Re: Cut-through vs Store Forward [7:48316]
My guess is that your sniffer sees them as 60 bytes, since most sniffers leave don;t count the CRC which is 4 bytes. Most of these are ARP packets. Alejandro Acosta Alamo wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48537t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
sam sneed wrote: My guess is that your sniffer sees them as 60 bytes, since most sniffers leave don;t count the CRC which is 4 bytes. That's a good point. The NIC strips the CRC. Some analyzers do let you configure the NIC to capture the CRC. Usually this isn't necessary unless you happen to be the programmer who has the job of developing and troubleshooting the CRC calculation. The analyzer can still tell you a CRC error count, of course, even if it doesn't capture the actual 4 bytes of the CRC itself, as you know, I'm sure. Most of these are ARP packets. And BPDU, Ethernet keepalives, TCP ACKs, CDP in some cases, IGMP sometimes, some SNMP queries. There may be more. My network has a ton of AARPs for example. Priscilla Alejandro Acosta Alamo wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48566t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48421t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
You found 3000 of what? At 06:21 PM 7/9/2002 +, Alejandro Acosta Alamo wrote: Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48431t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Cut-through vs Store Forward [7:48316]
you found 3000 out of 15000 that were what ? less than 64 bytes ? Larry Letterman Cisco Systems [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Alejandro Acosta Alamo Sent: Tuesday, July 09, 2002 11:22 AM To: [EMAIL PROTECTED] Subject: Re: Cut-through vs Store Forward [7:48316] Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48424t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
.I found over 3000 out of 15.000 packets that were less than 64 bytes longer.. - Original Message - From: Alejandro Acosta Alamo To: Priscilla Oppenheimer ; Sent: Tuesday, July 09, 2002 2:10 PM Subject: Re: Cut-through vs Store Forward [7:48316] Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48430t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
Alejandro Acosta Alamo wrote: .I found over 3000 out of 15.000 packets that were less than 64 bytes longer.. First, I would check how your protocol analyzer counts. An application can send a packet that is less than 64 bytes. The Ethernet driver must pad the frame out to 64 bytes. It's possible your analyzer doesn't count the padding and is giving you a length that just counts the actual data. If that's not the explanation, then you have an unhealthy network. The recipient of an Ethernet frame that is less than 64 bytes will just drop the frame. Why waste bandwidth on this junk? On a shared network, frames that are less than 64 bytes (fragments or runts) can occur due to collisions. Some collisions are normal on a shared network. But 20% is too high. Runts result when a station starts sending, gets through the preamble and into the actual frame, but not past 64 bytes, and notices that another station is sending. The transmitters send a short jam, and then stop sending. They backoff and wait a random amount of time before retransmitting. The result is that they transmitted runts (frames less than 64 bytes). On a point-to-point network (supposedly not shared), runts result from a duplex mismatch. One side thinks the link is full duplex and sends whenever it wants. The other side is set for half duplex and thinks that receiving while it's sending is a collision, stops sending, backsoff, and leaves behind a runt. Priscilla - Original Message - From: Alejandro Acosta Alamo To: Priscilla Oppenheimer ; Sent: Tuesday, July 09, 2002 2:10 PM Subject: Re: Cut-through vs Store Forward [7:48316] Hello again, Priscilla, you have said that an ethernet frame must be at least 64 bytes, right?. I have just placed an sniffer on my LAN and I found over 3000 out of 15.000 packets. Does this mean that 20% of those packets are illegal? Thanks Alejandro Acosta - Original Message - From: Priscilla Oppenheimer To: Sent: Monday, July 08, 2002 1:08 PM Subject: RE: Cut-through vs Store Forward [7:48316] Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48448t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Cut-through vs Store Forward [7:48316]
Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48322t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
MADMAN wrote: I seem to recall some Cisco switches that would perform cut-through switching until a configurable number of CRC's are detected and would switch to store-and-forward until errors cleared. Dave Oh, that's right! I meant to mention that in the message. Some switches automatically convert to store-and-forward when a configured threshold of errors is reached. This is sometimes called adaptive cut-through switching. I don't know which switches have this features. I just know that this always comes up in theoretical discussions of the switching mode. ;-) Also, some switches offer fragment-free cut-through switching. These switches do cut-through, but only after 64 bytes have been received. That way they avoid forwarding a frame that is illegally short. The Cat 5000 and 6000 family of switches only offer store-and-forward, by the way. I think this is an argument for considering cut-through and its varieties a marketing development, rather than a technical development. The reduced latency that cut-through offers is not a big advantages on real-world networks, especially since the latency on high-end store-and-forward switches is minimal anyway. Priscilla Priscilla Oppenheimer wrote: Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com -- David Madland Sr. Network Engineer CCIE# 2016 Qwest Communications Int. Inc. [EMAIL PROTECTED] 612-664-3367 Emotion should reflect reason not guide it Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48346t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cut-through vs Store Forward [7:48316]
I seem to recall some Cisco switches that would perform cut-through switching until a configurable number of CRC's are detected and would switch to store-and-forward until errors cleared. Dave Priscilla Oppenheimer wrote: Alejandro Acosta Alamo wrote: Hello, I understand the differences between Cut-through and Store Forward. My question is: How do you decide with method to use?, in whch situation have you change the switching method?. Thanks Alejandro Acosta A lot of switches support only one method, so you don't have a choice. If you do have a choice, the decision is based on the number of errors on your network. Cut-through doesn't do any error checking and in fact forwards frames that have a bad CRC or are too short. Ethernet says that frames must be at least 64 bytes. Anything less is considered a fragment and is illegal. Cut-through forwards fragments that have an entire destination address that can be looked up to get a port number. If your switch connects many shared networks, then CRC errors and fragments due to collisions are normal. But why waste bandwidth forwarding these to other ports on the LAN? In this case, you might want to go with store-and-forward which does not forward errored frames or fragments. If your switch connects single devices all using full-duplex, then it's unlikely that you are experiencing many CRC or fragments. So, cut-through makes the most sense. Priscilla Oppenheimer http://www.priscilla.com -- David Madland Sr. Network Engineer CCIE# 2016 Qwest Communications Int. Inc. [EMAIL PROTECTED] 612-664-3367 Emotion should reflect reason not guide it Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=48336t=48316 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
