MTU calculation on CISCO routers

Hello, just wanted to clarify my knowledge on MTU.
interface commands -
IP MTU: is calculating LAYER 3 HEADER + ITS PAYLOAD, which makes max MTU of 1500.
MTU: ETHERNET HEADER + LAYER 3 HEADER + ITS PAYLOAD, which makes 1514 mtu if no mpls, no tags are used. I AM right ? Looking at some vendors other than CISCO (for example) alcatel -lucent this seems to be correct.
But i saw on some cisco routers MTU and IP MTU - 1500 bytes. Why MTU is only 1500, how CISCO calculates MTU, it doesn't count ethernet header or what ? So my calculation above is bad considering CISCO ?
Thanks!

Hello,
Sorry Giuseppe, but I have to disagree with your statement that ((IOS MTU is referred to layer 3 PDU only)) and with the ((MPLS MTU)) command.
Infact, how Cisco treat MTU is what should be understood, at least from my point of view and experience.
The IOS indeed calculate the (IP MTU, Layer-2 MTU and MPLS MTU), below how its calculated:
1- The 1500 of (IP MTU) considers the layer-3 Header and the Payload.
2- The Layer-2 MTU of (1500), considers the Ethernet Header and CRC Trailer of additional 22 bytes as well, So the Default of (MTU 1500) doesnt mean the header and FCS is not considered, the fact, the total layer-2 MTU is equal to 1522, but when you see it 1500 on the IOS, it doesnt mean its not considerable, its calculated as a sum and its shown as 1500, So the 1500 considers the Ethernet header and CRC in its Calculations.
I have seen many implementation where MTU were a big issue resulting in performance degradation and frame/packet drops if not increased, Especially when having MPLS and Dot1q Tunneling.
The Layer-2 MTU from my point MUST be increased when using Dot1q Tunneling to consider the Inner VLAN tag of 4 Bytes, Like Wise, the MPLS MTU on IOS Platforms must be increased to accomodate the additional labels.
I hope this gives an idea of how Cisco Calculates its MTU ,
Regards,
Mohamed

Similar Messages

The difference of the IEEE802.1x Auth between Cisco Routers and Catalyst switches

Hello
I am investigating the difference of the IEEE802.1x Auth between Routers and Switches.
Basically dot1x auth is availlable on Catalyst Switches. however if I want to check to
PortBased Multi-Auth , MAC address Auth and any certification Auth with this feature,
Is it possible to integrate into Cisco Router such as Cisco 891F ?
In my opinion Cisco891F is also available to use basic IEEE802.1x but if it compares with Catalyst switches such as Cat3560X
I think there might be any unsupported feature on Cisco 891F.
I appreciate any information. thank you very much in advance.
Best Regards,
Masanobu Hiyoshi

Many time in interviews asked comaprison between cisco routers and switches that i was answerless bcoz i dont have much knowledge about that.Can anyone provide me the compariosin sheet of the same.how are the cisco devices differ with each other how much Bandwidth each routres support and Etc...
Ummmm ... The most common question I get is "what is the difference between a router and a switch".
However, if you get a question like this, then my impression to this line of questioning are:
1. The candidate they are looking for has in-depth knowledge of routers and switches. And I mean IN-DEPTH!;
2. They are not looking for a candidate. They just want to stroke their ego. There is not alot of people who can give you the "names and numbers" of routers and switches at a snap of a finger. And if you do happen to know the answer, then and there, then expect a tougher follow-up question.

Two Cisco Routers in one class-c network

Hello,
i have two cisco routers, which are connected to one switch. On this switch, there are several servers connected as well.
When i connected the second cisco router, i got messages on the first router, that there is an ip address conflict. After a few minutes it seems as if the vpn tunnel on the first router breaks down because of this conflict. I'm not sure about this, but when i disconnected the second router again, the vpn tunnel could be established again. The vpn tunnel goes to another router via WAN and ends in the local class-c network, where both routers are in.
Router1
LAN 192.168.105.254 (255.255.255.0)
WAN 212.xxx.xxx.xxx
||
||
Cisco Switch
||
||
Router2
LAN IP 192.168.105.253 (255.255.255.0)
WAN IP 217.xxx.xxx.xxx
Router1
int fa 0/1
ip address 192.168.105.254 255.255.255.0
Router2
int fa 0/1
ip address 192.168.105.253 255.255.255.0
Could the /24 mask on the interfaces cause the conflicts?
From the servers, none has the ip 192.168.105.253 or 192.168.105.254 and if i disconnect Router2, the IP 192.168.105.253 is not reachable from any system on the switch.
So how does this ip address conflict occur?

