I am reading about the DBL feature on the Cisco 4500E which protect the buffers from filling up with traffic that is identified as nonadaptive or belligerent flows such as aggressive UDP flows. Since my curiosity doesn't stop here, i am trying to understand how the supervisor engine identify this type of traffic, which characteristics has this traffic apart from being UDP.

Is this UDP traffic only?

Can someone provide me with examples of aggressive UDP flows or any other flows that are marked as belligerent flows?


Gonçalo Reis


Industry’s First Hardware and Flow-Based Congestion Avoidance at Wire Speed

A Cisco innovation, Dynamic Buffer Limiting (DBL) is the first flow-based congestion avoidance quality-of-service (QoS) technique suitable for high-speed hardware implementation. Operating on all ports in the Cisco Catalyst 4500 Series Switch, DBL effectively recognizes and limits numerous misbehaving traffic flows, particularly flows in a network that are unresponsive to explicit congestion feedback such as packet drops (typically UDP-based traffic flows). It is a multiprotocol technique that can examine a flow’s Layer 2/3/4 fields.

DBL provides on-demand Active Queue Management by tracking the queue length for each traffic flow in the switch. When the queue length of a specific flow exceeds its limit, DBL will drop packets or mark the Explicit Congestion Notification (ECN) field in the packet headers, so the flow can be handled appropriately by servers in the unlikely event of network congestion. Unchecked flows—also known as belligerent or non-adaptive flows—use excessive bandwidth, and their consumption of switch buffers results in poor application performance for end users. This misbehaving traffic can also negatively affect well-behaved flows and wreak havoc with QoS.

Belligerent flows can come from misbehaving or aggressive applications that try to use an excessive amount of bandwidth. An application without any congestion control mechanism that attempts to use all the available bandwidth would result in belligerent flows. An aggressive or improper TCP implementation on a high performance host can transmit high rate traffic to the network.

Belligerent flows can also come from network failures or misconfigurations. For instance, in a switched Ethernet environment, a spanning-tree loop, where packets are forwarded at wire rate through a circle of switches can result in several belligerent flows. Similarly, router misconfigurations can lead to looping behavior, such as multicast routing loops. A belligerent flow can also arise because of a host interface or operating system failure where packets are transmitted into the network at it's maximum rate. Less common but still of concern, a malicious host or compromised switch or router can inject high rate streams of packets into the network.

Some reading:

Using Dynamic buffer Limiting to protect against Belligerent flows in High-speed Networks

  • Great, thanks for the explanation and the link for some reading. Cheers
    – Gngogh
    Jan 19 '18 at 20:59

The supervisor engine maintains (in hardware) a table of 5-tuples: src-ip, dst-ip, src-port, dst-port, protocol (udp/tcp).

The table has rows like this:

5-tuple-xx => interface te3/1 => <n> packets in the last time window
5-tuple-yy => interface te3/1 => <m> packets in the last time window

When the o/p interface starts seeing congestion, and there is DBL enabled, this table is consulted to see which flow(s) to drop packets from.

  • Great. How can i check that table?
    – Gngogh
    Jan 19 '18 at 12:06
  • I somehow doubt if there is a "show" command that shows this table, because it is built and maintained completely in hardware, based entirely on the packets flowing through the device (as opposed to things like IP routes where the hardware maintains a copy of the information that the software pushes, and therefore easier to display in a "show" command). However, you could try to look for any dbl-related show commands by looking for "show platform hardware ?" and "show platform software ?"
    – mere3ortal
    Jan 19 '18 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.