As of last week, I started receiving numerous input errors on three switchports of a cisco 3750 12 port fiber switch. For example, 21439 input errors, 3 CRC. Switchports on other switches connected to this fiber switch show 0 input errors. I am monitoring three ports in question and captured 5 minutes of traffic. What is the best way to analyze capture to possibly determine source of input errors? asked 29 Jan '13, 09:08  ws-dmoore |
2 Answers:
AS they are input errors, they will not be duplicated with a monitor session. The only way to catch them would be to place a TAP on the ports and use a sniffer that does not drop frames with a bad FCS. Or maybe do some analysis of bad frames. What kind of errors are they if they are not CRC errors? answered 29 Jan '13, 09:29  SYN-bit ♦♦ |
Please make sure it's not something simple like a L2 device sending DTP (Dynamic Trunking PRotocol) to your L3 3750 (if it's L3). Router interfaces don't know what DTP is, and will cause input error counters to increment. Also, Cisco has some nice documents on how to troubleshoot input errors. If you google for it, I'm sure you'll find several articles that can guide you. Wireshark isn't the best tool because w/o a tap, you'll never see it in Wireshark. Even with a tap, you may not see damaged frames. So troubleshoot with Cisco CLI first (show controllers, sho ip counters, etc.) Good luck. answered 29 Jan '13, 19:52  hansangb |