hello,
can you check the router 1 log. with error message you should have a mac address
May 10 05:32:20.489: %IP-4-DUPADDR: Duplicate address 10.10.10.1 on GigabitEthernet0/1.1, sourced by 0003.oc12.a2c3
This should help you to identify host already with 192.168.105.253.
Before connecting Router 2, from Router 1 ping 192.168.105.253 and do a sh arp ?
HTH,
regards,
cisand

Ask the Expert: Packet Capture Capabilities of Cisco Routers and Switches

With Rahul Rammanohar
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about packet capture capabilities of Cisco routers and switches.
In May 2013, we created a video that included packet capture capabilities across multiple Cisco routers and switches. For each product, we began with a discussion about the theory of the capabilities, followed by an explanation of the commands, and we concluded with a demo on real devices. In this Ask the Expert event, you’re encouraged to ask questions about the packet capture capabilities of these Cisco devices:
•       7600/6500: mini protocol analyzer (MPA), ELAM, and Netdr
•       ASR9k: network processor capture
•       7200/ISRs: embedded packet capture
•       Cisco Nexus 7K, 5K, and 3K: Ethanalyzer
•       Cisco Nexus 7K: ELAM
•       CRS: show captured packets
•       ASR1K: embedded packet capture
More Information
Blog URL: Packet Capture Capabilities of Cisco Routers and Switches
Watch the Video: https://supportforums.cisco.com/videos/6226
Hitesh Kumar is a customer support engineer in the High-Touch Technical Services team at Cisco specializing in routing protocols. He has been supporting major service providers and enterprise customers in routing, Multiprotocol Label Switching (MPLS), multicast, and Layer 2 VPN (L2VPN) issues on routing platforms for more than three years. He has more than six years of experience in the IT industry and holds a CCIE certification (number 38757) in service.
Rahul Rammanohar is a technical leader with the High-Touch Technical Support Team in India. He handles escalations in the area of routing protocols and large-scale architectures for devices running Cisco IOS, IOS-XR, and IOS-XE Software. He has been supporting major service providers and large enterprise customers for routing, MPLS, multicast, and L2VPN issues on all routing platforms. He has more than 13 years of experience and holds a CCIE certification (number 13015) in routing/switching and service provider.
Remember to use the rating system to let Hitesh and Rahul know if you have received an adequate response.
Because of the volume expected during this event, Hitesh and Rahul might not be able to answer each question. Remember that you can continue the conversation in the Service Provider, sub-community forum shortly after the event. This event lasts through November 1, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hello Erick
    Thanks for the topology. The trigger will be different for labelled packet as you would need to mention the values of labels too in the trigger.
     Below are two examples of one or two labels being used, it depends on where you are capturing the packet in mplsvpn scenario which will decide teh number of labels being imposed on the packet.
Trigger for one label. (if the router on which you are capturing the packet PHP is being performed)
VPN label - 5678
Source Address - 111.111.111.111
Destination Address - 123.123.123.123
show platform capture elam trigger dbus others if data = 0 0 0 0x88470162 0xE0000000 0 0 0x00006F6F 0x6F6F 7B7B 0x7B7B0000 [ 0 0 0 0xffffffff 0xf0000000 0 0 0x0000ffff 0xffffffff 0xffff0000 ]
Trigger for two labels. (for other core routers)
IGP label - 1234
VPN label - 5678
Source Address - 111.111.111.111
Destination Address - 123.123.123.123
show platform capture elam trigger dbus others if data = 0 0 0 0x8847004D 0x20000162 0xE0000000 0 0 0x00006F6F 0x6F6F7B7B 0x7B7B0000 [ 0 0 0 0xffffffff 0xf000ffff 0xf0000000 0 0 0x0000ffff 0xffffffff 0xffff0000 ]
    You can check the labels being used (by using show ip cef <> details) and covert their values to hex and change the trigger accordingly.
     I have changed the colors for better understanding. If you notice carefully in the trigger the values for ip address, labels have just been converted to their respective hex values which could be replaced.
     Please let me know if this helps.
Thanks & Regards
Hitesh & Rahul

