Junos OS

HI,all,

There is an issue on my network.The R2(address is 12.1.1.2) ping the R1(address is 12.1.1.1),any I found some packets drop ,as:

juniper@R2> ping 12.1.1.1 size 10000 rapid count 20    

PING 12.1.1.1 (12.1.1.1): 10000 data bytes

.!!!!!.!!!!.!!!!!!!.

--- 12.1.1.1 ping statistics ---20 packets transmitted, 16 packets received, 20% packet loss

round-trip min/avg/max/stddev = 8.638/9.373/11.048/0.736 ms

However,I use the ping pool without the key word "rapid",it seem to be well.Anything wrong with my router?

thank you.

Attachment(s)

PING R2.txt   2 KB 1 version

Hello there,

Please provide the following details:

1/ router hardware model

2/ JUNOS version

3/ network diagram

4/ path taken by traffic.

Also, have you changed the default ICMPv4 rate-limit on the router

http://www.juniper.net/techpubs/en_US/junos10.4/topics/reference/configuration-statement/icmpv4-rate-limit-edit-system.html

HTH

Rgds

Alex

Hi,aarseniev,

Thank you for your response,for point 1 to point 3,you can see the files which I uploaded.The last point,I am not understand the meaning.

Thank you.

Attachment(s)

info-R2.txt   7 KB 1 version

info-R1.txt   8 KB 1 version

Hello,

Thanks for sharing this information.

Please also post the following printout from both R1 and R2 routers _before_ and _after_ You run Your ping:

show system statistics

 http://www.juniper.net/techpubs/en_US/junos/topics/reference/command-summary/show-system-statistics.html

 I am especially interested in these values:

        0 fragments received
        0 fragments dropped (dup or out of space)
        0 fragments dropped (queue overflow)
        0 fragments dropped after timeout
        0 fragments dropped due to over limit
        0 packets reassembled ok

 and these

        0 drops due to rate limit
        0 calls to icmp_error
        0 errors not generated because old message was icmp
        Output histogram:
                echo reply: 75
        0 messages with bad code fields
        0 messages less than the minimum length
        0 messages with bad checksum
        0 messages with bad source address
        0 messages with bad length
        0 echo drops with broadcast or multicast destination address
        0 timestamp drops with broadcast or multicast destination address
        Input histogram:
                echo: 75
                router advertisement: 130
        75 message responses generated

 HTH

Regards

Alex 

Hi all,

good sugestions from Alex, but I can't stop asking basic question: don't you have firewall filter/policer to protect RE ? You are using 'ping rapid' with big IP packets, so the packet rate is quite big.

jtb

Hi,aarseniev,

Thank you for your response,the info on R1 as:

        73 packets reassembled ok       

0 packets reassembled ok       

93 packets reassembled ok       

0 packets reassembled ok       

0 fragments dropped (dup or out of space)     

  0 fragments dropped (queue overflow)       

5 fragments dropped after timeout       

0 fragments dropped due to over limit       

0 fragments dropped (dup or out of space)       

0 fragments dropped after timeout       

0 fragments dropped       

0 fragments dropped       

0 fragments dropped (dup or out of space)       

0 fragments dropped (queue overflow)       

5 fragments dropped after timeout       

0 fragments dropped due to over limit     

  0 fragments dropped (dup or out of space)     

  0 fragments dropped after timeout       

0 fragments dropped     

  0 fragments dropped     

  Output histogram:           

    echo reply: 73         

Output histogram:     

          echo reply: 93

The more detail,you can see the log which I uploaded,thank you.

Attachment(s)

R2.txt   49 KB 1 version

R1.TXT   47 KB 1 version

Hi Zhoukangle,

It looks like you are running into the ICMP rate-limiter.. I notice you are pinging between routers, which on Juniper devices is not a good test; ICMP is rate-limited to prevent 'starving' the Re-PFE links (on M/t/MX) or the CPU (on small srxs).

> However,I use the ping pool without the key word "rapid",it seem to be well.

If the point above is correct , i.e. if you can send 10000 ping without 'rapid', or with a reasonable interval (try using the 'interval'  keyword), then you have no reason to be afraid - it is just the router dropping a few ICMP fragments due to rate limiting.

A better test would be to ping through the router, between hosts. Can you try this, and let us know?

Also,on some platforms, you can use 'show pfe statistics traffic' to check for software discards.

The output should be similar to the one below:

Packet Forwarding Engine local traffic statistics:
    Local packets input                 :             18994003
    Local packets output                :             14998371
    Software input control plane drops  :                    0
    Software input high drops           :                    0
    Software input medium drops         :                    3   <<<< These are 3 drops due to high traffic rate to the RE.
    Software input low drops            :                    0
    Software output drops               :                    0
    Hardware input drops                :                    0

I hope it helps,

 Saverio

HI,Saverio,

I ping the router without rapid,it will be OK,thank you.

Hi Zhoukangle

Your problem may be occur to firewall. You can remove some policies in firewall and try again.

I think that I will be OK.

Thanks.

Your are sending 10,000B packets.  What is the MTU set at?  If it is at 1500B then that is quite a bit of fragmentation..

Hi,jwparks,

Thank you for your response.The MTU by default value,thank you.

Looking over the information you posted, this seems to only be a problem with 10,000B packets - which must be broken into 7 distinct fragments.  It looks like the pings up to 5,000B packets are fine - which is still over the standard 1500B MTU.  Try seting the interface mtu to 9192 to see if that helps by reducing the fragmentation.

The real question I have is why use 10,000B pings (7x larger than the standard ethernet frame)?

Hi,jwparks,

Thank you for your response,following you information,I set the MTU 9192,the result as:

juniper@R2> ping 12.1.1.1 rapid size 10000    

PING 12.1.1.1 (12.1.1.1): 10000 data bytes

.....

--- 12.1.1.1 ping statistics ---

5 packets transmitted, 0 packets received, 100% packet loss
juniper@R2> 

The more detail,you can see the log which I uploaded,thank you.

(Why I must use 1500bytes?the answer is :this is the testing which my client ask for,thank you)

Attachment(s)

R1.txt   1 KB 1 version

R2.txt   496 B 1 version