Announcement

Collapse
No announcement yet.
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Shoretel and Solarwinds

    We are currently on 9.1, build 14.21.4905 and running Solarwinds 9.5 SP4.
    There are times when Solarwinds will report high network traffic between 2 Shoretel devices, either phone to phone or phone to switch. Traffic reported will be on port 5004, and can be greater than 14MB. When you drill down, it is usually distributed equally between both devices, meaning if Solar reports 14MB, it will be 7MB on one Shoretel device and 7MB on the other end. I'm having a hard time believing a conversation between 2 devices would generate that much traffic when the max packet size with no compression is 64k. I'm having a difficult time explaining this behavior to the network guru's. Wiresharking the port is not an option at this time but may be on the next trip to this site. Anyone else seen this type of behavior?
    Thanks in advance.

  • #2
    That is absolutely possible depending on the length of the conversation.

    Looks like you are using flow data to surmise that information. What switches are you using (helps to determine whether it is Netflow or sFlow)?

    Comment


    • #3
      Shoretel switches are 120/24's connected to Dell 3448's. Using Netflow. I would think that would be one lengthy conversation. While I am not certain this is causing any issues, it does appear to be quite a bit of traffic and is cause for concern. Any thoughts regarding options?

      Comment


      • #4
        Outside of the concern about the traffic amount, are you experiencing call quality problems?


        That traffic amount is pretty normal. Remember, I need to calculate overhead as well, so the packet size is more along the lines of 90Kb (if you are using G.711).

        So a 1 minute call from one side, will generate 90 * 60 = 5400kb / 8 = 675KB per minute.

        A 10 minute conversation would then generate 6.75MB of traffic from one side. Pretty much in line with what you are seeing. That is only for RTP payload too, not any signaling or PCM traffic (which are both pretty small).

        Comment


        • #5
          I'm rounding for the sake of simplicity in illustration, by the way.
          Last edited by cburgy; 01-08-2010, 11:23 AM.

          Comment


          • #6
            Thanks for the explanation Chris and it does make sense. No real traffic issues that cannot be explained. This was just brought to my attention and questioned as accurate. With your information, I should be able to explain it to their satisfaction.
            I appreciate the input and time taken to respond.

            Comment


            • #7
              My pleasure.

              Comment


              • #8
                Are we talking cumulative traffic, or bandwidth in use.. Ie: Mb/s..
                I have seen similar patterns, but it was bandwidth in use. It saturated a 1.5MB pipe for an hour until we rebooted the voice switches. One end was a SGT1 switch, with only 2 calls in progress at the time. Version 8.1.

                Comment

                Working...
                X