what to check when getting high errors or discards on an interface

I just turned on an alert in solarwinds to alert me when I have a high number of errors or discards on an interface. I'm recieving a ton of alerts now. What are the things I can check to troubleshoot and resolve this and what is a normal amount of errors or discards to have in a day on an interface?

Find more posts tagged with

npm

Accepted answers

All comments

sean.martinez

You will need to contact your Device’s Vendor to understand what the Errors or Discards are, since Vendors represent Discarded Packets differently. Here is a paper from Cisco about their Discards:

http://www.cisco.com/en/US/products/hw/routers/ps167/products_tech_note09186a008012fb87.shtml

If you are seeing a lot of Discards or Errors from a Cisco Device, here is a document on how to Troubleshoot Switch Port and Interface Problems

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015bfd6.shtml

Message was edited by: Sean Martinez Fixed the 2nd Link

krfitzgerald

the second link is not working?

FormerMember

discards are nothing to worry about.

In/out errors are usually issues with physical layer connections

so if you are getting in/out errors then clean the terminations, reseat the SFPs, replace old cables, move data cables away from RFI emitting devices that kind of stuff to get your errors to go away.

netlogix

I know discards should not be a big deal, but I have some applications that get real flaky because of high discards.
the 2nd link didn't work do you have a different one?

FormerMember

Would like to hear more if you get time.

My sys admins tell me nothing is wrong when i show them all the windows devices seeing 1 million discards a day

and i even have one switch port that sees 25 to 35 trillion discards a day and everyone still says its all good
so if you have quantifiable degregation from discards please share it so i can tell them all where they are wrong

or at least have a better approach on them for the next round.

if the packets are being discarded at the interface the application should never be seeing the packet.

netlogix

Windows devices? Do they have windows firewall running? if so, packets that are blocked by windows rules are counted as drops. Even if the rules are wide open, some packets are dropped by the firewall (some unicast or multicast, etc).

TCP packets should get re-transmitted and the tcp window should get automatically adjusted, but re-transmits take up network time and can compound an issue of a congested network/interface.

25-35 trillion! wow, there is something wrong or it might have 64 bit counters enabled and only handle 32 or a bad snmp poll, or it's really dropping that many packets. Is it constant, or bursty? If bursty, is it specific times or appears random?

I have an event that happens every day at 8:00 am and causes the count of packets to jump about 4 times the normal count and the output buffers get overrun on my router and I end up dropping 100k packets over a 10 minute period, I am trying to figure out how to troubleshoot/tune that. The spike it only about 50% bandwidth. The router is starting to get aged and I just don't think it can process the pps unless I somehow tune it. I just need a starting place and am trying to get as much documentation as I can to come at the issue with some knowledge.

FormerMember

Discards could be caused by high utilisation on the interface

Errors could be a misconfiguration such as speed/duplex or a layer 1 issue such as cabling etc.

rfletcher

Does anyone know where Orion pulls the information for receive and transmit discards? We're not really concerned that there are discards but we'd like to know how orion pulls them