Sign in with
Sign up | Sign in
Your question
Solved

Cisco 881 router problems

Last response: in Networking
Share
September 5, 2012 3:35:37 PM

I work for a small radio station. We have about 85 devices on our network, running off a cisco 881 router. For one reason or other, after a couple hours the past few days, it has been locking up and funneling down my internet connection from 20 mbps to around .5. At first I naturally called and chewed out the internet guys, but they kept saying everything looked fine on their end. Finally, in a fit of desperation, I rebooted the router, and my connection shot back up to 20 megs. A few hours later, I got calls saying it had dropped back down again. I rebooted the router, same result. So what I'm wondering is, what's the next step in troubleshooting this thing? Is it the router itself, or is there something on the network spamming through the internet? I'm fairly new to the world of business networking and could really use whatever help anyone can offer!
September 5, 2012 4:20:39 PM

Because its a commercial router you have more options.

First thing to do is log into the router and
show proc
You want to be sure you are not running at 100% cpu
Next issue
show int
What you are looking for is to see if your interface have high traffic loads or if you are seeing errors. In the "normal" case you should see high utilization inbound on your wan interface and outbound on your lan interface. If you are seeing high rates of traffic inbound on the lan you could have a virus or other network issue...or the users could just be uploading stuff.

If you see traffic but it does not appear to be a error you now have to get creative since you need to know WHO is causing the issue.

You can try to configure IP ACCOUNTING OUTPUT-PACKETS on either the wan and/or the lan interface. A show ip accounting will then give you lists of ip and byte counts. Be careful not to do this on your router if it has high cpu.

Another command to try is IP ROUTE-CACHE FLOW on the interfaces. Then you can issue show ip cache flow and it will give you a list of open session with source and destination ip. This command is not as good as IP ACCOUNTING but it but much less burden on the router.

You can also from the global command prompt try IP FLOW-TOP-TALKERS and then you can show ip flow top-talkers You must first configure the cache flow and this command is not in all versions of software.

Once you find the problem you can either chase the user down or there are many QoS configurations available to try to reduce the problem.


m
0
l
September 5, 2012 4:57:35 PM

Thanks so much for that insight. I'll give those things a try. I checked the current usage (router in working state), and the CPU is hovering between 8 & 14%. Glancing through the sh int results, I'm noticing that on fe0 I have 706,000 collisions, and I'm guessing that's a bad thing, though I have no clue what to do about it. The other ports all seem fine, but I'm pretty novice at reading these things. I'll paste in the results I have so far - sorry they're a bit long....


