Sources of network traffic quality issues

If you are having network traffic issues, review the following issues to help isolate the problem.

Table 1. Sources of network traffic quality issues
Issue Source
Dropped network TCP packets Network TCP packets can be dropped in any of the following conditions occur:

  • Over-subscribed span port: Dropped network packets can be caused by an over-subscribed network switch span port. In this configuration, one or more selected network traffic streams are configured to a share a single port where the total of all selected traffic exceeds the port's bandwidth. For example, three 500 megabits/s traffic streams with aggregate bandwidth of 1.5 gigabits/second is mirrored to a switch span port that can handle only 1.0 gigabits/second. During peak traffic periods, this span port is unable to handle the load, and packets are dropped.

  • Inadequate CPU resources on the switch: The span port can be dependent on the switch's CPU for available cycles to aggregate and/or filter the required traffic for mirroring.

    Contemporary switches typically allocate available CPU cycles for span port mirroring where the CPU priority is to handle switching operations. If the CPU is busy with switching operations, there cannot be sufficient cycles to manage the mirroring, in which case span port operations "starve," and network packets are dropped in the mirrored traffic.

    Note: The mirrored traffic bandwidth cannot be close to the practical limits of the span port. A network switch's utilization curve becomes an important factor in providing high-integrity mirrored traffic.

  • Other network devices: In a more complex network infrastructure, more network devices can be used with a mirrored network traffic source, such as network traffic aggregators, and network port replicators. These types of devices can cause network packet loss, especially if any active devices are altering the network traffic as part of their processing.
Unidirectional traffic

A simple misconfiguration error can result in the DNCA receiving network traffic for one direction only. In these instances, HTTP requests or responses are forwarded to the DNCA, but not both.

For the DNCA to correctly reassemble HTTP hits, the TCP traffic must be provided for both directions. In most cases, this situation is a relatively easy to identify and usually is caused by misconfiguration of the source network device.