A third-party packet capture and analysis tool can monitor only packets whose rate is within 10 Gbps Packets cannot be monitored when the packet rate exceeds 10 Gbps.Telemetry is recommended for routine monitoring of microbursts. Therefore, the microbursts lasting for 1 ms or even 10 ms cannot be monitored. Although the minimum accuracy of the interface rate is only second-level, the collection of buffer usage of interface queues can be accurate to 100 ms. Telemetry determines whether a microburst occurs on a port based on the buffer usage and the millisecond-level packet rate statistics of the port.The forwarding engine detects the following packet loss log: QOS/6/QOS_PACKET_DROP.Ĭurrently, you can detect microbursts by using Telemetry, a third-party packet capture and analysis tool, or the discarded packet capture function.

The following alarm is generated on a port: QOS_1.3.6.1.5.25.32.4.1.11.51 hwXQoSPacketsDropInterfaceAlarm.

The number of discarded packets on an egress port of a switch is not 0.

Therefore, the switch cannot capture the microburst information.Ī microburst occurs when any of the following conditions is met:

In addition, millisecond-level polling on all ports greatly consumes CPU resources, which may affect normal services of the switch. As a result, the CPU cannot traverse all ports to obtain traffic information during microbursts.

When a switch collects packet statistics on ports, the CPU traverses all ports, lowering the performance of obtaining port packet statistics. Why cannot devices support millisecond-level traffic statistics? This is because switches have a large number of ports. Even if the NMS can calculate the traffic rate at the millisecond level, the accuracy of the traffic graph is still second-level because the data reported by devices is generally second-level. In addition, the accuracy of traffic monitored by the NMS depends on the accuracy of the data reported by managed devices. Therefore, the traffic monitoring accuracy is second-level. The minimum interval can be set to five seconds and even one second on some third-party NMSs. Second-level monitoring interval: Generally, an NMS monitors traffic at an interval of 30s. Limited management scale: The pull mode is used to obtain monitoring data of devices, and cannot monitor a large number of network nodes. The NMS obtains device data in SNMP get mode, which has the following disadvantages: The traffic curves seem to be smooth on the NMS although microbursts (packet loss) have occurred. The NMS monitors port traffic around the clock and determines the traffic trend on the network based on traffic curves of devices. Therefore, more buffer space is consumed and more packets are discarded due to congestion when microbursts occur. On an actual network, the number of ingress ports is greater than that of egress ports. Without considering overhead data such as the inter-frame gap, preamble, frame checksum, and packet header, the microburst duration is 4 ms (5 MB/10 Gbps). Therefore, 4 MB data is discarded due to insufficient buffer space. However, the switch has only 1 MB buffer space. It sends only 5 MB data out and buffers the other 5 MB data for transmission later. Port3 supports only a rate of 10 Gbps, which is a half of the total transmission rate.

Assume that Port1 and Port2 respectively send 5 MB data to Port3 at a line rate of 10 Gbps. The following figure shows a typical millisecond-level microburst scenario. If the switch does not have sufficient buffer space, the excess data is discarded, causing congestion and packet loss. When a microburst exceeds the forwarding capability of a switch, the switch buffers the burst data for transmission later.

Wireshark sum iograph