Troubleshoot this switch port

[spidey07]

What seems to be the problem here?

6500#sh int f6/40
FastEthernet6/40 is up, line protocol is down <removed dead giveaway>
Hardware is C6k 100Mb 802.3, address is <removed>
Description:
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 249/255, rxload 1/255
Encapsulation ARPA, loopback not set
Full-duplex, 100Mb/s
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops:452794773
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 103320000 bits/sec, 18368 packets/sec
1 packets input, 82 bytes, 0 no buffer
Received 1 broadcasts (0 multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
189593824451 packets output, 101753059918073 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out

 

[Cooky]

FastEthernet6/40 is up, line protocol is down
...txload 249/255
...Total output drops:452794773

This indicates the port is probably a destination port in a SPAN/monitor session.
You may need to move to a GigE port, or better yet, something like a GigaMon to support the throughput.

 

[spidey07]

You get a cookie! Well done. Moving to have multiple interface 10 gig sniffers in the larger datacenters. This is also called "blinding the port", so much traffic is being sent to it it can't output it all, queues get filled up and the resultings drops.

 

[drebo]

So how many drops need to happen before the line protocol goes down?

 

[spidey07]

So how many drops need to happen before the line protocol goes down?

That won't take the line protocol down. It shows up/down because it's a span/monitoring port. That's why I said "removed because it would be too obvious". What I removed was (monitoring).

 

[drebo]

Ahh, gotcha. I don't have much experience with SPAN ports, so I'm not familiar with the ways they report. I've only ever set one up.

 

[Emulex]

does this put a load on your switch? i have a baby procurve and throwing 48 ports onto a single 1gig span put a world of hurt on the router and dropped tons of packets on the span port. like 50-60&#37; load with only a few machines backing up. dumbo kinda move like debug on on a core switch

 

[spidey07]

It's not supposed to, and if it does the switch stinks. It's all supposed to be done in hardware. That's the biggest gripe with the cisco 6500, it only allows two span sessions and that's a hardware limitation, nothing they can do about it.

 

[sactwnguy]

To get around the 2 span port limit on the 6500 look into vacl's, we used them to set up NetQoS at my previous company.