detect jumbo packets on the network

On our platform, most of the equipment is Cisco and we have a jumbo packet problem on the network but there is no defined alarm that alerts me when jumbo packets are detected on the switches. Is there any way or alternative for solarwinds to inform me of this?

Find more posts tagged with

jumbo packets

size packet

Accepted answers

All comments

cnorborg

So, are the packets producing errors via syslog? Or are you just seeing an error counter increase somewhere? Or are you just wanting to detect them somehow?

If a syslog message is being produced, or an SNMP trap, it should be pretty simple to create and alert when the syslog or trap is generated.

If an error counter, there is a possibility that its already being polled via SNMP in Orion, although a search for jumbo in the SWQL studio brought up nothing? But, maybe it's called something else? If its not being polled already, but you can poll it via SNMP, you'd have to find the MIB/OID for it, set up a custom poller and then alert on that, or maybe just display it on a page somewhere?

If you just want to detect them, you could probably do this via NTA or the Netflow module. I know at one point I did generate a report on the average packet size on our network by parsing through Netflow data.

HTH!

evivas-ndc

We manually detect jumbo packets by running the "show interface" command on each interface of our Cisco Nexus 5000 and 7000 switches, but we would like solarwinds to alert us when these counters increase.

They do not arrive via syslog, they simply increment the interface counters

We will not be able to generate the netflow because the packet travels to and from different interfaces

Thank you.

verwin_u

hi @evivas-ndc

You can possible use NTA and NCM:

NTA:

- you can enable NTA on your 2-3 network devices where these jumbo size traverses.

- enable these in your NTA record.

https://documentation.solarwinds.com/en/success_center/nta/content/nta-required-fields-sw148.htm

InterfaceRx	10	SNMP ingress interface index
InterfaceTx	14	SNMP egress interface index

- configure flow alert by packet size

https://documentation.solarwinds.com/en/success_center/nta/content/nta-configuring-flow-alerts.htm

NCM:

- create scheduled custom job

https://documentation.solarwinds.com/en/success_center/ncm/content/ncm-jobs.htm

For further assistance in NCM job configuration and NTA flow records. I highly recommend to open a ticket to SW support for detailed assistance. ;-) SW do have tons of experienced NCM and NTA support geeks.

evivas-ndc

Hi. Thanks for your helps

In the ticket they responded this:

To further assist you on this, you can poll it using UNDP tool SolarWinds Universal Device Poller (UnDP) is a customization feature of NPM. With UnDP, you can create custom monitors for almost any statistic provided by SNMP based on its Management Information Base (MIB) and object identifier (OID).

You may see this: documentation.solarwinds.com/.../core-monitoring-mibs-with-universal-device-pollers-sw548.htm

verwin_u

Hi @evivas-ndc ,

As i promote support geeks, my question now is what happed to them

Have you inform them that you can identify jumbo packet via cisco show command -- show interface.

You can use NPM-UNDP if you know the specific OID of packet size. You may inquire to cisco if they could provide you that oid? Else, best option would be NCM and NTA. Most likely NCM as we are sure that you can view the info via show command.

How about NTA, where you able to check packet size in monitored flow interfaces?

Is your support ticket still open? What is the SW ticket number? You may also escalate your ticket to senior support engineers or L2 engineers.

ecklerwr1

FWIW: The Cisco OID for frame size on an interface is typically "1.3.6.1.2.1.2.2.1.14" which corresponds to the "ifMTU" object within the IF-MIB (Interface MIB) standard, allowing you to retrieve the maximum transmission unit (MTU) size of a network interface, essentially representing the maximum frame size it can handle. I use jumbo frame VLANs for a lot of things. There is more than one way to skin this cat but adding a UNDP for this could work... and these are ethernet frame sizes enumerated by the MTU so it's a layer 2 thing. IP packets are on a higher layer 3.

The biggest problem with using jumbo frames is exactly what you're running into... if the entire path doesn't allow jumbo frames it can do more harm than good.

jameslindsay

I have the same issue but, I don't care that Jumbo frames exist, I care that they have a high drop rate. I'm wondering how I might approach building an alert that detects drops based on the size and drop rate? Given 200 byte ping - no drops. 2000 byte ping - 7 % drop. 8000 byte ping - 25% drop. I am sending 200 pings for each test, alerts when drop rate is GTE 5%. Perhaps a SAM script probe from both ends of a circuit?