canyon#sh int
FastEthernet0 is up, line protocol is up
Hardware is Fast Ethernet, address is 0022.559e.04f0 (bia 0022.559e.04f0)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 5/255, rxload 4/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Half-duplex, 100Mb/s
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 1630000 bits/sec, 402 packets/sec
5 minute output rate 2237000 bits/sec, 352 packets/sec
5178121 packets input, 2173557550 bytes, 0 no buffer
Received 20310 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
6170581 packets output, 3219025005 bytes, 0 underruns
0 output errors, 706677 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet1 is up, line protocol is up
Hardware is Fast Ethernet, address is 0022.559e.04f1 (bia 0022.559e.04f1)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 405000 bits/sec, 57 packets/sec
5 minute output rate 27000 bits/sec, 44 packets/sec
347386 packets input, 293602930 bytes, 0 no buffer
Received 696 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
291882 packets output, 22557531 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet2 is up, line protocol is up
Hardware is Fast Ethernet, address is 0022.559e.04f2 (bia 0022.559e.04f2)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 6000 bits/sec, 9 packets/sec
5 minute output rate 72000 bits/sec, 9 packets/sec
99055 packets input, 19627765 bytes, 0 no buffer
Received 27 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
147844 packets output, 182951960 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet3 is up, line protocol is down
Hardware is Fast Ethernet, address is 0022.559e.04f3 (bia 0022.559e.04f3)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet4 is up, line protocol is up
Hardware is PQII_PRO_UEC, address is 0022.559e.04f4 (bia 0022.559e.04f4)
Description: DSL Interface
Internet address is 199.21.201.198/29
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 3/255, rxload 4/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:01, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 1844000 bits/sec, 295 packets/sec
5 minute output rate 1345000 bits/sec, 316 packets/sec
5979103 packets input, 3062533893 bytes
Received 564 broadcasts, 0 runts, 0 giants, 0 throttles
2 input errors, 0 CRC, 0 frame, 0 overrun, 2 ignored
0 watchdog
0 input packets with dribble condition detected
3910744 packets output, 1160635159 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
NVI0 is up, line protocol is up
Hardware is NVI
Interface is unnumbered. Using address of FastEthernet4 (199.21.201.198)
MTU 1514 bytes, BW 56 Kbit/sec, DLY 5000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation UNKNOWN, loopback not set
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
SSLVPN-VIF0 is up, line protocol is up
Hardware is SSLVPN_VIF
Interface is unnumbered. Using address of SSLVPN-VIF0 (0.0.0.0)
MTU 1514 bytes, BW 56 Kbit/sec, DLY 5000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation UNKNOWN, loopback not set
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
Vlan1 is up, line protocol is up
Hardware is EtherSVI, address is 0022.559e.04f0 (bia 0022.559e.04f0)
Internet address is 192.168.254.250/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 5/255, rxload 3/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 1368000 bits/sec, 360 packets/sec
5 minute output rate 2144000 bits/sec, 345 packets/sec
4132224 packets input, 1179594813 bytes, 0 no buffer
Received 27810 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
6178481 packets output, 3170301571 bytes, 0 underruns
0 output errors, 1 interface resets
5228 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
Vlan2 is up, line protocol is up
Hardware is EtherSVI, address is 0022.559e.04f0 (bia 0022.559e.04f0)
Internet address is 192.168.1.1/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:01, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 412000 bits/sec, 57 packets/sec
5 minute output rate 28000 bits/sec, 47 packets/sec
346441 packets input, 292563885 bytes, 0 no buffer
Received 2737 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
292264 packets output, 21279746 bytes, 0 underruns
0 output errors, 1 interface resets
190 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
Vlan3 is up, line protocol is up
Hardware is EtherSVI, address is 0022.559e.04f0 (bia 0022.559e.04f0)
Internet address is 10.2.1.1/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 5000 bits/sec, 8 packets/sec
5 minute output rate 73000 bits/sec, 8 packets/sec
99107 packets input, 19236084 bytes, 0 no buffer
Received 1 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
144805 packets output, 182217412 bytes, 0 underruns
0 output errors, 1 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
Vlan4 is administratively down, line protocol is down
Hardware is EtherSVI, address is 0022.559e.04f0 (bia 0022.559e.04f0)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 packets output, 0 bytes, 0 underruns
0 output errors, 2 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
canyon#


m
0
l
Related resources
September 5, 2012 6:44:49 PM

Half duplex is a huge issue. It depends what is plugged into this port. I forget exactly how wireless appears...i do not think this is the wireless interface. Wireless by default is half duplex and is a known issue. I would make sure both the port on the router and external device are set to auto. If that does not work then try setting them both to duplex full.

So just the utilization lines from your show.

===========================
FastEthernet0 is up, line protocol is up
5 minute input rate 1630000 bits/sec, 402 packets/sec
5 minute output rate 2237000 bits/sec, 352 packets/sec
FastEthernet1 is up, line protocol is up
5 minute input rate 405000 bits/sec, 57 packets/sec
5 minute output rate 27000 bits/sec, 44 packets/sec
FastEthernet2 is up, line protocol is up
5 minute input rate 6000 bits/sec, 9 packets/sec
5 minute output rate 72000 bits/sec, 9 packets/sec
FastEthernet3 is up, line protocol is down
FastEthernet4 is up, line protocol is up
5 minute input rate 1844000 bits/sec, 295 packets/sec
5 minute output rate 1345000 bits/sec, 316 packets/sec
2 input errors, 0 CRC, 0 frame, 0 overrun, 2 ignored
Vlan1 is up, line protocol is up
5 minute input rate 1368000 bits/sec, 360 packets/sec
5 minute output rate 2144000 bits/sec, 345 packets/sec
Vlan2 is up, line protocol is up
5 minute input rate 412000 bits/sec, 57 packets/sec
5 minute output rate 28000 bits/sec, 47 packets/sec
Vlan3 is up, line protocol is up
5 minute input rate 5000 bits/sec, 8 packets/sec
5 minute output rate 73000 bits/sec, 8 packets/sec
=================================

