Source Quench Message 1

[RookThis]

I have an interesting problem that I need assistance with. There is a /24 subnet that returns a source quench message whenever any device on that subnet is pinged via an extended ping from a router. This even occurs from the gateway router of the subnet. If I do an extended ping from a router that traverses a firewall I do not receive the source-quench messages. Has anyone seen this before, and if so, can they explain why this is happening.

From within the same network I see 17% success rate for the pings, from outside the network I see 100% success rate for the pings.

One Network
servers<===>switch<===>Routers<===>firewall<===>Routers<===>switches<===>servers 2nd Network

 

[burtsbees]

Well, your question is confusing...
" There is a /24 subnet that returns a source quench message whenever any device on that subnet is pinged via an extended ping from a router. This even occurs from the gateway router of the subnet."---The subnets are separated by routers, so if you are doing an extended ping from the gateway router of this subnet, then you are not traversing outside the subnet. If you ping from a different router, then you are outside of the subnet.
Are these Cisco routers? Do you have any policy routing or queueing methods in place? Are the buffers too small? Anything in the routers like WRED that may prevent any fragmented, smaller packets that come in massive quantities? Without more info, this is as far as I can go. Please be a bit more specific as to what you are pinging from and to, as well as what kind of devices you have. Also, what device(s) give you the source quench message? Do you only get the messages on extended pings, or do you get a lot of dropped packets (in a Cisco, you can look at the output of "sh int" for dropped packets and runts).

Burt

 

[RookThis]

Thanks for the response.. let me see if I can clarify. This company has two networks segregated network interconnected by a firewall, so Network A and Network B. On network A there are some servers that hand off a 6500 which is layer 2 connected to a 6500 that does the routing for that subnet. If I do an extended ping from any router within Network A, even the router that routes that particular subnet I get the source quench returns. I am seeing some output discards on the that router. The funny thing is that it's only on that particular subnet. If I ping another subnet on that router everything works as expected. Now if I ping that very same server from network B, I always see a success rate of 100%. The path to that server crosses the same servers, so I'm confused why it works. I hope this makes more sense.

 

[RookThis]

I did find these settings in the switch where the servers are connected.

set qos wred 1p2q2t tx queue 1 40:80 70:100
set qos wred 1p2q2t tx queue 2 40:80 70:100

NetworkB#ping ip
Target IP address: X.X.X.X
Repeat count [5]: 1000
Datagram size [100]: 1500
Timeout in seconds [2]:
Extended commands [n]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 1000, 1500-byte ICMP Echos to X.X.X.X, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (1000/1000), round-trip min/avg/max = 8/9/36 ms




NetworkA#ping ip
Target IP address: X.X.X.X
Repeat count [5]: 1000
Datagram size [100]: 1000
Timeout in seconds [2]:
Extended commands [n]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 1000, 1000-byte ICMP Echos to X.X.X.X, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
QQQQQQQQQQQQQQQQQQQQ
Success rate is 25 percent (254/1000), round-trip min/avg/max = 8/8/12 ms

 

[burtsbees]

I have no clue what "two networks segregated network interconnected by a firewall" or "servers that hand off a 6500 which is layer 2 connected to a 6500" mean. Sorry, but you are just going to have to be more clear, including what led you to do the extended ping in the first place. Random Early Detection will do this, as it will forecast bursty traffic and perhaps drop it. Are there any security measures in place in the path of the icmp packets?

Burt

 

[RookThis]

Servers
\
Switch
\
Router
|
Router Doing an extended ping to the server
| from any router on this side of the FW
| results in the source quench
| problem allowing only 17% success rate
|
Firewall
|
|
|
Router Doing the extended ping from this side of
| the FW to the same server, results in
| 100% success rate.
Router I don't understand why this happens.
| Users are complaing about
performance issues but only by users
Router on the other side of the FW.


The path to the server from this side of the firewall still has to go through the routers along the path. Why would I not see the source quench results from this side of the FW?

 

[burtsbees]

Please port a sh run from the switch closest to the servers (I am assuming it is the 6500 with the wred config???)---or, try to remove the wred config lines with the "no" form of the command.

Burt

 

[RookThis]

It is a 6509 and it has these commands on it:

set qos wred 1p2q2t tx queue 1 40:80 70:100
set qos wred 1p2q2t tx queue 2 40:80 70:100

If I do a show qos it states that it's not enabled on this switch.

 

[burtsbees]

Ok---you have already said that...now please post a complete configuration of the 6509. Thank you.

Burt