In this lesson,
we're going to talk about interface statistics
and how it's used
to monitor our network's performance.
Now, if you're new to networking, you may be wondering
what exactly is an interface?
Well, an interface is just one of the physical
or logical switch ports on a router, switch
or firewall, enterprise level devices,
each interface can generate its own statistics
and maintains its own status.
In this lesson, we're going to explore the link state,
the speed and duplex status,
the send receive traffic statistics,
the cyclic redundancy check statistics,
and the protocol packet
and byte counts that are collected for our network devices.
To help guide our discussions,
I'm going to be using the output from a Cisco router
for an interface called F0/0,
which simply means it's a fast ethernet
or CAT5 connection going from this physical interface
on slot zero and port zero of a given router.
Now first, you can see we have the link state.
A link state is used to communicate
whether or not a given interface has a cable connected to it
and a valid protocol to use for communication.
For example, if I connected a fast ethernet
unshielded twisted pair cable
to the interface on 0/0
of this router and then plugged in the other end
into another router to create a connection,
I should see fast ethernet 0/0 is up
line protocol is up.
This indicates that the interface is physically up
and the protocol is operational.
If we're using ethernet, that means that frames
are able to be entering and leaving this interface.
Next, we have some information about the interface itself,
such as the MAC address and the IP address assigned to it.
After that, we see there's an MTU size set of 1500 bytes,
which is normally used by default in ethernet,
and then we have the bandwidth is being set at 100,000
kilobits per second, which is 100 megabits per second.
This makes sense because I'm using fast ethernet
or CAT5 cabling for our connection.
This speed is also used by the router,
which is trying to calculate the metrics
for the routing protocols like OSPF and EIGRP,
since they rely on the connection speed
in making their determinations and their link costs.
Next we have the reliability, which is being shown here
as 255 out of 255.
This means if the connection begins to have more inputs
or output errors, you're going to see the reliability lower.
Basically, you read this as reliability
equals the number of packets
divided by the total number of frames,
so 255 over 255 is the best reliability,
and it indicates there is no packets
or frames that have been dropped so far.
TX load is our next statistic,
and this is going to indicate
how busy the router is transmitting frames
over this connection.
At one out of 255, this router is not very busy at all.
Rxload is like Txload,
but instead of transmitting, we're going to be measuring
how busy the router is in terms of receiving frames.
Next, we have the ARC type being used.
In this case, we're using ARPA
or the advanced research project agency setting,
which indicates that we're using standard ethernet.
This is because ARPA developed standard ethernet
and we're using that for ethernet frames
for our encapsulation.
Now, if you're using something different, a serial link
or a frame relay, it would say something different here
instead of ARPA, but if you're using ethernet,
you should expect to see ARPA right here.
Next we have the keep alive,
and this is set to 10 seconds, which is the default.
This is how often the router
is going to send a keep alive packet
to other devices that is connected to
to check if they're still up and online.
Next, we have a line that says, full duplex,
100 megabits per second, 100BaseTX/FX.
Now, this indicates whether this interface is using half
or full duplex, and in this case we're using full duplex.
It also tells you what the bandwidth
is and the interface type you're using.
In this case, as I said, we're using full duplex
and we're using 100 megabits per second as our bandwidth,
and we have a fast ethernet interface type
and it's either using copper or fiber cabling
because it says TX/FX.
Now, next we're going to have our ARP type,
and in this case again, we're going to use ARPA.
The timeout here tells us
how long each ARP cache is going to remember a binding
and when it will be cleared.
In this case, we're using the default time of four hours.
The next two lines are the last input, last output,
and last clearing of the counters.
In this case, the router was just rebooted,
so they're all set to zero
because they were all just cleared.
Next, we have our input queue, which tells us
how many packets are in the input queue
and their maximum size.
In this case, the maximum size is 75 packets
For our queue, drops is the number of packets
that have been dropped so far.
Flushes is used to count the selective packet discards
that have occurred.
Basically, when the router
or switch has to say it needs to start shedding some load
and it starts dropping packets selectively,
SPD is a protocol
that's going to drop your lowest priority packets when the CPU
becomes too busy, so that way it can save capacity
for higher priority packets as a form of quality of service.
Now, the total output drops here is at zero.
This means that we've had no drops
because we never had a full output queue.
Since we have 100 megabit per second connection,
as long as we're communicating
with another 100 megabit per second connection,
we should see this stay at zero drop packets.
If we started using a 20 megabit per second connection,
for instance on our ISP,
then we might likely have an experience here
with network congestion because we're sending it 100,
but they can only take it at 20.
That would cause a problem for us,
and at that point, some of our packets might get dropped.
Next, we have our queuing strategy
for our quality of service.
In this case, we're setting this as first in, first out,
which is known as FIFO.
This is the default for this type of router.
Next, we have output queue size and the maximum.
Currently, our queue is empty and it's showing zero packets.
Now the maximum queue size here is set at 40,
so if I receive more than 40 packets,
the queue is not going to be able to hold it
and the rest of those will get dropped.
Next, we have our minute input and output rates.
Now here are the average rates at which packets
are being received and being transmitted.
Packet input is our next line,
and here we can see 923 packet inputs
was received for a total of 158866
158866 bytes of data being processed.
The next line contains the receive broadcast,
and in this case we received 860 broadcast frames.
We also have runts, giants
and throttles counted here as well.