Implementing WAAS using 3925 and 2911 Cisco routers

Dear all,
I am new to Cisco WAAS and therefore I would like to request some help regarding the following scenario:
I have a star network (1 hub and 5 spoke) topology where each satellite site is connected via a 2 MB (symmetric) to the Head-Quarters (Central node). In order to be able to concentrate all servers (services) at the head-quarters and improve the users experience in remote sites when accessing network services that are located at the head-quarters we want to implement Cisco WAAS instead of increasing the existing bandwidth.
At the head-quarters we are using a 3925 Cisco router and at the remote locations we are using 2911 Cisco routers. Last but not least there will be approximately 75 concurrent users from remote sites accessing resources at the head-quarters.
Currently I am planning to use the following:
·At the head-quarters I am planning to use a Cisco Wide Area Application Services (WAAS) Module: SM-SRE-900-K9 with an Enterprise license (for large deployment) in the Cisco router 3925
·At the remote sites I am planning to use a Cisco Wide Area Application Services (WAAS) Module: SM-SRE-700-K9 with an Enterprise license (for medium deployment) in the Cisco router 2911
Is there anything else that I am missing or need to take into consideration for deploying the WAAS.
Regards,
Screech

Hi Screech,
Answers:
Is the dedicated WAE hw for central management purpose a required component?not required as WAEs can optimize even without Cntral managementbut you will not be able to collect statistics, reports and will have to manage WAEs from CLI. This a kind of highly recommended management piece you will need.
What is the difference between using a full blown WAE instead of a Sm SRE module: Using a fully blown WAE at DC is recommended as you are then avoiding couple of bottlenecks.
1. Bandwidth allcoation
2. SM / NM models have low capacity, disks where as fully blown models like 674s have 10k/15k SATA / SAS drives.
3. HW redundancy: you have backup PS / HD in dedicated WAEs in msot of the models.
4. HW dependency: Your SM moduels depened upon your router / switch. If for some reason, switch or router goes down, SM moule goes down at same time.
5. Additional NICs / HW availability.
There are various other reasons you might want to consider. You can ask your cisco sales engineer or one of the PDI help engineer on the forum can also punch in here.
but basicaly, I would go for fully blown WAE on DC side and central management piece as well.
Regards.

System MTU size on Cisco switch

after setting sys mtu to something other than 1500 on a WS-C3750G-24TS-1U it appears that this setting will stay in effect even if the startup config is erased and the switch is reloaded. My question is. Does this mean that if I need to replace the switch and I just load a saved version of the config and the vlan.dat files. Most likley if I am running a non default MTU this will not be in effect on the new switch.

Hi IP,
if i was understood properly, you have changed the MTU size of cisco 3750 from default 1500 bytes to 1998(eg.) now even after restarting the switch, this MTU size doesn't come to the default value of 1500 bytes & also when you tried put this config & vlan.dat file you wanted to know whether this changed MTU value will be in effect. Answer is NO, bcoz config & vlan.dat doesn't contain this MTU settings. but you can again manually change the MTU size to 1500 bytes & restart the switch.
hope this helps.
rate this post if it is been clarified.

Securing Telnet access on Cisco routers (access class)

Dear All,
In all my network i have cisco catalyst switch and cisco routers deployed in my WAN. In cisco routers, it was activated an ACL to secure telnet access to WAN devices. only 3 hosts (remote) were autorized to access these devises. I need to modify this secuirty to have access from the LAN (locally).
The ACL was implmented in all routers, and activated using access class in.
in there any idea without changing more the configuration and only tell the router to apply this ACL for WAN and not access for the LAN ?
Thanks for your help,
Best regards,

Hi,
here is the ip int brief.
thanks
CISCO1841#show ip int brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 192.168.1.1 YES NVRAM up up
FastEthernet0/1 192.168.2.1 YES NVRAM up up
ATM0/0/0 unassigned YES NVRAM up up
Dot11Radio0/1/0 unassigned YES NVRAM up up
Dot11Radio0/1/0.1 192.168.2.129 YES NVRAM up up
Dot11Radio0/1/0.2 192.168.3.1 YES NVRAM up up
NVI0 unassigned NO unset up up
Virtual-Access1 unassigned YES unset up up
Dialer1 151.16.203.203 YES IPCP up up

Cisco Routers - optimal dsl sync interval for bt a...

