Solved

Wireshark switch port / LAG

Posted on 2014-09-05
3
563 Views
Last Modified: 2014-09-17
I am investigating some potential network issues (user base is blaming network so I'm attempting to prove it is not) and as a result have setup some basic bandwidth monitoring on a number of edge ports going to users PC's who appear to be frequently affected. I have also setup the same bandwidth monitoring on the LAG group and on the separate members of the LAG ports.

I have noticed that daily we experience a very odd heartbeat every 30 secs or so (obvious in the diagram attached) which I have no idea where it roots from. It's only present in one of the LAG members however. I've only just started placing times of the pattern appearing but it's very obvious when it is, as you'll see.

My question is how, without any formal monitoring SW in place at present, can I tell what the traffic is and where it's coming from? I've been told I can use wireshark but how to I go about setting that up to reflect what's going through a certain LAG or port?

Somebody mentioned connecting a laptop to the core and setup port mirroring. Our core is a Cisco 3750 stack and the edge is Cisco Small Business 500G stack.

Thanks,

Skijuice
Traffic-Stats.jpg
0
Comment
Question by:skijuice
3 Comments
 
LVL 12

Assisted Solution

by:Bryant Schaper
Bryant Schaper earned 100 total points
ID: 40306342
not sure if the sb supports port mirroring, but that would capture the traffic, you can download a free trial of riverbed cascade pilot and see if it spots anything.  Netflow might me a better tool, cacti I think will analyze it.
0
 
LVL 11

Expert Comment

by:itguy565
ID: 40308509
0
 
LVL 57

Accepted Solution

by:
giltjr earned 400 total points
ID: 40309958
The 3750 definitely support port mirroring.    You can use Wireshark to capture and analyze the data.

The jpg file is a little fuzzy (maybe its my eyes), but it looks like your "heart beat" is 250Mbps every 30 seconds.  I would NOT call that a heart beat.  A heart beat should be a few bps, not a couple hundred Mbps a second.  That looks more like some type of file/folder/directory/system synchronization/replication.

I would assume the reason that member #1 shows nothing and member #2 shows the spike is that the traffic is a single TCP session between two hosts.  When you have a LAG group the traffic is balanced between the links based on various things, the configurable options on most Cisco devices are:

1) source/target MAC address
2) source/target IP address
3) source IP address+source port/target IP address+target port.

Once a link is picked based on the above, the traffic stays on that link until the link goes down, or in the case of #3, the TCP connection is torn down a new connection is established.
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now