Determine whether network packet loss is a problem of the device (vro as an example)

Check whether the route table matches the destination address of the packet. If there are matched table items in the route table, subsequent work will be performed. Therefore, it is the basis of router interfaces to receive packets. If the packet is lost, the routing switching function will be greatly affected, resulting in data loss.

There are many causes of packet loss, but the main reason may be due to insufficient vro memory or CPU overload. To solve this problem, you must first determine the cause of the problem. The following describes two simple methods to help the network administrator determine who is behind the loss of router packets.

 

1. Determine whether the message is lost due to memory fragmentation.

Memory fragmentation refers to the fact that the vro memory is divided into many discontinuous blocks. This will reduce the memory usage. In severe cases, memory errors may occur, affecting the performance of the router. It also causes the loss of router packets. In fact, not only does the vro memory have the fragmentation problem, but also does the common hard disk. For example, Microsoft's operating system has a tool for fragment, which can ensure that users can organize fragments in the hard disk to improve the storage capacity and performance of the hard disk. The memory fragment here is actually similar to the hard disk fragment.

How can we determine whether there are fragments in the vro memory? Here, we mainly use the show memory command that comes with the Cisco router. This command displays information about the current memory. If you run this command, the current available memory (Free) and maximum available fast (Largest) values are displayed. The Network Administrator compares the two values to determine the impact of fragmentation on the performance of the router. This mainly compares the available memory of the router with the maximum available and fast size. If the available memory of the vro is close to the maximum available speed, it indicates that although the vro has fragments, the effect is not great. However, if the maximum available block is small, such as only a few 10th of the maximum memory available, it indicates that the router memory fragmentation problem is serious.

For example, if the available memory of the vro。 is 20 mb and the maximum available block size is 15 MB, it indicates that the vro memory contains some broken blocks, but this broken block does not affect the normal operation of the vro. If the available memory is 20 mb and the maximum available block is 0.8M, there are many broken blocks in the vro memory. Continuous continuous memory is not highly available and fast enough, which may cause serious memory allocation problems, such as intermittent packet loss for one or more interfaces. Some memory fragments are allowed in the vro memory. So far, no memory management technology can completely avoid producing memory fragments. This Shard must be a reasonable value. No one can provide a specific standard for the specific value. However, based on my experience, it is best to ensure that the size of the available block is between 1/2 and 1/3 of the available memory. Of course, the closer the available block size is to the available memory, the better.

In fact, the relationship between the available block and the available memory can be expressed using the drawer in the cabinet. For example, although the available capacity of a cabinet is relatively large, it is divided into more than 1000 grids of different sizes. The space capacity of each grid is limited. When large data needs to be stored, the whole capacity is sufficient, but the capacity of small grids is insufficient. In this case, the message is lost. At this time, it seems that the memory is sufficient, but there is no continuous space in the memory to store data. Therefore, these seemingly large available memory cannot save much data.

How can this problem be solved? The simplest method is to restart the router. When the router restarts, the router IOS system will re-allocate the memory and cache space. After restarting, the network administrator can check the memory allocation process. In general, excessive fragments are caused by a router overload for a long time. You only need to restart to solve the problem of memory fragmentation.

 

Ii. Determine whether the CPU is overloaded

If you are sure that there are not too many fragments in the vro memory, the network administrator should consider whether the packet is lost due to CPU overload. To view the CPU usage, you can use the show process command to view the CPU usage of the vro.

This command shows the CPU usage of the vro。 in the last 5 seconds, the last 1 minute, And the last 5 minutes. Because the CPU usage has been changing, the network administrator is mainly concerned with the average CPU usage within five minutes. Generally, if the CPU usage within five minutes can be kept below 60%, and cannot exceed 70% at most, it indicates that the CPU of the router is still working normally. However, if the CPU usage reaches 70% or above, it indicates that the CPU usage of the router is excessive. In this case, the loss of router interface packets may be caused by CPU overload. However, the network administrator cannot determine that the CPU of the router is overloaded by an analysis. If an enterprise has a conference video application, the CPU usage of the router is always high during the video. Therefore, the network administrator needs to perform multiple tests in different time periods. If the results of Multiple tests show that the CPU usage in the last five minutes has reached 70% or more, the router's CPU overload will be confirmed.

If you confirm that the vrocpu CPU is overloaded, the network administrator needs to confirm which process occupies a large amount of memory. Only by finding out the culprit can the network administrator solve the problem. If the network administrator finds that the sulfate BACKGROUND process occupies a large amount of CPU, a bridge storm occurs. To solve the problem of CPU overload, the network administrator must first find out who is consuming CPU resources.

To achieve this, the network administrator can use the show process memory command to query the MEMORY allocation information of the router. By executing this command, the system will feed back information such as the available memory usage and usage of the current vro. It also reflects the memory space occupied by each process. If a process occupies a large amount of memory and the CPU shown above, it indicates that the process is very problematic. The network administrator should troubleshoot these processes one by one. Router CPU overload is often caused by these processes. For example, sometimes the network administrator can forcibly shut down some processes that consume a large amount of CPU resources, and then test whether the packet loss has improved. If there is a significant improvement, find the cause of the problem. At this time, the network administrator can take the right remedy and analyze what services are related to this process and why it occupies so many CPU resources and memory resources. If possible, you can disable this service to reduce packet loss and ensure the normal operation of other services. Wait until you find out the cause of the problem, fix it, and restart.

Different types of protocols apply to different types of exchanges. Cisco routers use many exchange technologies, such as process switching, fast switching, autonomous switching, and Silicon Switching, but all rely on packets. If the packet is lost, any advanced exchange technology will not work. Therefore, it is critical to prevent packet loss. When a network administrator finds a packet loss, the network administrator immediately takes the above measures to find out the cause of the packet loss and actively takes measures to restore the fault as soon as possible.