Tag Archives: 1.1c

1.1.c Explain general network challenges

1.1.c [iv] Impact of micro burst

Micro-bursting is a phenomenon where rapid bursts of data packets are sent in quick succession, leading to periods of full line-rate transmission that can overflow packet buffers of the network stack, both in network endpoints and routers and switches inside the network.

Symptoms of micro bursts will manifest in the form of ignores and/ or overruns (also shown as accumulated in “input error” counter within show interface output). This is indicative of receive ring and corresponding packet buffer being overwhelmed due to data bursts coming in over extremely short period of time (microseconds). You will never see a sustained data traffic within show interface’s “input rate” counter as they are averaging bits per second (bps) over 5 minutes by default (way too long to account for microbursts). You can understand microbursts from a scenario where a 3-lane highway merging into a single lane at rush hour – the capacity burst cannot exceed the total available bandwidth (i.e. single lane), but it can saturate it for a period of time.

In order to troubleshoot microbursts, you need a packet sniffer that can capture traffic over a long period of time and allow you to analyze it in the form of a graph which displays the saturation points (packet rate during microbursts versus total available bandwidth). You can eventually trace it to the source causing the bursts (e.g. stock trading applications).

Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 989-994).  . Kindle Edition.


1.1.c Explain general network challenges

1.1.c [iii] Asymmetric routing

When communication between two hosts (or end points of any type) take different paths on their way out and another on their way in, it is called asymmetric routing. It can also cause packets to arrive out of order if packets that are part of a given flow take different paths.

Large amounts of flooded traffic might saturate low-bandwidth links causing network performance issues or complete connectivity outage to devices connected across such low-bandwidth links. An example of such situation could be a topology where there are two switches (ports in two VLANs, say A and B), two routers (doing inter-VLAN routing between A and B) and two hosts one in VLAN A and one in VLAN B. Now since the routers will proxy ARP for respective hosts as they are default gateways, switches will never be able to learn actual end hosts MAC addresses (router will rewrite them every single time to their own). Switch A and B will continue to flood traffic since they are unaware of the actual host A and host B MAC addresses.

The solution approach is normally to bring the router’s ARP timeout and the switch’s’ forwarding table-aging time close to each other. This will cause the ARP packets to be broadcast, relearning must occur before the L2 forwarding table entry ages out.

Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 958-964).  . Kindle Edition.

1.1.c Explain general network challenges

1.1.c [i] Unicast flooding

Unicast flood is the unintentional behavior of a switch treating a unicast packet as a broadcast packet; a packet destined for one host is flooded or transmitted out of all the ports of a switch. The underlying cause of flooding is that destination MAC address of the packet is not in the L2 forwarding table (there is one for each VLAN) of the switch. The primary reasons for unicast flooding behavior include asymmetric routing, STP topology changes (i.e. repeated TCNs), and MAC forwarding table overflow.

Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 948-953).  . Kindle Edition.



1.1.c Explain general network challenges

1.1.c [ii] Out of order packets

1.1.c [iv] Impact of micro burst

Cause Unnecessary Retransmission

Limits Transmission Speed

Reduce Receiver’s Efficiency


In computer networking, micro-bursting is a behavior seen on fast packet-switched networks, where rapid bursts of data packets are sent in quick succession, leading to periods of full line-rate transmission that can overflow packet buffers of the network stack, both in network endpoints and routers and switches inside the network. It can be mitigated by the network scheduler. In particular, micro-bursting is often caused by the use of the TCP protocol on such a network.[

A Study of Internet Packet Reordering
Yi Wang1, Guohan Lu2, Xing Li3

Abstract. Packet reordering is a well-known phenomenon that the order of
packets is inverted in the Internet. Previous research indicates reordering can
affect the performance of both the network and the packets receiver.

1 Introduction
In the architecture of TCP/IP, the IP layer provides a “best effort” datagram service.
Although TCP is a reliable higher-layer protocol, packet reordering can affect its
performance and the efficiency of packet receiver:
(1) Causes Unnecessary Retransmission: When the TCP receiver gets packets out
of order, it sends duplicate ACKs to trigger fast retransmit algorithm at the sender.
These ACKs makes the TCP sender infer a packet has been lost and retransmit it. If
the temporary sequence number gap is caused by reordering, then the duplicate ACKs
and the fast retransmission are unnecessary and a waste of bandwidth.
(2) Limits Transmission Speed: When fast retransmission is triggered by duplicate
ACKs, the TCP sender assumes it is an indication of network congestion. It reduces
its congestion window (cwnd) to limit the transmission speed, which needs to grow
larger from a “slow start” again. If reordering happens frequently, the congestion
window is at a small size and can hardly grow larger. As a result, the TCP connection
has to transmit packets at a limited speed and can not efficiently utilize the bandwidth.
(3) Reduce Receiver’s Efficiency: TCP receiver has to hand in data to the upper
layer in order. When reordering happens, TCP has to buffer all the out-of-order pack-
ets until getting all packets in order. Meanwhile, the upper layer gets data in burst
rather than smoothly, which also reduce the system efficiency as a whole.