A little more complex that expected but nothing looks as though it is a problem.

I suspect VLAN 1 is your wireless and your wired lans combined and the utlization show no issues.

You have 1.8m inbound from the ISP and 1.3 outbound so no issues if you have 20m less than 10% utilization. You also have no issues on all the other ports. There appears to be quite a bit of traffic going between machines in the location but nothing this router should not be able to handle.

If it is not the duplex then I would suspect some table overloaded.... I am assuming you have this issue wired and wireless.

Rather than reboot the router try

CLEAR ARP

and/or

CLEAR IP NAT TR *

Both will cause drops of the user sessions. You can of course do SHOW ARP and SHOW IP NAT TR

You can also configure logging with

logging buffered 50000 debug

and then show log to see if anything strange is being logged... i doubt it, I would leave logging enable all the time even after you get it fixed.


m
0
l
September 6, 2012 2:42:53 AM

:o  Well, I'm not sure what to do at this point. You've given me some great tools for getting around my router in the future, but nothing I have tried has made any difference up to this point, other than rebooting the router. :(  I don't know, maybe I'm doing it wrong. This is the first time I have ever seen any of these commands, so maybe I just need a little more instruction. When I wanted to clear the ARP, I logged in, then typed "enable", then ran the commands. When I ran them, they didn't do anything, but they didn't give me any errors either. Then when I checked the ARP table and stuff again, it all looked the same as before. Does it repopulate that quickly, or did something not take? Or am I doing this all from the wrong screen? :pt1cable: 
m
0
l
September 6, 2012 11:48:19 AM

Did you fix the duplex issue. Running half duplex causes the collisions which can easily cause the issue you see.

I may have been confusing since I didn't know there were 2 models on 881 router and the one you have I suspect is not wireless. Fa0 is a physical port a coworker told me and the majority of your traffic is running on this port and it is running half duplex.

Yes the arp table will refil as soon as a new packet for that destination comes in. It is rare to have a issue but I have seen virus cause problems.
m
0
l
September 13, 2012 12:28:36 AM

Hi, sorry it's been so long since I responded - yesterday we were forced to really knuckle down and and figure this out because everyone started losing connectivity altogether - printing, file sharing, internet, the works - all down. After a lot of troubleshooting and headache, we finally narrowed it down to something I've been calling from atop the wall all along, but didn't necessarily think it would cause a complete meltdown of these proportions. Attached to our router are three very old hubs. Not switches, hubs. Yes, you read correctly, 10/100 HUBS. I began working here about a year ago, and I was blown away by the fact that a network of this size was depending on equipment that archaic to fit its needs. I tried to convince management that I needed new switches to preserve the network, but I couldn't convince anyone of the justification of the cost, even for cheap $200 ones. Needless to say, when they all failed yesterday, I got my way. Now, with three beautiful new switches shining from the racks, we have a beautifully performing network with no collisions on any interface. Everyone is much happier. I didn't change anything on the router, including the duplexing issue you brought up. I'm unfamiliar with how to change that - care to share? Thanks again for all your help! :hello: 
m
0
l

Best solution

September 13, 2012 12:02:13 PM

The command is DUPLEX but you want to leave it AUTO which is the default. It works the vast majority of the time and you only set it when you have issues.

The key reason a hub is bad news is it runs half duplex.....besides seeing all the traffic on all the ports.
Share
September 24, 2012 2:34:44 PM

Best answer selected by ronnielebaron.
m
0
l
!