I am wondering what this is 31 0.088694 00:00:00_00:00:00 Spanning-tree-(for-bridges)_01 MAC CTRL 60 MAC PAUSE: pause_time: 8192 quanta The network slows down and pings are 2ms to about 6ms if the switch (new unmanaged gigabit) is rebooted things will go back to normal for a while 4-6 hours or even several days. There is a mix of workstation nics Thanks folks asked 28 Jun '11, 19:32  Buckshot edited 29 Jun '11, 03:31  packethunter |
2 Answers:
You have caught the rather elusive MAC PAUSE frame. The pause frame instructs the receiver to stop sending data for a certain time. The time is specified in the unit "quanta", where one quanta is time needed to send 512 bits. For a Gigabit network 1 Quanta equals 512 nanoseconds. The 8192 quanta from your trace effectively shut down the receiver for roughly 4 milliseconds, which aligns nicely with the increase in the RTT from 2 to 6 msec. MAC pause is a special frame that can be send by a switch or an end system to tell it's neighbor to slow down. Typical scenarios for this frame are:
Some managed switches and NIC drivers can send and process the pause frames. This is a feature of the switch or the driver, and by far not supported by all devices. If I can configure pause frames I usually allow the switch to slow down a workstation or server, but not vice versa. If any workstation can tell the switch to shut up you will quickly run out of buffers. The sender of the MAC pause frame should transmit another frame with 0 quanta to inform the remote end that the device is back in business. What makes me curious is your source MAC address of 00:00:00:00:00:00, which does not look like it is hand crafted. Try to track down the MAC address. Disable the pause frame on workstations and servers if you have unmanaged switches. answered 29 Jun '11, 03:29 packethunter |
Thank you very much. The MAC address of 00:00:00:00:00:00 does throw me off but I know the switch that is the problem... now I just have to try and track down the offenders Thanks again answered 29 Jun '11, 16:42 Buckshot |
PAUSE frames are link local. Meaning it only lives from RJ45 to RJ45 and doesn't get propagated beyond that. So if you are seeing this everywhere, it must be "everywhere connected to switch X" correct? PAUSE frame can be stupid at times. One thing the standard lacked was the ability to stop the pause condition when things got better. Some will send a puase-time set to zero, but I don't know that it's universal. You only need the PAUSE in rare conditions, so if the new switch is suspect, try turning off PAUSE fucntion completely. And ask the vendor if an FW update is avail. Good Luck!