[c-nsp] 6500 - What determines whether certain traffic is punted or not?

[Lee]

Hi Drew,

On Tue, Nov 24, 2009 at 11:33 AM, Drew Weaver wrote:

> Howdy,
>
> I've been having some issues with queue drops/CLI sluggishness on a 6500
> and I wanted to check what kind of volume of traffic I was getting punted to
> the RP.
>
> I made a span session and began checking out the traffic with tethereal.
>

How did you make the span session?  I think a regular span session gets you
everything - not just punted packets.

I haven't actually tried this, but here's the notes I have for setting up a
span session to see punted packets:
------------------

Here are the instructions to setup inband span (which monitors traffic sent
to the MSFC):

Router#monitor session 1 source interface fa 3/3 !--- Use any interface that
is administratively shut down.
Router#monitor session 1 destination interface fa 3/2

Now, go to the SP console. Here is an example:

Router#remote login switch
Router-sp#test monitor add 1 rp-inband rx <--- check the syntax as it varies
from one IOS to the next so use ?

Verify monitor session:

Router-sp#test monitor show session 1
Ingress Source Ports: 3/3 15/1
Egress Source Ports: 3/3
Ingress Source Vlans: <empty>
Egress Source Vlans: <empty>
Filter Vlans: <empty>
Destination Ports: 3/2

Go back to the RP and verify the monitor session as well:

Router#show monitor
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa3/3
Destination Ports : Fa3/2
SP console:
Router-sp#test monitor session 1 show
Ingress Source Ports: 3/3 15/1
Egress Source Ports: 3/3
Ingress Source Vlans: <empty>
Egress Source Vlans: <empty>
Filter Vlans: <empty>
Destination Ports: 3/2

To remove the inband span from sp do
 test monitor session 1 del
and from the rp do
 no mon sess all
-------------------------------

Regards,
Lee



> It seems like a huge (30,000) or so packets every few seconds of just UDP
> traffic is being punted.
>
> The system is a Sup720-3BXL.
>
> Does anyone know how to determine what kind of traffic should be punted to
> the RP and more importantly why this UDP traffic is hitting the RP?
>
> It almost looks like p2p traffic, but I also see other types of traffic,
> tcp 445, DNS, port 80, etc.


> thanks,
> -Drew
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>