Hi has anybody played around with the "dsl sync interval" on Cisco routers, I was after finding out the optimum setting.........or is it a "well it depends" type answer?
Many thanks

Hi has anybody played around with the "dsl sync interval" on Cisco routers, I was after finding out the optimum setting.........or is it a "well it depends" type answer?
Many thanks

Cisco routers support ipv6 in OPNET?

Hi all,
my question is: which of cisco routers support ipv6 in OPNET Modeler simulator?
please, It's urgent.
Thanks in advance.

Hi Dan,
This is a funny community section to pose questions on the SOHO 97
It's End of Like annoucement was a wee while ago, in June 2006.
http://www.cisco.com/en/US/prod/collateral/routers/ps4866/prod_end-of-life_notice0900aecd804d5ad6.html
As you appreciate, the replacement for the SOHO97, the 800 series product supported IPv6.
I have taken the liberty , in relation to soho97, to copy a section from the IOS software release notes from the following URL;
http://www.cisco.com/en/US/products/hw/routers/ps221/prod_bulletin09186a00801ffda1.html#wp1003249
It states the following in relation to IOS version12.3(4)XG
"Baseline IPv6
Supported Platforms: Cisco 831, 836, and 837 Series Routers; Plus Images Only
Support of the baseline initiatives IPv6 features—providing IPv6 support to all Cisco 830 Series platforms. Further details in release notes."
Like yourself, no where can i see a reference to the SOHO 97 product supporting IPv6.
regards Dave

Difference between setting up a vpn with windows 7 and cisco routers

Hi.I was wondering what the main difference Is between setting up a vpn with windows 7 or configuring It on cisco routers.
When you setup the vpn on windows 7 or xp do the client and server pc's take care of the encryption and decryption whereas configuring vpn on routers , the encryption and decryption Is done solely by the routers?
If I want to setup a connection where an IP In the same Internal lan Is assigned to the client pc I'm guessing I'd have to use a router configuration.
Thanks

Thank you for the response, lucky for me there was another option. Threatened to cancel with the ISP on the NAT side unless they assigned us a public static ip/gateway/subnet. They ended up doing that and the VPN connected as soon as the changes were made in the Linksys.

Facing issue in using SNMPV3 on Cisco Routers

Hi,
Actually, i am trying to implement SNMPV3 on Cisco Routers & Switches to manage & monitor these devices in a more secure manner using NMS called Orion (NPM) Network Performance Monitor.
When i am going to add the node on Orion (NPM), it is showing me an error that the device does not support the interfaces MIB.
The Routers IOS Version and its feature set is as under:
Cisco 3800 & 2800 (IOS version 12.4(20)T2 Advance IP Services).
Configuration as under:
snmp-server DEPT_GRP V3 auth context DEPT_CTX read DEPT_VIEW
snmp-server view DEPT_VIEW iso included
snmp-server view DEPT_VIEW internet included
snmp-server view DEPT_VIEW interfaces included
snmp-server view DEPT_VIEW system included
snmp-server view DEPT_VIEW chassis included
snmp-server context DEPT_CTX
snmp-server user SNMPADMIN DEPT_GRP v3 auth sha cisco123 priv des cisco123
snmp-server host 213.42.48.158 version 3 auth SNMPADMIN
At Orion parameters are given as under:
username :- SNMPADMIN
SNMPV3 context :- DEPT_CTX
SNMPV3 Authentication :- SHA1
SNMPV3 Privacy/Encryption :- DES56
Password Key :- cisco123 (All the places)
Kindly help me out and advise me where i am going wrong. Kindly check the configuration above is anything missing in it regarding the SNMPV3 configuration.
Rgds,
Ayaz Ali

