SRX

 View Only
last person joined: 20 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  Ping from SRX3xx

    Posted 04-12-2024 09:12

    Greetings. We have SRX345 on which I observe the following: when I ping some IP address from it, some replies have high latency:

    64 bytes from a.b.c.d: icmp_seq=48 ttl=55 time=36.534 ms
    64 bytes from a.b.c.d: icmp_seq=49 ttl=55 time=37.352 ms
    64 bytes from a.b.c.d: icmp_seq=50 ttl=55 time=36.389 ms
    64 bytes from a.b.c.d: icmp_seq=51 ttl=55 time=36.381 ms
    64 bytes from a.b.c.d: icmp_seq=52 ttl=55 time=36.242 ms
    64 bytes from a.b.c.d: icmp_seq=53 ttl=55 time=38.165 ms
    64 bytes from a.b.c.d: icmp_seq=54 ttl=55 time=173.321 ms
    64 bytes from a.b.c.d: icmp_seq=55 ttl=55 time=420.768 ms
    64 bytes from a.b.c.d: icmp_seq=56 ttl=55 time=36.484 ms
    64 bytes from a.b.c.d: icmp_seq=57 ttl=55 time=36.370 ms
    64 bytes from a.b.c.d: icmp_seq=58 ttl=55 time=505.974 ms
    64 bytes from a.b.c.d: icmp_seq=59 ttl=55 time=49.361 ms
    64 bytes from a.b.c.d: icmp_seq=60 ttl=55 time=54.231 ms
    64 bytes from a.b.c.d: icmp_seq=61 ttl=55 time=67.610 ms
    64 bytes from a.b.c.d: icmp_seq=62 ttl=55 time=42.658 ms
    64 bytes from a.b.c.d: icmp_seq=63 ttl=55 time=39.336 ms
    64 bytes from a.b.c.d: icmp_seq=64 ttl=55 time=36.727 ms
    64 bytes from a.b.c.d: icmp_seq=65 ttl=55 time=36.971 ms
    64 bytes from a.b.c.d: icmp_seq=66 ttl=55 time=37.266 ms
    64 bytes from a.b.c.d: icmp_seq=67 ttl=55 time=36.591 ms
    64 bytes from a.b.c.d: icmp_seq=68 ttl=55 time=136.710 ms
    64 bytes from a.b.c.d: icmp_seq=69 ttl=55 time=36.456 ms
    64 bytes from a.b.c.d: icmp_seq=70 ttl=55 time=37.808 ms
    64 bytes from a.b.c.d: icmp_seq=71 ttl=55 time=37.275 ms
    64 bytes from a.b.c.d: icmp_seq=72 ttl=55 time=36.530 ms
    64 bytes from a.b.c.d: icmp_seq=73 ttl=55 time=38.975 ms
    64 bytes from a.b.c.d: icmp_seq=74 ttl=55 time=38.718 ms
    64 bytes from a.b.c.d: icmp_seq=75 ttl=55 time=41.931 ms
    64 bytes from a.b.c.d: icmp_seq=76 ttl=55 time=39.002 ms
    64 bytes from a.b.c.d: icmp_seq=77 ttl=55 time=38.702 ms
    64 bytes from a.b.c.d: icmp_seq=78 ttl=55 time=37.269 ms
    64 bytes from a.b.c.d: icmp_seq=79 ttl=55 time=37.984 ms
    64 bytes from a.b.c.d: icmp_seq=80 ttl=55 time=38.999 ms
    ^C
    --- a.b.c.d ping statistics ---
    81 packets transmitted, 81 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 36.187/52.241/505.974/68.458 ms

    But when I ping same IP from machines that behind this SRX, everything is fine:

