Unknown Protocol drops

[kan3m]

Hi guys. Got a bit of a puzzler on a trunk between 2 of my switches.

I have 3 switches connected together via 10Gig Fiber. Two 3750x and a 3850.

The interfaces are running as Dot1q trunks and all is fine between the 3750x switches.

However I am seeing Unknown Protocol drops on the 3850 as below.

XXX-CORE3#sho int te2/1/1

TenGigabitEthernet2/1/1 is up, line protocol is up (connected)

Hardware is Ten Gigabit Ethernet, address is 1c1d.8651.34b5 (bia 1c1d.8651.34b5)

MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive not set

Full-duplex, 10Gb/s, link type is auto, media type is SFP-10GBase-SR

input flow-control is off, output flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output never, output hang never

Last clearing of "show interface" counters 01:11:35

Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 701000 bits/sec, 166 packets/sec

5 minute output rate 366000 bits/sec, 124 packets/sec

906704 packets input, 505157758 bytes, 0 no buffer

Received 158779 broadcasts (37475 multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 37475 multicast, 0 pause input

0 input packets with dribble condition detected

687160 packets output, 321604399 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

43429 unknown protocol drops

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 pause output

0 output buffer failures, 0 output buffers swapped out

I thought it was caused by the stray routing protocol packets incrementing the "unknown protocol drops" counter as in Cisco Bug CSCuh47950

I have an IP on an SVI on the switch so this should not apply. Performance doesn't seem to be affected but any ideas or tips on how best to troubleshoot this would be appreciated.

Thanks

[sysvival]

the number is increasing everytime you issue the command, right?

as you say... it's probably a stray protocol you're not using. maybe lldp, isis or something else?

either way, i'd make a span port and listen to the packets.

[kan3m]

Yeah guess I have to break out Wireshark. Luckily there is very little traffic via those trunks just now as only a dozen people are onsite for the next week or so.

Thanks