Hi Joe,
Thanks for your response. As per your reply, i had removed the context and views which were configured earlier on the router and followed the same instructions as you mentioned in your reply, but i would like to tell you one thing about the configuration that i had done for snmp v3.
Your configuration is :-
snmp-server group DEPT_GRP v3 auth read v1default
snmp-server user SNMPADMIN DEPT_GRP v3 auth sha cisco123 priv des cisco123
My Configuration is :-
snmp-server group DEPT_GRP v3 priv read v1default
snmp-server user SNMPADMIN DEPT_GRP v3 auth sha cisco123 priv des cisco123
In your configuration, you are using Authentication (Auth) for the SNMP v3 group and if u select auth (Keyword) then you have to only provide authentication method (SHA,MD5) no privacy keys for encryption (DES,AES) in snmp user configuration, otherwise it will give you an error that credential not matched on the host when you try to poll the device.
In my configuration, I am using privacy (priv) for the SNMP v3 group, thats why i had given both authentication and encryption keys under SNMP user configuration.
In short, user settings are dependent on the group settings if you are using auth then it only support authentication but no privacy and if you are using priv then it allow both authentication and encryption (privacy).
Thanks for your support, it really helped me out in solving the issue. Now, i am able to poll my all routers using snmp v3.
Rgds,
Ayaz Ali

Sub interface features only in cisco routers?

is sub interface feature available only in cisco routers? any body has any clue?

as far as I know, only router provides sub-interface.
Gilles.

Can Cisco Routers, Switches, or Firewalls run AV?

Can anyone point me to a document or official statement from Cisco stating that their routers, switches, and firewalls are not capable of running Anti-Virus/Anti-Malware to protect their IOS? NERC CIP standards require that all devices contained within the Electronic Security Perimeter run Anti-Virus/Anti-Malware software "where technically feasible", if the devices cannot run AV/AM you have to submit a "Technical Feasibility Exception"....done that...now they want proof that Cisco devices (routers, switches, firewalls) are not capable of running AV/AM to protect their IOS. Please don't confuse this with all of the offering that Cisco has to protect end-user devices...this applies only to the routers, switches, and firewalls.
Any answers would be greatly appreciated, even comments from others dealing with this issue.

A couple of years ago in a conference there was a presentation that claimed to install a rootkit to Cisco IOS devices.
Here is the response from Cisco http://www.cisco.com/warp/public/707/cisco-sr-20080516-rootkits.shtml
That is the closest I can think of that could help you.
PK

