I recently used Sniffer Pro v4.7 at

[phaelon56]

I recently used Sniffer Pro v4.7 at an outside location (not our own network) and got a whole bunch of alarms for
'excessive drops' Threshold was 100 - I got a level of a couple million. It only shows up on alarm log - not in Expert window - I can't go to the Expert explain. What does this refer to and what does it mean? Is having multiple cases of a couple million something that is significant?



Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[phaelon56]

Forgot to mention - I was connected to a SPAN port. SPAN and mirror ports don't show packet drops because those stats are discarded at the port level on switches and not propogated to the SPAN port. You must check the MIB to find them. Any ideas on this? Maybe a false positive?

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[AlfSutherland]

Hi Owen,
This is most likely caused by a duplex mismatch between the Sniffer analyzer and the attached switch port. Some devices do not auto-detect duplex mode correctly during initial auto-negotiation for port speed. Most switch ports default to full duplex at 100Mb. When running full-duplex, CSMA/CD is disabled. The switch port will be able to transmit at will. The Sniffer running in half-duplex will see multiple collisions.
Alf