Routing Issue- Strange Ping Outputs

[skk391]

Hi all,

I think I have a routing problem, can someone take a look at my config please,

I have two parts to my network

1) 172.16.0.x
2) 10.1.1.x

I have a router connecting the networks together.

If I telnet from 10.1.1.x to the router on 10.1.1.28 and send ping around I can get to the router on that interface and ping various servers on the 172.16.0.x range. I have a few clients which obtain their IP address from the router range still belong to the 172.16.0.x range with a default gateway of 172.16.0.1 ( the IP address of the interface that the router is connected to ) When I try to ping these machines I get a strange output, The router randomly drops pings!

I haven't really got any routing statements going on because the router is connected to the subnet in question

My config



router#
router#
router#
router#show config
Using 2072 out of 29688 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
!
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
ip subnet-zero
ip cef
!
!
ip domain lookup source-interface FastEthernet0/1
ip domain name
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip host
ip name-server
ip name-server
ip dhcp excluded-address 172.16.0.1 172.16.0.30
!
ip dhcp pool VOIP
network 172.16.0.0 255.255.255.0
default-router 172.16.0.1
dns-server 10.1.1.12
option 242 ascii "172.16.0.2,MCPORT=1719,HTTPSRVR=172.16.0.2,VLANTEST=1"
option 176 ascii "MCIPADD=172.16.0.2,MCPORT=1719,TFTPSRVR=172.16.0.2,HTTPSRVR=172.16.0.2,VLANTEST=1"
domain-name
lease 14
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0

ip address 172.16.0.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1

ip address 10.1.1.28 255.255.255.0
duplex auto
speed auto
!
ip http server
ip classless
ip route 172.16.0.10 255.255.255.255 FastEthernet0/0
!
!

snmp-server community public RW
snmp-server enable traps tty
!
!
!
!
!
!
line con 0
password
line aux 0
line vty 0 4
password
no login
!
!


THE STRANGE PINGS!!!!!!!

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.58, timeout is 2 seconds:
!!!.!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
router#ping 172.16.0.58

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.58, timeout is 2 seconds:
!!!.!

 

[Viconsul]

Hi

I would check the switch port settings connecting the router as well as that of the host you are pinging for any mismatch.

HTH

-Viconsul

 

[skk391]

Thanks. What sort of mismatch am I looking for? I will check this tomorrow

 

[Viconsul]

Hi

Speed and duplex mismatch and a show interface of the switchports may reveal additional errors.

-Viconsul

 

[skk391]

The switches on the 172.16.x are non Cisco switches. Will check the routers interfaces first. I might swap out the non Cisco switches for Cisco very soon. I'll post my finding back here tomorrow

 

[skk391]

Quick question.this wouldn't be a routing issue would it because the two IP address ranges/ networks are physically connected to the router on its interface ports???

 

[Viconsul]

Also, I have always been an advocate of fixed speed and duplex setting where possible, rather than auto.
...Just a thought.

-Viconsul

 

[Viconsul]

This is not a routing issue, atleast not with the local router.

 

[skk391]

Thanks. Will post my finding tomorrow

 

[VinceWhirlwind]

Also, I have always been an advocate of fixed speed and duplex setting where possible, rather than auto."

This is the attitude that causes 99% of duplex mismatch configuration errors on networks today.

auto works, use it.

 

[Viconsul]

This is the attitude that keeps my network running, especially when you have administrative control of either end of the connection.
Yes auto does work, but there are cases when fixed settings work better.

-Viconsul

 

[skk391]

Hi all,

I've posted the show interface output below.

I've noticed the following.

I connect to the router using telnet 10.1.1.28 then ping anything on the 10.1.1.x range and the ping returns back correctly .......

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

I then ping anything on the 172.16.0.x where the default gateway of the client is set to 172.16.0.1. The address of the router on this network i.e. fa 0/0


router#ping 172.16.0.58

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.58, timeout is 2 seconds:
!!!.!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms

If I then ping something on the 172.16.0.x range but with a default gateway of 10.1.1.28, so for example
Ip address 172.16.0.158
Subnet 255.255.255.0
Default gateway 10.1.1.28

It pings correctly......

router#ping 172.16.0.158

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.158, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms


The output
FastEthernet0/1 is up, line protocol is up
Hardware is AmdFE, address is 0012.80e5.44a1 (bia 0012.80e5.44a1)
Description: Connection to 10.1.1.x
Internet address is 10.1.1.28/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/58/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 135000 bits/sec, 27 packets/sec
5 minute output rate 84000 bits/sec, 47 packets/sec
1017374384 packets input, 1092083882 bytes
Received 145607589 broadcasts, 0 runts, 0 giants, 0 throttles
237 input errors, 0 CRC, 0 frame, 116 overrun, 121 ignored
0 watchdog
0 input packets with dribble condition detected
949071417 packets output, 1087608973 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 babbles, 0 late collision, 0 deferred
1 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

--------------------------------------------------------------------------------------------------

router#show int fa 0/0
FastEthernet0/0 is up, line protocol is up
Hardware is AmdFE, address is 0012.80e5.44a0 (bia 0012.80e5.44a0)
Description: Interface to the VOIP network
Internet address is 172.16.0.1/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 89000 bits/sec, 49 packets/sec
5 minute output rate 200000 bits/sec, 10 packets/sec
961189368 packets input, 358648681 bytes
Received 23559980 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
815098634 packets output, 1487863340 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 babbles, 0 late collision, 0 deferred
18 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

 

[Viconsul]

I don't understand why your default gateway would be as below instead of fa0/0 ip?

