The two graphs below are on opposite sides of the same cable.
In other words, the graphs should be a mirror image of each other – but they are not!
The first is from a CCR2004 running v7.13 - a core distribution router (running OSPF, etc) - downstream from the CCR1036
The 2nd is from a CCR1036 running v6.49.13 - an Internet gateway router (running firewall and NAT) - upstream from the CCR2004.
The spikes on the first graph are significant - a spike is about 2.5Gbps in magnitude (from avg. level of traffic to peak).
How is it that they don’t show on the gateway router (the other side of the cable - an SFP+ DAC-cable).
This isn’t a plotting problem with the CCR2004, since other routers downstream of it also show this traffic pattern.
These graphs are taken during a low-usage hour of this network – everything gets far more pronounced during evening peak hours - yet, no packet loss or any actual problems observed - only these graphs.
Do you have the same results when graphing using an external application & using SNMP or something?
Perhaps because of the different RouterOS 6 <> 7
Things related to some fast-path stuff what that certain things are “less visible” to RouterOS 7 ?
Mikrotik must provide insight on how & where they gather these value first before you can draw any conclusions.
Thanks everyone.
The comments about fragmented traffic make sense, but I don’t see a problem with MTUs.
All interfaces on all routers are using 1500 MTU.
Where it comes to the CCR2004 - L2 MTU is 1592
On the CCR1036 (where no surges show) - the L2 MTU is 1580 – could that be it?
Our external graphing systems using SNMP are not granular enough to show these very short surges.
To add to the mystery, these surges are seen on most interfaces of the CCR2004 (all routed - nothing bridged) – although with different magnitudes.
There’s also some strangeness that I have never seen before when trying to Torch an interface - see the attached from a 2-3 seconds of Torch - the first entry is probably the traffic of that surge - has no data!!! No Eth-protocol, no nothing – just lots of packets!!
I have experienced similar spikes on my CCR2216 right up to ROS 7.16.1
I have had a ticket open with mikrotik for a long time on this issue and they not able to identify why. On my lab CCR2216 I installed 7.17 beta6 and I don’t have spikes anymore so I’m waiting for 7.17 stable to release then i will update 1 production router and see if in production it also fixes the issue.
Thank you so much for posting this, yahelb. Seems to me this is some kind of CCR2004-1G-12S+2XS architecture specific bug that MikroTik needs to fix. I am seeing the exact same behavior you are on mine; mystery traffic spikes on tx and rx that are basically double whatever the actual real rate is. Picture attached from ROS 7.18.2, I bet it looks very familiar.
I’ve submitted a bug report, let’s see how long it takes them to fix.
Edit: I also notice you didn’t specify which exact CCR2004 model you’re using, but I’m willing to bet it’s also a 1G-12S+2XS.
Nice to know I’m not crazy…
I’ve since gotten used to this, and apart from a slightly high CPU on the 2004, everything seems to be working fine – so I’m not wasting anymore time on this.
Soon enough, we’ll just toss the CCR2004 to the garbage bin and replace it with something better…
Here’s the graph on my 2004 right now… Exactly as it always was…