Video/Voice Conference -8 Error Explained for Cisco Routers

I cannot tell you how long I have spent trying to figure out this problem. We have a bunch of macs sitting behind a NATed Cisco 2811 router, and iChat will just never work, throwing the good ole' -8 error.
Having a good understanding of SIP, I decided to get down an dirty with the investigation of why iChat doesn't work behind some routers, while it does on others.
iChat uses SIP, but as I have found, Apple's implementation of it does not completely honor the RFC. This is the root cause of iChat not working behind enterprise grade routers that have SIP ALG activated (details later).
Apple uses its own flavor of NAT traversal: SNATMAP. This is an Apple service that is utilized every time a video/voice conference is created from iChat. For those of you familiar with SIP, SNATMAP essentially performs the same function as a STUN server. This service abstracts the port specifications necessary to get around NATs to a server on the public Internet.
With some routers, this SNATMAP seems to work fine. With others, not so much. I honestly don't have too deep of an understanding of SNATMAP so I cannot get into too much detail as to why it doesn't work with some routers. If anyone knows, please chime in!
I can, however, clearly indicate why it doesn't work behind routers that have a SIP ALG, which essentially has the intelligence to pick apart to SIP packet to make them NAT friendly. Basically, there is a portion of SIP packets called the SDP (Session Description Protocol) that provides all of the information necessary to set up the voice and video stream. The SIP RFC calls for this section to include information like the connection IP address, port, video codec, audio codec, etc. HOWEVER, Apple's implementation of iChat DOES NOT INCLUDE THE PORT IN THE SDP. Therefore, when a SIP ALG tries to intelligently convert the port, it isn't there to change. Even if it does manage to insert a port number into the SDP, the iChat client receiving the SIP packet doesn't respect that port number and just dumbly sends the request back to the default SIP port (5060).
Here is a little flow of the process:
1. A SIP packet is sent out from iChat to the cisco router
2. Cisco intercepts the packet, changes the private IP address of my computer to the public IP address of the interface, and changes the port to one that it assigns on the public interface. So, basically the SIP packet enters the cisco with the SDP info like 192.168.100.137:5060 and leaves the Cisco like <public IP>:1877.
3. On the receiving end, the SIP packet and SDP section is read with our DSL connection's public IP address, so when it tries to make contact back, requests are sent to the DSL public IP address and not an unrouteable private IP. Also, it sends to the port specified in the SDP section.
4. When a packet comes in from the peer, the destination is something like <public IP>:1877. The cisco NAT translation table remembers that things destined to port 1877 should be converted to 192.168.100.137 on port 5060. The SDP section of the SIP packet is modified and things are peachy.
5. This happens back and forth for all SIP messages that traverse the NAT.
iChat is not SIP RFC compliant which is why we are having these natting issues. iChat does not specify a port in the SDP portion of the SIP messages it is sending out: a big no-no. Therefore, when the recipient iChat is sending back its requests to 207.182.233.32, it is sending it to port 5060 instead of assigned port 1877. The public port 5060 is blocked, and is not routed to any specific computer, resulting in a timeout. Here is the Cisco output 'debug ip nat sip'
001892: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] processing INVITE message
001893: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] register:0 door_created:0
001894: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] translated embedded address 192.168.100.138-><public IP>
001895: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] No port present. Use new port 5060->1210
As you can see, it is processing the INVITE request and translating the internal IP address to the public one.
However, it reports no port present, meaning that the port specification in the SDP section of the SIP packet is not present. It does a port translation because it feels obligated to, but iChat doesn't respect that on the other end and sends to 5060 anyway which is not mapped to any specific internal IP addess, so, alas, it doesn't work.
Now, that being, said, this explains why iChat doesn't work behind SIP ALGs. However, if you are able to disable the SIP ALG (on cisco: 'no ip nat service sip udp 5060'), it still doesn't work. With the ALG turned off, the SDP translations don't occur, but for some reason SNATMAP still doesn't work either. I am thinking that could be due to a nat issue, but I haven't figured that out yet. Anyone's insight would be appreciated!
Hope this helps anyone out there seeking help / console with iChat Error -8 issues behind an enterprise grade router.
Hopefully we can figure out why iChat's SNATMAP implementation doesn't work with a Cisco NAT next...

Hi
Ok for the Homehub's.
UPnP should be enabled.
Set the Quicktime streaming setting, goto sys prefs/quicktime/streaming/streaming speed, set to 1.5mbps(dont use automatic)
In ichats prefs click on video and change bandwidth limit to NONE.
Goto to sys prefs/sharing/firewall and turn on(dont add any ports for ichat, leave anything that is ticked ticked).
Restart ichat.
And try connecting to me defcom1 .mac account.
Tony

USB port on Cisco routers to connect 4G datacard

Hello
Can anybody know about the following questions?
1) Which router having USB port on which we can connect 4G datacard for internet connectivity?
2) Is there any inbuild USB port available on 1921-SEC/K9, 2921-SEC/K9, 3925-SEC/K9 routers for connecting 4G datacard for internet connectivity?
3) Is there any WIC card available that will be having USB port for connecting 4G datacard?
Regards,
Mukesh Kumar
Network Engineer
Spooster IT Services

1) Which router having USB port on which we can connect 4G datacard for internet connectivity?
None. USB ports do not have adequate capabilities to power up those kinds of devices.
2) Is there any inbuild USB port available on 1921-SEC/K9, 2921-SEC/K9, 3925-SEC/K9 routers for connecting 4G datacard for internet connectivity?
Cisco Fourth-Generation LTE Wireless WAN Enhanced High-Speed WAN Interface Cards Data Sheet
Q&A: Fourth-Generation LTE Wireless WAN Cards for Cisco Integrated Services Routers Generation 2

MTU calculation on CISCO routers

Similar Messages

Maybe you are looking for