Hello all... In analyzing traffic for a particular application, I'm seeing that roughly half of the traffic is reported by Wireshark as "Data Center Ethernet (DCE) protocol(Cisco)". It is consuming close to 2Gbps of link capacity. I have seen this type of traffic before, but I never gave it much thought, mainly because I have never seen a significant amount of it. Has anyone seen this level of DCE traffic in their travels? Any suggestions on how to diagnose why there is so much of it, and how to remove/reduce it? Thx much. Feenyman99 asked 04 Jun '17, 21:03  feenyman99 |
2 Answers:
One brief discussion of DCE is at this Data Center Handbook page (saved on the Wayback Machine); DCE packets are the ones shown as "FP Frame Format". Here's another page about FabricPath and a Cisco document about it. Wireshark should be dissecting the Ethernet traffic inside the FP frames, so it should show them as more than just "Data Center Ethernet"; if it's not, that's probably a Wireshark bug. If it does dissect the traffic inside the frames, then that'll tell you what type of traffic it is, at least at the Ethernet layer, and perhaps at layers above that. answered 06 Jun '17, 20:15  Guy Harris ♦♦ |
PROBLEM SOLVED... It turns out, the packets identified by Wireshark as DCE, are actually Cisco FabricPath (CFP) encapsulated packets, as noted by Guy H. The reason that Wireshark was not dissecting the Ethernet inside the CFP frames was: CFP dissection was not "fully" enabled. What I mean by that is... When I went to Analyze -> Enabled Protocols, I saw that “CFP” was enabled, but… the sub-protocol “fp_eth” was not enabled. Once I checked that fp_eth box, Wireshark is now dissecting these packets with all layers interpreted, and the fog has lifted :-). thx, feenyman99 answered 11 Jun '17, 18:54 feenyman99 |
