7200 vxr queueing issues, anyone have an idea?

[americanmcneil]

On my core router (a Cisco 7206 vxr) I have 4 bonded T1's. Recently we have noticed that our internet has slowed way down. We provide bandwidth for others and they are affected as well. Anyway I started poking around and took a look at my multilink1 and saw that I have an insane amount of output drops. I was using FIFO queueing and then changed to weighted-fair and that seemed to clear it up for all of four days and now I am back to square one. Here is a look at multilink1:

Multilink1 is up, line protocol is up
Hardware is multilink group interface
Internet address is 63.144.15.62/30
MTU 1500 bytes, BW 6144 Kbit, DLY 100000 usec,
reliability 255/255, txload 94/255, rxload 68/255
Encapsulation PPP, loopback not set
Keepalive set (10 sec)
DTR is pulsed for 2 seconds on reset
LCP Open, multilink Open
Listen: CDPCP
Open: IPCP
Last input 00:00:00, output never, output hang never
Last clearing of "show interface" counters 02:28:53
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 9780268
Queueing strategy: weighted fair
Output queue: 0/1000/64/9780268 (size/max total/threshold/drops)
Conversations 0/256/256 (active/max active/max total)
Reserved Conversations 0/0 (allocated/max allocated)
Available Bandwidth 4608 kilobits/sec
5 minute input rate 1648000 bits/sec, 210 packets/sec
5 minute output rate 2288000 bits/sec, 8224 packets/sec
2354924 packets input, 2369411770 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
66850027 packets output, 2326898409 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions

Anyone have any ideas?

Scott "thrown to the wolves" McNeil

 

[helpdeskdan]

WF Queueing will help somewhat, but if you have periods of congestion, it isn't going to solve the problem. Do you have any network monitoring tools at your disposal? It would be useful, at the very least, to see utilization over time.

 

[americanmcneil]

Thanks anyway Dan, but it turns out that someone else's server that goes out our internet ramp was hacked and had become a spam server. They were hammering the outgoing interface with over 7k packets per second and that what was causing all of those drops. It has since been resolved. Again, Thanks Dan for responding!!

 

[burtsbees]

Ha ha---I was gonna say to throw a sniffer on the line and get rid of the spammers! The clue would have been the fact that thre were so many drops, but no input/output erors, like no oversize (giants) or undersize packets (runts). Darn NetBotz! Dan's suggestion would have caught that...you report the IP to the authorities, or hit them with a virus yourself?lol

Burt

 

[helpdeskdan]

Yeah, well, it would have at least narrowed it down. Glad you got it fixed.