[c-nsp] 6509 policer effect different between input and output

[Ziti Bake]

I am testing policing on a C6509 with sup720, running
native (12.2(18).SXD5).  I am trying to configure a
layer-3 "interface vlan" with a 12Mbps policer both in
and out:

access-list 2000 permit ip any any
class-map match-all match_any
  match access-group 2000
policy-map 12mbps_policer
  class match_any
     police 12000000 192000 192000 conform-action
transmit 
!
interface Vlan667
 ip address 10.10.50.38 255.255.255.252
 no mls qos tiny-fragment
 service-policy input 12mbps_policer
 service-policy output 12mbps_policer
!

One test PC is connected via layer-2 interface fa7/1:

interface FastEthernet7/1
 no ip address
 switchport
 switchport access vlan 667
 spanning-tree portfast

...and another is connected via layer-3 gi8/1 and a
simple switch (no QoS, no VLAN there):

interface GigabitEthernet8/1
 ip address 10.10.3.200 255.255.255.224
!

I am running iPerf tests (100 parallel TCP flows)
between the two devices.  With output policing
(pushing traffic into the 6509 via L3 int gi8/1, "out"
interface Vlan667, and on out L2 port fa7/1), I am
limited to 12Mbps throughput when my 12000000 policer
is configured with a burst size between 128kbytes and
192kbytes.  This is in the ballpark for the expected
burst needed, per Cisco's calculator.

However, reversing the direction of the iPerf push (in
L2 fa7/1, in L3 Vlan667, and out L3 int gi8/1), then I
am limited to 3-4Mbps with the same policer applied in
the input direction.  At 100 iPerf flows, with the
following burst sizes, I am seeing unexpectedly low
bitrates:

- police 12000000 128000 128000 (3.8Mbps)
- police 12000000 256000 256000 (5.8Mbps)
- police 12000000 512000 512000 (8.5Mbps)
- police 12000000 768000 768000 (9.1Mbps)
- police 12000000 1024000 1024000 (10.3Mbps)
- police 12000000 1280000 1280000 (11.0Mbps)
- police 12000000 1536000 1536000 (11.0Mbps)

I can get near 12Mbps through the input policer, but
only using very large burst size (1200kbytes!).  I'm
not sure why my results differ so much from input to
output policing.

-zB


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com