PING Times Very Strange

[rmmagow]

Solaris 8 on a 450 server, single NIC, no routing, all static as follows:

IP address of machine is 10.224.2.21/24
Gateway is 10.224.21.1

Route table:
10.224.2.0 gw 10.224.2.21 flag U Ref 3 Use xxx I/f HME0
224.0.0.0 gw 10.224.2.21 same
default gw 10.224.2.1 flag UG Ref big number I/F is blank
127.0.0.1 gw 127.0.0.1 flag UH ref big number I/F is lo0

I enter a command ping -s 172.31.196.1 looks like this:

64 bytes from 172.31.196.1: icmp_seq=0. time=0. ms
64 bytes from 172.31.196.1: icmp_seq=1. time=6020. ms
64 bytes from 172.31.196.1: icmp_seq=2. time=4992. ms
64 bytes from 172.31.196.1: icmp_seq=3. time=4000. ms
64 bytes from 172.31.196.1: icmp_seq=4. time=3000. ms
64 bytes from 172.31.196.1: icmp_seq=5. time=2000. ms
64 bytes from 172.31.196.1: icmp_seq=6. time=1000. ms
64 bytes from 172.31.196.1: icmp_seq=7. time=1. ms
64 bytes from 172.31.196.1: icmp_seq=8. time=0. ms
64 bytes from 172.31.196.1: icmp_seq=9. time=1. ms
64 bytes from 172.31.196.1: icmp_seq=10. time=1. ms

This happens with other addresses like 172.31.198.1 etc.

These 172 addresses are on the same box as the 10.224.2.1 interface, the box being my big central router. What gives here? The ping should be 0 to 1 ms all the time. If I do a second ping -s to the same 172.31.196.1 I/F it will run like that, quickly. It will revert back to weird behavior after a while (arp time-out I'm guessing). I'm lost and can't explain what's going on. The machine at 10.224.2.21 is my network management system and this is confusing the heck out of it. Traceroute does not indicate wierd routing behavior. Thanks

 

[jimbopalmer]

I am hoping the gateway is 10.224.2.1 and the 21 is a typo.

is there a way to ask the router it's CPU utilization?
I tried to remain child-like, all I acheived was childish.

 

[rmmagow]

The route table example here is right from netstat -rn and that's what it's reading. Machine's IP 10.224.2.21, it's default gateway is 10.224.2.1. The router utilization is around 30%. This behavior occurs even at night when the router is barely chugging along. I also tried to ping address 172.31.198.35, another router hanging off the 172.31.198.1 interface. It behaved the same way, one quick ping a few slow ones, then steady times after that. Got me pretty confused and I've been working with this stuff for a long time. I may try moving the box to a different network inside to see how it reacts. Thanks.

 

[bluedevils]

gateways are supposed to be on the same network as the server's NIC

 

[rmmagow]

OOPS, sorry jimbopalmer and bluedevils, that was a typo, the machine is 10.224.2.21, GW 10.224.2.1 same network w/class c mask.

 

[bluedevils]

what does traceroute show? Do a few to see how consistant it is

 

[rmmagow]

Traceroute to 172.31.196.1 always shows just a single hop to 10.224.2.1 as it should since 10.224.2.1 and 172.31.196.1 both are I/F addresses on my big Nortel router, the central BCN box.

 

[bluedevils]

Doh! I missed that one....

 

[youdaman]

I have seen this problem before. If you are using copper cables(100MPS-10MPS) then I would try another cable. When we had the problem, it was due to very dirty fiber. If you were to ping at higher packets sizes, you most likely will start to see packets drop. On my particular problem, the pings at default size of 64 bytes would should large times. Then when you ping -s xxx.xxx.xxx.xxx 800, it will start to drop packets. Hope this helps.

 

[youdaman]

Sorry but I didn't enter our final solution. We polished the fibers from -29 on the OTDR down to -18. Then we could ping at over 1500 bytes with no drop packets and the times near 0 ms.

 

[rmmagow]

I re-patched the machine with new cabling, it's copper. Prior to that I tried the big packet pings but nothing dropped, ping'd at 1450 bytes. The SUN box is patched into the network via an oddly defined VLAN in a layer 2 switch. I tried moving the patch cord to the central layer 3 switch on the same VLAN, didn't change anything. The VLAN really doesn't have to be defined in the layer 3 switch since the layer 2 switch connects directly to the central router. There are some confusing connections back there w/regards redundancy that I am going to examine. BUT, I have another machine on the same vlan at IP ADDRESS 10.224.2.25, it is an W2K machine. When I ping (-t) to 172.31.198.1 or 196.1 etc etc the pings run immediately, no funny times, no jumping around. The SUN station, an ES450, indicates it is connected at 100 meg via the green light on the switch. Deeply confused by this.

 

[youdaman]

if you type ifconfig -a as root on the Unix box, does it show a correct mask for the interface you are using? Also, how is the switch set up. Full/Half etc.....

 

[rmmagow]

Fundamental screw-up, it' Solaris 7, not 8. I nailed the switch to 100 meg full, made entries in /etc/system to force 100 meg full on the card. No change. i'm going to move the machine to a different VLAN , one that resides only in the core switch. The 10.224.2 network I'm using exists in the core switch AND in the core router, the core router being the gateway address. A different VLAN, say 10.224.40.0/24 exists only in the core switch, the gateway of 10.224.40.1 for this VLAN is a VRRP address in the core switch. The central router sees these as summarized addresses via OSPF. Next step is an upgrade to Solaris 8. I'm trying to scoff an Ultra 10 w/Solaris 7 to see how it behaves on the 10.224.2 segment. netstat -I was showing some gradual increase in errors/collisions prior to the hard-code to 100 meg, it's clean now but still the odd behavior exists. Thanks.

 

[cfsalmeida]

if odd behavior continues it's could be a DNS problem ... maybe packets 2 to 6 are slow due to DNS resolution then DNS timeout and return to normal times try ping an address that are in /etc/hosts (assuming /etc/nsswitch as hosts: files dns), if a host in /etc/hosts is okay then you have a DNS problem.

Kind Regards,

Carlos Almeida,