GroupStudy.com GroupStudy.com - A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
RE: FW: They Might Be Giants! [7:80159] posted 12/03/2003
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]


It's probably not a bad NIC, but a misconfiguration. If the NIC were spewing
out a few extra bits or bytes, the FCS would be bad and then you would see
other errors such as bad FCS and alignment errors. Maybe jabber or dribble
conditions too. I can't remember the exact definitions of those off the top
of my brain which isn't working today anyway due to a head cold. :-) But
they refer to bad frames, not just frames that are too big, such as giants.
I think a giant has a valid FCS and properly ends on an 8-bit boundary, but
it's just bigger than 1518 (or 1522) bytes.

There are many opportunities for a misconfiguration that could cause
"giants" due to all the tags and shims and extra little headers that various
new-fangled technologies offer, such as 802.1Q, VPN, MPLS, jumbo frames,
GigE carrier extenstion, etc.

Also, as Frank (I think it was Frank) mentioned, every interface, line
module, etc. from Cisco behaves differently with respect to giants. It's
possible it's just an annoying warning message and that the switch is
forwarding correctly. If there are not a lot of other symptoms like dropped
packets, lost connections, lots of retransmissions, you could maybe ignore
the giants.

Priscilla

Mossburg, Geoff \(MAN-Corporate\) wrote:
> 
> Wish this group had an email recall button somewhere...
> I could hook a sniffer up to the switch and see if I could grab
> the MAC, but
> I think I'd have to manually sort through the packets to
> determine which are
> giants; I don't think my sniffer will sort/filter by packet
> size. The
> problem I'm trying to solve is simply to definitively determine
> where these
> giants are coming from and correct the problem (bad NIC, etc).
> 
> Geoff Mossburg
> 
> 
> -----Original Message-----
> From: Priscilla Oppenheimer [mailto:nobody@xxxxxxxxxxxxxx] 
> Sent: Tuesday, December 02, 2003 8:14 PM
> To: cisco@xxxxxxxxxxxxxx
> Subject: RE: FW: They Might Be Giants! [7:80159]
> 
> 
> Mossburg, Geoff (MAN-Corporate) wrote:
> > 
> > (I meant to send this to the group...)
> > 
> > Hmmm.... No disrespect intended (and please excuse me for my
> Mr. Spock
> > impersonation), but wouldn't it be logical that if the switch
> > adheres to the
> > new IEEE standard, the giants wouldn't get reported on the
> > switch in the
> > first place? 
> 
> What does logic have to do with it? :-) Seriously, you would
> have to get in
> the programmer's head and I wouldn't assume that much logic. It
> could report
> a giant as a warning and still forward, or report the giant and
> drop it, or
> not report the giant, and forward or not. It could report a
> giant only if
> not configured for 802.1q (since that's what the extra bytes
> are for) but
> still forward, or not. There are numerous possibilities all of
> which could
> be argued to be logical.
> 
> What problem are you trying to solve anyway? You're seeing
> giants and want
> to know where they came from?? Can you get the src MAC address?
> 
> Priscilla
> 
> 
> > 
> > Geoff Mossburg
> > 
> > 
> > -----Original Message-----
> > From: Priscilla Oppenheimer [mailto:nobody@xxxxxxxxxxxxxx]
> > Sent: Tuesday, December 02, 2003 7:15 PM
> > To: cisco@xxxxxxxxxxxxxx
> > Subject: RE: They Might Be Giants! [7:80159]
> > 
> > 
> > In the past, Ethernet MTU was 1518, counting the header and
> FCS. 1500
> > bytes of payload, 12 bytes of dest and src, 2 bytes of
> length/type, 4
> > bytes for
> > FCS.
> > 
> > Recently, IEEE increased it to 1522 to account for an 802.1Q
> VLAN
> > header.
> > 
> > So because there's 2 definitions, switches could behave
> differently
> > with regards to giants. They should discard giants, but maybe
> they
> > don't consider
> > the over-sized frames to be giants.
> > 
> > Priscilla
> > 
> > 
> > 
> > Mossburg, Geoff (MAN-Corporate) wrote:
> > > 
> > > All,
> > > 	I'm troubleshooting giants on an Ethernet switch port and
> > I'm having
> > 
> > > some problems. My understanding of giants is that they are
> > packets of
> > > a size larger than the media type can handle... In this
> case,
> > Ethernet
> > > can handle
> > > an MTU of 1518 bytes (excluding the header). The problem
> with this
> > > definition is that if Ethernet cannot handle packets above
> > 1518
> > > bytes, then
> > > it seems logical to me that the switch-port SHOULD discard
> > them
> > > and not
> > > forward them onto the segment. Is this correct, or will
> giants show
> > > up all along the path from source to destination? Assuming
> that I am
> > > correct,
> > > wouldn't this mean that the problem device should always be
> > > directly
> > > connected to the switch port that the giants are showing up
> > on?
> > > 
> > > Geoff Mossburg
> > **Please support GroupStudy by purchasing from the GroupStudy
> > Store:
> > http://shop.groupstudy.com FAQ, list archives, and
> subscription
> > info:
> > http://www.groupstudy.com/list/cisco.html
> **Please support GroupStudy by purchasing from the GroupStudy
> Store:
> http://shop.groupstudy.com FAQ, list archives, and subscription
> info:
> http://www.groupstudy.com/list/cisco.html
> **Please support GroupStudy by purchasing from the GroupStudy
> Store:
> http://shop.groupstudy.com
> FAQ, list archives, and subscription info:
> http://www.groupstudy.com/list/cisco.html
> 
> 




Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=80221&t=80159
--------------------------------------------------
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html