    64 bytes from a.b.c.d: icmp_seq=60 ttl=55 time=35.1 ms
    64 bytes from a.b.c.d: icmp_seq=61 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=62 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=63 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=64 ttl=55 time=35.4 ms
    64 bytes from a.b.c.d: icmp_seq=65 ttl=55 time=35.1 ms
    64 bytes from a.b.c.d: icmp_seq=66 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=67 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=68 ttl=55 time=35.1 ms
    64 bytes from a.b.c.d: icmp_seq=69 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=70 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=71 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=72 ttl=55 time=35.4 ms
    64 bytes from a.b.c.d: icmp_seq=73 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=74 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=75 ttl=55 time=35.4 ms
    64 bytes from a.b.c.d: icmp_seq=76 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=77 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=78 ttl=55 time=35.1 ms
    64 bytes from a.b.c.d: icmp_seq=79 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=80 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=81 ttl=55 time=35.1 ms
    64 bytes from a.b.c.d: icmp_seq=82 ttl=55 time=35.3 ms
    64 bytes from a.b.c.d: icmp_seq=83 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=84 ttl=55 time=35.2 ms
    64 bytes from a.b.c.d: icmp_seq=85 ttl=55 time=35.5 ms
    ^C
    --- a.b.c.d ping statistics ---
    85 packets transmitted, 85 received, 0% packet loss, time 84103ms
    rtt min/avg/max/mdev = 34.979/35.241/35.562/0.202 ms

    Is this normal? Does it have something to do with the priority of the SRX'es CLI process?



  • 2.  RE: Ping from SRX3xx

    Posted 04-12-2024 09:36

    I have seen the same with a 340, though not that extreme.

    When you ping from a computer, your pings traversing the firewall stay in the packet forwarding engine and get processed as fast as possible. When pinging from the firewall itself, you're involving the routing engine, communication between the RE and the PFE, and in the grand scheme of things, user pings are not that important for the RE. Besides, the routing engine CPU is not that great (just think how much you have to wait for conmits).



    ------------------------------
    Nikolay Semov
    ------------------------------



  • 3.  RE: Ping from SRX3xx

    Posted 04-13-2024 10:05

    I also see this kind of nonsense:

    64 bytes from a.b.c.d: icmp_seq=0 ttl=126 time=38.658 ms
    64 bytes from a.b.c.d: icmp_seq=1 ttl=126 time=37.179 ms
    64 bytes from a.b.c.d: icmp_seq=2 ttl=126 time=36.111 ms
    64 bytes from a.b.c.d: icmp_seq=3 ttl=126 time=35.122 ms
    64 bytes from a.b.c.d: icmp_seq=4 ttl=126 time=34.282 ms
    64 bytes from a.b.c.d: icmp_seq=5 ttl=126 time=33.197 ms
    64 bytes from a.b.c.d: icmp_seq=6 ttl=126 time=32.178 ms
    64 bytes from a.b.c.d: icmp_seq=7 ttl=126 time=32.130 ms
    64 bytes from a.b.c.d: icmp_seq=8 ttl=126 time=41.201 ms
    64 bytes from a.b.c.d: icmp_seq=9 ttl=126 time=40.100 ms
    64 bytes from a.b.c.d: icmp_seq=10 ttl=126 time=39.142 ms
    64 bytes from a.b.c.d: icmp_seq=11 ttl=126 time=38.003 ms
    64 bytes from a.b.c.d: icmp_seq=12 ttl=126 time=38.140 ms
    64 bytes from a.b.c.d: icmp_seq=13 ttl=126 time=37.151 ms
    64 bytes from a.b.c.d: icmp_seq=14 ttl=126 time=36.157 ms
    64 bytes from a.b.c.d: icmp_seq=15 ttl=126 time=35.112 ms
    64 bytes from a.b.c.d: icmp_seq=16 ttl=126 time=34.137 ms
    64 bytes from a.b.c.d: icmp_seq=17 ttl=126 time=35.106 ms
    64 bytes from a.b.c.d: icmp_seq=18 ttl=126 time=34.139 ms
    64 bytes from a.b.c.d: icmp_seq=19 ttl=126 time=43.137 ms
    64 bytes from a.b.c.d: icmp_seq=20 ttl=126 time=32.192 ms
    64 bytes from a.b.c.d: icmp_seq=21 ttl=126 time=31.134 ms
    64 bytes from a.b.c.d: icmp_seq=22 ttl=126 time=40.005 ms

    I didn't copy-paste enough pings, but yes, there are also random spikes.

    Cycling between 31 and 40 with many consecutive pings being almost exactly 1 ms off from the last -- suspicious... Just for fun, I like to speculate that the routing engine, or at least the part that's handling ICMP replies, has some sort of a poll-driven mechanism (as opposed to interrupt-driven) that checks for incoming packets every so often but only if it's not busy with something else.



    ------------------------------
    Nikolay Semov
    ------------------------------