Ip address 172.16.0.158
Subnet 255.255.255.0
Default gateway 10.1.1.28

Also, fa0/1 seems to have some input errors which may or may not be recent, again check speed and duplex mismatch.

FastEthernet0/1 is up, line protocol is up
Hardware is AmdFE, address is 0012.80e5.44a1 (bia 0012.80e5.44a1)
Description: Connection to 10.1.1.x
Internet address is 10.1.1.28/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/58/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 135000 bits/sec, 27 packets/sec
5 minute output rate 84000 bits/sec, 47 packets/sec
1017374384 packets input, 1092083882 bytes
Received 145607589 broadcasts, 0 runts, 0 giants, 0 throttles
237 input errors, 0 CRC, 0 frame, 116 overrun, 121 ignored
0 watchdog
0 input packets with dribble condition detected
949071417 packets output, 1087608973 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 babbles, 0 late collision, 0 deferred
1 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

Then, the following is redundant in your config.

ip route 172.16.0.10 255.255.255.255 FastEthernet0/0

 

[VinceWhirlwind]

fa0/1 is running at 100 full.
If there were a duplex mismatch, it would be the other end running at Half. If the other end were running at Half, at this end he would be seeing CRCs, not input errors.
Also, with 1017374384 packets input and 237 input errors, it looks like something to be slightly interested in, but doesn't look like a high priority issue, unless those input errors have just started and are now accumulating rapidly.

Additionally, your advice on not using the IEEE standard auto-negotiation is very poor.
As I said before, by far and away the most common cause of duplex mismatches is people disabling auto-neg.
Plus, the standard for Gig ethernet is to use Auto, because it sets the clocking.
So either you are disabling Auto on 100Mb interfaces and enabling it on Gb interfaces, which is horrible configuration mess, or you are disabling Auto on Gb interfaces which is a flat-out misconfiguration that has the potential to break your network through bad clocking.

 

[VinceWhirlwind]

OP, can you do an extended ping?
5 pings isn't enough to see a pattern.
If you do 100 pings, it would be interesting, for example, if it was a regular drop of every 4th ping.

Based on how very simple your config is, I'd be looking for a hardware issue, so I'd be making sure I was pinging different devices on the questionable IP range.

Also, do a show CPU % (or better yet, use your network monitoring tool to give you the most granular possible view of CPU % history) to see if the router is just being lazy with ICMP because it has better things to do. Probably not, but rule it out.

I don't really understand what this means:
"If I then ping something on the 172.16.0.x range but with a default gateway of 10.1.1.28, so for example
Ip address 172.16.0.158
Subnet 255.255.255.0
Default gateway 10.1.1.28"

What kind of device is that that you are pinging? How on earth do you expect it to find 10.1.1.28 at Layer2 when it is on a different network? Have you somehow got these two networks bridged somewhere through a different device?

 

[skk391]

Cool. I will carry out the extended pings tomorrow and post back. The devices I'm ping are all windows based PCs. Yeah, not sure how the PCs would reach 10.1.1.28, but was just testing it and was surprised on how I was get it to ping correct with that config.

Happy to carry out any testing... I have machines on the network with dual cards. So one NIC on the 10.1.1x and another on the 172.16.0.x range, so that could be the bridge.

 

[VinceWhirlwind]

OK, so you need to a
show ip route
on the router as well as a
route print (or whatever the command is these days)
on the Windows PCs (both Source and Destination PCs) for your bad ping test.

I've always found servers with multiple NICs on different networks horribly confusing - a recent network I was cleaning up had about a dozen servers on it that were in multiple networks, and many other devices on the network were using one or other of the servers as their default gateway. So each server was acting as a router, but only for some hosts. This led to some weird asymmetric routing and lots of other weird stuff.
First step is to identify all your DHCP-addressed hosts and check all the DHCP scopes to make sure the router address being served is the correct Real Router IP address for that subnet.
Second step is to check every single host for statically-assigned routes and get rid of them intelligently by either just deleting them or copying them to the Real Router and then deleting them
Next step is to identify all the statically-addressed hosts and do the above two steps for each of them one by one.
Final step after all that is done, you can clean up the hosts that have multiple NICs in different subnets.