Solved

Wireshark switch port / LAG

Posted on 2014-09-05
3
605 Views
Last Modified: 2014-09-17
I am investigating some potential network issues (user base is blaming network so I'm attempting to prove it is not) and as a result have setup some basic bandwidth monitoring on a number of edge ports going to users PC's who appear to be frequently affected. I have also setup the same bandwidth monitoring on the LAG group and on the separate members of the LAG ports.

I have noticed that daily we experience a very odd heartbeat every 30 secs or so (obvious in the diagram attached) which I have no idea where it roots from. It's only present in one of the LAG members however. I've only just started placing times of the pattern appearing but it's very obvious when it is, as you'll see.

My question is how, without any formal monitoring SW in place at present, can I tell what the traffic is and where it's coming from? I've been told I can use wireshark but how to I go about setting that up to reflect what's going through a certain LAG or port?

Somebody mentioned connecting a laptop to the core and setup port mirroring. Our core is a Cisco 3750 stack and the edge is Cisco Small Business 500G stack.

Thanks,

Skijuice
Traffic-Stats.jpg
0
Comment
Question by:skijuice
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 12

Assisted Solution

by:Bryant Schaper
Bryant Schaper earned 100 total points
ID: 40306342
not sure if the sb supports port mirroring, but that would capture the traffic, you can download a free trial of riverbed cascade pilot and see if it spots anything.  Netflow might me a better tool, cacti I think will analyze it.
0
 
LVL 11

Expert Comment

by:itguy565
ID: 40308509
0
 
LVL 57

Accepted Solution

by:
giltjr earned 400 total points
ID: 40309958
The 3750 definitely support port mirroring.    You can use Wireshark to capture and analyze the data.

The jpg file is a little fuzzy (maybe its my eyes), but it looks like your "heart beat" is 250Mbps every 30 seconds.  I would NOT call that a heart beat.  A heart beat should be a few bps, not a couple hundred Mbps a second.  That looks more like some type of file/folder/directory/system synchronization/replication.

I would assume the reason that member #1 shows nothing and member #2 shows the spike is that the traffic is a single TCP session between two hosts.  When you have a LAG group the traffic is balanced between the links based on various things, the configurable options on most Cisco devices are:

1) source/target MAC address
2) source/target IP address
3) source IP address+source port/target IP address+target port.

Once a link is picked based on the above, the traffic stays on that link until the link goes down, or in the case of #3, the TCP connection is torn down a new connection is established.
0

Featured Post

Turn Insights into Action

Communication across every corner of your business is essential to increase the velocity of your application delivery and support pipeline. Automate, standardize, and contextualize your communication processes with xMatters.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question