{"id":4022,"date":"2012-08-03T15:15:44","date_gmt":"2012-08-03T21:15:44","guid":{"rendered":"http:\/\/gregsowell.com\/?p=4022"},"modified":"2012-08-03T15:15:44","modified_gmt":"2012-08-03T21:15:44","slug":"odd-cisco-inspect-behavior","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=4022","title":{"rendered":"Odd Cisco Inspect Behavior"},"content":{"rendered":"

I was recently asked to evaluate why a network was having issues with watching youtube or download large files.<\/p>\n

I checked speed and duplex, every thing was fine on my and their sides.<\/p>\n

show int<\/code><\/pre>\n
I checked the CPU and everything was fine.<\/p>\n
show proc cpu history<\/code><\/pre>\n
To rule out the rest of their network, they unplugged their switch from the 2800 series router and connected their laptop straight in.  The issue persisted.<\/p>\n
On issuing some show interface commands I noticed that the interface was displaying input errors along with ignored.  I found an article<\/a> that say these in conjunction with buffer errors say you don’t have adequate buffer space…however I was receiving no buffer issues.  The article pointed towards some hardware issues.<\/p>\n
router#show interface Gi0\/1\r\nGigabit0\/1 is up, line protocol is up \r\n... \r\n21 input errors, 0 CRC, 0 frame, 0 overrun, 21 ignored<\/code><\/pre>\n
I happened to have a spare router that was equivalent, so I duplicated their config and gave it to them to swap out.  They swapped the gear and the issue persisted…hmmmm.<\/p>\n
I noticed in the config that there were some “ip urlfilter exclusive-domain” command entered.  This is used in conjunction with something like Websense or N2H2 for web filtering…but they don’t have such a service.  It turns out they were trying to do some web filtering.  I then noticed that their default inspection policy included HTTP.<\/p>\n
ip inspect name DEFAULT http<\/code><\/pre>\n
I issued the no command on the http inspection and low and behold everything cleared up.  It seems that a router with an http inspection policy killing streaming connections will manifest as input and ignored only.<\/p>\n
Good day and happy routing.<\/p>\n","protected":false},"excerpt":{"rendered":"
I was recently asked to evaluate why a network was having issues with watching youtube or download large files. I checked speed and duplex,\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,8],"tags":[],"class_list":["post-4022","post","type-post","status-publish","format-standard","hentry","category-cisco","category-networking"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/4022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4022"}],"version-history":[{"count":2,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/4022\/revisions"}],"predecessor-version":[{"id":4024,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/4022\/revisions\/4024"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}