I've just been stuck with solving an issue on a clients backup server. "Backup performance is awful" was my only description before being dumped into this situation on this beautiful (albeit cold) Saturday.
Anyways, we were seeing output packet drops at the switch (cisco 4509). Disabled QoS on all server ports and that immediately stopped.
However, the "interface details" tab in Wireshark shows an ever increasing value under statistics "Packets not received due to overrun". Dozens of these a second.
I setup PRTG to monitor bandwidth, I'm seeing a steady 50,000 kbits/sec. The port isn't being throttled near as I can tell.
Any tips how I can track down the cause of this "overrun"?
Any help is appreciated. Thank you.
asked 01 Dec '12, 12:12
"Packets not received due to overrun" is the number reported by a OID_802_3_RCV_OVERRUN request to the driver; the page for it says it's "The number of frames not received due to overrun errors on the NIC."
When the "Interfaces" dialog is open, the interfaces are all open and capturing packets (that's where the statistics in that dialog come from); the overruns may just mean that the machine running Wireshark isn't processing packets fast enough - and that's probably processing in Windows before the packets reach Wireshark/dumpcap, as "overrun errors on the NIC" means, I think, "packets are coming in faster than the host driver can remove them from the driver's ring buffer" or possibly even "faster than the NIC can handle them". If Wireshark is running on one of the machines involved with the backup, the problem may just be that there's too much traffic for the machine to handle.
If there were a program that reported adapter statistics such as the overrun count without doing any capturing, I'd suggest running that and seeing whether it reports overruns - if so, that means that the overruns can't be blamed on running Wireshark, in which case you're probably just overloading the machine. I don't know of one, though, and some Googling didn't turn anything up.
answered 02 Dec '12, 16:31
Guy Harris ♦♦