Identifying a device which is hammering a frame PVC

[RhodriJenkins]

I work for a company with a large frame relay network which is set up as follows:

We have 1 main site with around 35 PVC's going into it. One of those PVC's goes to another large site which also supports many of its own PVC's. Both of these sites have been configured with a single subinterface, into which all PVC's go.(all done with cisco kit-1600, 3620, 3640 and 3660's). Hope that makes sense!!

OK, so the problem I have is this... I am based at the main site and occasionally response between here and the other large site becomes very slow (people think it's gone down). I use Solarwinds Bandwidth Monitor to check each end, sure enough they are being hammered. My goal is to find what is hammering the link. The way in which the frame is configured here makes this very difficult.
Because all PVC's terminate into the same subinterface at both these sites I cannot be sure that it is traffic between these 2 sites which is making it slow.

What I really want is some way of monitoring the utilization of each PVC as opposed to the utilization of the interface (all PVC's bundled together). Also what would be handy is a way of actually identifying what types of data are travelling across my WAN links as this may help me locate the culprit, maybe then I could also consider a packet shaping solution??

Should I consider putting each DLCI onto their own subinterface? I hope I've made this clear as it is driving me mad. Every time I think I might find what is doing it, the line goes quiet again.

 

[salserocito]

We have a VERY similar WAN configuration. Though, we have a different sub-interface and DLCI for each individual site on our WAN. This allows each site to be monitored individually with its own stats.

Also, what is the speed of the Frame and the current CIR?

Once you have setup the sub-I/F's, you can packet trace between the the sub-I/F's at both sites to see what is travelling across the wire.

Good luck!

 

[jeter]

Sub interfaces are the way to go however I think want you need is to put a sniffer on your network and or have your Frame provider monitor your circuits. You should verify the CIR on the circuits just to make sure there has been no changes. Jeter@LasVegas.com
Fisher CCNA
Sprint-Data

 

[TJUK]

Like people have said subinterfaces are the way to go..

Seeing as you dont have this, then the other suggestion of using a sniffer is the best..

Use something like sniffer pro and look at top talkers... that should give you some usefull information.

Are you using any form of adaptive-shaping on the link?

Cheers

Terry

 

[RhodriJenkins]

Thanks all for your usefull comments. In answer to your questions :

It has a 256 Access Pipe and a 128 CIR between the 2 main sites.
I'm currently trying to persuade the powers that be to invest in a WAN sniffer as we don't have one. Obsurd considering how large our WAN is (Lots of small sites interconnected with regional offices (150 sites)).

I intend to implement the sub interfaces soon. My thinking is that I'll make all PVC's point to point with 2 hosts per subnet. Would you agree? I'll do the necessary research before I begin anyway.

On a general point, I've been charged with the task of sorting out many WAN issues we have at the moment. In a nutshell these issues are due to the company growing very quickly and a lack of planning of the WAN structure over the last year. I'm basing my new WAN structure around information lifted from The CCNP Routing manual. Can anyone suggest any other useful resources which can help with designing a hierarchical network?


Thanks again

Rhodri

 

[salserocito]

I'm not sure what your budget looks like, but who is your Frame-Relay provider? MCI/WorldCom?

You may want to look into a Managed Services solution for your Frame-Relay NetWork. Not only will they assist in the re-design of your WAN, but they will also handle implementation as well as 24/7 monitoring.

Just a thought.