8600 CP-Limit - 4500 Port Rate-Limiting

[bartounet16000]

Hello
I have 6 stacks of Avaya 4548 this stacks are connected to a stack distribution in 4548 which it connected whith SMLT on 2 network core Nortell networks 8600

Since today on 8600 the SMLT ports connected to this distribution stack shutdown regularly with this kind of log:

2014-02-04T08: 43:32.198098 +01:00 CPU5 [2014-02-04 8:59:04] WARNING CPU Shutdown Port 4/5 due to excessive control frames multicast 0, broadcast 15011 packet per second

My question is
What is the default value for the CP-LIMIT on 8600 ( 10000 pps ?)

My other question is:
How does the option of rate limit on ports Nortell 4548 works ?
when the level is reached? the port become shutdown ? or til drop packets?

[Théo]

Hi,

By default CP-limit is defined to 10000 or 8000 pps, it can change with versions.

On ERS 4500, like 5000, rate-limit will define a threshold of authorised broadcast and/or multicast traffic. When the threshold is reach, all other packet are dropped. Interface stay UP.
This is only on ERS 8000 (and VSP) that ports are shutdown with CP-limit.

when you do "show rate-limit", it display percentage of multicast and broadcast per port. If you see some port at 100%, check stats. this is not necessary a loop. you can have only broadcast/multicast traffic.

In your case, it seems to have a loop, or an MLT issue on you edge device. You should configure SLPP or loop detect.

regards,
Théo
 

[bartounet16000]

Thank you for your answer.
I have analyse a lot of things..

I have captured traffic on the 2 port interconnected whith SMLT

During the problem ( when CP-Limit shutdown ports) i can see a lot of packet broadcast ant multicast from hosts...
The packets rate from this hosts explain the shutdown by CP-LIMIT
On core 8600 logs are :
2014-02-06T15:06:28.610524+01:00 CPU5 [2014-02-06 15:22:01] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 0, broadcast 19010 packet per second
2014-02-06T16:19:02.775216+01:00 CPU5 [2014-02-06 16:34:37] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 0, broadcast 20348 packet per second
2014-02-06T16:35:34.479815+01:00 CPU5 [2014-02-06 16:51:08] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 3385, broadcast 6228 packet per second
2014-02-06T16:35:41.162774+01:00 CPU5 [2014-02-06 16:51:14] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 8322, broadcast 3878 packet per second
2014-02-06T16:50:03.269101+01:00 CPU5 [2014-02-06 17:05:37] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 0, broadcast 9225 packet per second
2014-02-06T16:50:04.246056+01:00 CPU5 [2014-02-06 16:50:28] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 7089, broadcast 1192 packet per second
2014-02-06T18:31:32.311575+01:00 CPU5 [2014-02-06 18:47:06] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 0, broadcast 16031 packet per second
2014-02-06T18:48:07.895803+01:00 CPU5 [2014-02-06 19:03:42] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 0, broadcast 7470 packet per second
2014-02-06T19:19:13.388023+01:00 CPU5 [2014-02-06 19:34:47] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 3181, broadcast 12872 packet per second
2014-02-06T19:19:14.561270+01:00 CPU5 [2014-02-06 19:19:39] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 11120, broadcast 287 packet per second
2014-02-06T20:41:58.053996+01:00 CPU5 [2014-02-06 20:57:31] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 3172, broadcast 8035 packet per second
2014-02-06T21:31:34.728844+01:00 CPU5 [2014-02-06 21:47:08] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 0, broadcast 14406 packet per second
2014-02-06T21:31:38.252815+01:00 CPU5 [2014-02-06 21:32:02] CPU WARNING Shutdown port 4/5 due to excessive control frames multicast 17536, broadcast 0 packet per second


this packets become from a stack after distribution stack.

But i have problem to understand if this massiv storm packets are due to problem on hosts or a network loop which duplicates packets about these hosts....

Can you help me for ths analyse

If it is a loop.. why it does not stop by bpdu filtering, or rstp... and how discover where it is

this packets storm show a massive flow of packet from Ghost Client... which is try to discover server...

Network loop or bad hosts ....

[Théo]

Hi,

You said "during problem", you mean that problem is not always present ?
What is the impact on your network service ? what kind of devices are connected on edge device (4548) ? PC, ip phone,.. ?

In few cases, STP and bpdu-filtering can't work. exemple with IP phone, connect both links on the same stack. As phone filter bpdu, STP and bpdu-filtering are useless.

to find the loop, if it come from a stack after the distribution one, check rate-limit percent on distribution switch.
If stacks are connected with MLT to distribution, disable redondants ports. 
Make a clear-stats on interconnexion ports, wait few times and check port-statistics. the Port with a lot of broadcast / multicast packet received should the bad one.
Then, check rate-limit stats on this stack and note ports with big percent. make a clear-stats on them and check there stats.

Good luck
Regards,

Théo

 

[bartounet16000]

Thanks for answer
 I have just solve problem
It was a loop , someone had plug two plus on the wall

I had could found thé loop whith packet capture ans duplicate frames

My probleme was bpdu filtering count time 12000 ...
So when ports was becoming up the loop was activating...

It is crazy thé second beetween port up ans become down the loop can born