Now, a runt is an ethernet frame
that is less than 64 bytes in size.
It's really small, that's why it's a runt.
A giant is any ethernet frame
that exceeds the 802.3 frame size of 1,518 bytes.
It's really large, so it's a giant.
Throttles are going to occur when the interface
fails to buffer the incoming packets.
If this is a high number, this is an indicator
that you may be having quality of service issues
to your end users.
Next, we have input errors, CRC, frame overrun and ignored.
The input error counter will go up
whenever the interface is receiving a frame
with any kind of error in it.
This can be something like a runt, a giant,
no buffer available, CRC errors or other things like that.
CRC is the number of packets that were received
but failed the cyclic redundancy checksum
or CRC check upon receiving them.
If the checksum generated
by the sender doesn't match the one calculated
by this interface, when it receives that frame,
a CRC error is counted and the packet gets rejected.
Now, frame is used to count the number of packets
where a CRC error
and a non integer number of octets was received.
Overrun is used to count how often the interface
was unable to receive traffic
due to an insufficient hardware buffer.
Ignored is going to be used to count the number of packets
that the interface ignored since the hardware interface
was low on the internal buffers.
If you're experiencing a lot of noise on the connection
or broadcast storm, this ignored count
will start to rise drastically.
Next, we have the watchdog counter, which is used to count
how many times the watchdog timer has expired.
This happens whenever a packet over 2048 bytes is received.
The next line contains the input packets
with dribble condition detected,
which means that a slightly longer than default frame
was received by the interface.
For example, we talked about the fact
that the MTU size was 1500 bytes by default,
but a frame wasn't considered a giant
until it reached 1,518 bytes.
So if I got a frame that was 1,510 bytes inside,
it's technically above the MTU size,
but it's not yet a giant, so it would still be processed,
but it would be added here on the dribble condition counter
so I can know that I'm starting to get packets
above 1500 bytes.
Next, we have the packet output counter,
and this is the number of packets that have been sent
and the size of those transmissions in bytes.
The under run is the number of times
the sender has operated faster than the router can handle,
and this causes buffers or drop packets.
Next, we have the output errors,
and this is just like our input errors.
The only difference is we're now counting the number
of collisions and the interface resets
that are occurring as a result.
A collision is counted anytime a packet
needs to be remitted because an ethernet collision occurred.
Since we're using full duplex, this number should be zero.
If it's not zero, something's wrong.
Next, we have the interface reset,
and this the number of times an interface
had to be completely reset since the last reboot.
Next, we have unknown protocol drops.
Anytime a protocol drops,
but our device can't determine what protocol it was,
it's going to be listed under the unknown protocol drops.
For example, if you're not supposed to receive older types
of protocols like IPX traffic and Apple Talk on your router,
but somebody sends you a message that's formatted that way,
your router's going to drop it
and it's not going to know what it was
because it's not a properly formatted IP message
or an ethernet frame, so that counter is going to go up.
Next, we have babbles, late collision and deferred.
Now, a babble is used to count any frame
that is transmitted that is larger than 1,518 bytes.
This is similar to our giants,
but we're going to use this when we're transmitting
instead of receiving, a babble is for transmission,
a giant is for receipt.
Late collisions are going to be used to count the number
of collisions that occur after the interface
started transmitting its frame
and deferred is used to count the number of frames
that were transmitted successfully
after waiting because the media was busy.
So if your devices are using CSMA/CD
or collision detection, it's going to detect the media is busy.
It's going to wait, and then it's going to transmit.
When this happens, this number's going to go up
because it had to wait.
Again, we should see zero for late collisions
and deferred here
because we're using a full duplex connection,
but if we're using a half duplex connection,
there will be some numbers there.
Next, we have the lost carrier and the no carrier.
This is the number of times that the carrier was lost
or not present during the transmission.
The carrier we're talking about here
is the signal on the connection.
Finally, we have the output buffer failures
and swapped out, the output buffer failure
is going to be used to count the number
of times a packet was not output from the output hold queue
because of a shortage of shared memory.
An output buffer swap out is going to be the number
of packets stored in the main memory
when the queue was full.
If this number is very high,
that means that you're likely experiencing
a busy time in your networks.
Now, for the exam, you don't need to know
all of these things and memorize all their definitions,
but you should be aware of some key statistics
here on the interface.
Things like the link state,
the speed and duplex status,
the send and receive traffic statistics,
the cyclic redundancy check statistics, the protocol packet
and byte counts, the CRC errors, the giants,
the runts and the encapsulation errors.
On the exam, you may get a question
that involves troubleshooting a device
and you're going to see an interface statistic screen
like this, and then you're going to have
to recommend a solution to that problem.
For example, if the question asks why the device
is operating slowly and you see the connection
set to half duplex instead of full duplex,
that would be a reason for the slowdown
because you effectively cut your bandwidth in half
because it's to listen before transmitting.
Or if you see a large amount of collisions,
but you're running full duplex,
that would indicate there's two devices connected
to the same switchboard and that is causing you issues.
Or maybe you see there's a lot of CRC errors.
This could indicate a dirty fiber connector
or an unshielded twisted cable
that's subject to too much electromagnetic interference.
This could be caused by lots of different things
such as your cable being improperly run
over a fluorescent light
or near a power line or something like that.
My point is, it's important to be able
to read the interface statistics
so you can then troubleshoot
your network connectivity issues
in your routers and switches.