Congested Links to SHERN

PTS Case 23

Synopsis

The EUMEDCONNECT NOC reported suspicious behaviour seen on the 4 E1 links to SHERN (the Syrian NREN) - the RED (Random Early Detection) counter was rising (dropping packets) even though the circuits were not heavily loaded, nor was RED configured on the the 4 interfaces. They contacted Juniper support and were advised that although RED was not explicitly applied there was a default RED policy (100% drop probability when buffer 100% full) such that even though the packet drop was really ’tail drop’ it was reported as RED. Also, even though the observed average circuit utilization was low, Juniper engineers believed the symptoms were consistent with congestion caused by micro-bursts coming from the router's other, "high speed" FastEthernet ports.

A test was devised in an attempt to clarify if the drops were truly the result of micro-bursts (ie expected behaviour) or if there was some otherwise undetectable problem with the router’s packet forwarding engine (PFE).

Of the four E1 interfaces, two were configured so that they had large buffers (85%) and two were configured with small buffers (50%). Then the router was polled (by SNMP) at 5 minute intervals to see if the interfaces with smaller buffers dropped more packets than the interfaces with larger buffers. The results showed that the interfaces with smaller buffers did drop more packets than the other two but not by a significant amount given the 35% difference in size (~7% drop cf ~5.5% drop). This, combined with Juniper’s comments, suggests that the packet drop probably is normal behaviour.

Attempts to explore this case further were hampered by SHERN's unavailability to help. Since SHERN were the only directly affected user, and they were not concerned by this packet loss, the case was closed.

– Main.TobyRodwell - 14 Aug 2007