Cisco Cisco Token Ring Port Adapters Technical Manual
Wireshark Use to Identify Bursty Traffic on
Catalyst Switches
Catalyst Switches
Document ID: 116260
Contributed by Shashank Singh, Cisco TAC Engineer.
Jun 28, 2013
Jun 28, 2013
Contents
Introduction
Prerequisites
Requirements
Components Used
Background Information
Troubleshooting Methodology
Prerequisites
Requirements
Components Used
Background Information
Troubleshooting Methodology
Introduction
This document describes how to identify burst traffic on the switchports of Cisco Catalyst switches.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
The information in this document is based on the Cisco Catalyst Switch Series.
The information in this document was created from the devices in a specific lab environment. All of the
devices used in this document started with a cleared (default) configuration. If your network is live, make sure
that you understand the potential impact of any command before executing the command.
devices used in this document started with a cleared (default) configuration. If your network is live, make sure
that you understand the potential impact of any command before executing the command.
Background Information
Traffic bursts can cause output drops even when the interface output rate is significantly lower than the
maximum interface capacity. By default, the output rates in the show interface command are averaged over
five minutes, which is not adequate to capture any short−lived bursts. It is best to average them over 30
seconds. In this case, you can use Wireshark in order to capture egress traffic with the Switched Port Analyzer
(SPAN), which is analyzed in order to identify the bursts.
maximum interface capacity. By default, the output rates in the show interface command are averaged over
five minutes, which is not adequate to capture any short−lived bursts. It is best to average them over 30
seconds. In this case, you can use Wireshark in order to capture egress traffic with the Switched Port Analyzer
(SPAN), which is analyzed in order to identify the bursts.
Troubleshooting Methodology
Identify an interface that has incremental output drops. For example, you notice output drops on a
100Mb link while the average utilization of the link is only 55Mb. Here is the output of the command:
100Mb link while the average utilization of the link is only 55Mb. Here is the output of the command:
Switch#show int fa1/1 | i duplex|output drops|rate
Full−duplex, 100Mb/s, media type is 10/100BaseTX
1.