarded and it was sent via a RIB lookup (vs. a FIB
lookup).  Under some conditions we can actually use the
CEF/FIB to forwad locally generated packets.

On Thu, Nov 11, 2004 at 03:52:30PM +0500, Saad wrote:
> I am running VoIP call termination on Cisco 3640 with NM-HDV module. The
> 
> problem I am facing is that whenever I have traffic load then I have a
> lot of outgoing traffic on the router. I am using WIC-1ADSL card for
> internet and the protocol used is RFC1483 Routed. From previous
> discussion I think it might be the UDP packet size or I doubt that it
> might be a routing loop. When I use debug ip packet detail, I get the
> following result.
> 
> 
> 23:45:17: IP: tableid=0, s=80.32.170.82 (local), d=213.228.199.50
> (ATM2/0.1), routed via RIB
> 23:45:17: IP: s=80.32.170.82 (local), d=213.228.199.50 (ATM2/0.1), len
> 56, sending
> 23:45:17:     ICMP type=3, code=3

The above means the router sent a packet with a src of 80.32.170.82
(which is a locally attached ip address) to a dst of d=213.228.199.50
and routing table lookup resulted in an outbound interface of
ATM2/0.1.  Most likely this was a ping someone originated from 
router.


> 23:45:17: IP: tableid=0, s=213.228.199.50 (ATM2/0.1), d=80.32.170.82
> (ATM2/0.1), routed via RIB
> 23:45:17: IP: s=213.228.199.50 (ATM2/0.1), d=80.32.170.82 (ATM2/0.1),
> len 41, rcvd 3
> 23:45:17:     UDP src=17846, dst=17834

This is a packet that was swtiching through the router and was
punted to process level (else you would not have seen it in the
debug here).

> 23:45:17: IP: tableid=0, s=213.228.199.50 (ATM2/0.1), d=80.32.170.82
> (ATM2/0.1), routed via RIB
> 23:45:17: IP: s=213.228.199.50 (ATM2/0.1), d=80.32.170.82 (ATM2/0.1),
> len 144, rcvd 3
> 23:45:17:     UDP src=16821, dst=18515
> 23:45:17: IP: tableid=0, s=213.228.199.50 (ATM2/0.1), d=80.32.170.82
> (ATM2/0.1), routed via RIB
> 23:45:17: IP: s=213.228.199.50 (ATM2/0.1), d=80.32.170.82 (ATM2/0.1),
> len 120, rcvd 3
> 23:45:17:     UDP src=17281, dst=18265
>

You said: > problem I am facing is that whenever I have traffic load then I have a
> lot of outgoing traffic on the router. 

You need to be more clear on what load you see where.
The best way to track the traffic is to do "ip route-cache flow" 
on all your ingress interfaces and look at "sh ip cache flow".

 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/