Microbursts and buffers
Your graph says the link is at thirty percent, yet packets are dropping. The culprit is often a microburst — traffic that spikes to line rate for a few milliseconds.
Averages hide them
A five-minute, or even one-second, average smooths away a burst that filled the pipe for ten milliseconds. But the switch buffer lives in those milliseconds: if a burst arrives faster than the port can drain it, the buffer overflows and tail-drops packets, even though the average utilisation looks comfortable. The graph lies by averaging.
Where they come from
Many sources synchronising — a fan-out of responses, a backup kicking off, distributed workers replying at once — converging on one egress port. TCP then reacts to the drops, and throughput suffers in a way that makes no sense from the utilisation graph alone.
Seeing and easing them
You need fine-grained counters or a packet capture to catch them; the output-drop counter on the port is the giveaway. Easing them is a mix of traffic shaping to smooth bursty senders, spreading load across more paths, and right-sizing buffers. Tell us if you suspect microbursts — we can look at the drop counters on our side with you.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base