ETHERCHANNEL

How etherchannel algorithm actually works ?

In this section I would like to highlight on very basic topic "How etherchannel hash algorithm works". In day-to-day networking life some common issues that we face with etherchannel is,

1. Traffic is not distributed properly through each link in etherchannel across the network.
2. One port mostly, like an example, gi8/11 is being selected mostly for every traffic during peak hours. Why Gi8/11 is highly utilized and others have normal utilization?
3. How to change algorithm so that it select ports based on traffic pattern?

Let me start with basic fundamental: How etherchannel algorithm actually works ?

On most of the CISCO switches platform, default ether-channel load-balance algorithm is "XOR source and destination IP " to do the load-balance. The load-balancing is purely based on hashing provided by the hardware, which is in turn based on flows. You can essentially end up with a load balance setup that never changes links depending on your configured flows. You can choose whether to hash on Source or Destination Layer2 (MAC), Layer3(IP Address), or Layer4(Ports) flow information, but hash algorithm cannot be configured or changed to load balance the traffic among the ports in an Etherchannel.

Typically, you will need to play with your Source and Destination settings to find which settings used with your traffic flows creates the best load balance.

The Cisco-proprietary hash algorithm computes a value in the 0-7 range. With this value as a basis, a particular port in the Etherchannel is chosen. The port setup includes a mask which indicates which values the port accepts for transmission. With the maximum number of eight ports in a single Etherchannel, each port accepts only one value. If the Etherchannel has four ports, each port accepts two values, and so on.

Note: The hash algorithm cannot be configured or changed to load balance the traffic among the ports in an Etherchannel.

Assuming the default configuration, a flow is the source IP destination IP pair. Regardless of what the traffic is, that source destination pair will always use the same physical path. As an example,

If you have “http and ftp to/from the same source/destination IP, it will always use the same physical link. If a source destination pair is idle for a time, it will still use the same physical path since it always hashes with the same result. For instance, there is a very high value of replication traffic between several servers. You have 3 flows generating 50 mbps and 10 flows generating 1mbps. From what, it's entirely possible that the 3 largeflows could end up on the same physical link which means that you will have one circuit running at 50mbps and the other at 1mpbs.

So if in traffic capture, if it shows the traffic patterns are mainly in UDP with some of identical source and destination IP address pairs. Since most of traffic patterns are UDP with different port number during the peak hour, the better way to load balance the traffic is either to use source-port or destination-port hash algorithm depends on the traffic path. Again, this will not guarantee the traffic load balance to 50/50.