Hello.

I need some help with this. I always test ethernet family links(E, Fa, Gi) sending pings with MTU equal to 1500. Since most hosts uses MTU 1500 I think is not necessary to test using a high MTU size like 18024.

What do you think?

Correct. There's very little reason to test with MTU sizes greater than the max on the path.

How about if you test a link with an MTU of 1500 bytes an it has no losses, but with 18000 bytes it has 99% loss?

It could be that packets are process switched?



Source: http://blog.ioshints.info/2007/01/cef-punted-packets.html

I'll occasionally test with packets > 1500 if I have any reason to believe there's a problem with packet fragmentation.

What you describe sounds like a PMTUD issue.

_________________
"The most likely way for the world to be destroyed, most experts agree, is by accident. That's where we come in; we're computer professionals. We cause accidents."
-Nathaniel Borenstein

Realize that if you're pinging that way, it's the local router that is fragmenting the packets.

Thanks for your help.

I think this need a clarification. I was asking about testing links using pings with high packets size, not high MTU. I know what MTU means but I was used to say "high MTU packet" when I really mean "high packet size".

Got a new call from the same client complaining about packet loss using this test:

R1#ping 192.168.2.148 size 18024 re 10000

This test is not accurate unless the max path MTU between the two hosts be 18024, which means that no fragmentation is required.

The problem is that when Cisco routers need to fragment or reassemble fragments, they put the fragments in a buffer of limited size till all fragments arrive. Once all fragments are arrived, the router process the packet. If the amount of fragments in the buffer exceeds a threshold, the router just drops incoming fragments, so we got packet loss. This can be seen with a log like this:


*Mar 1 00:11:15.303: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Ethernet1/0: the fragment table has reached its maximum threshold 16

The Cisco doc says this log message means that max-reassemblies threshold has been reached. I test in a 3660 dynamips router and set the max-reassemblies parameter to 1024. I still got the "the fragment table has reached its maximum threshold 16" message from time to time, altought the threshold was set to 1024 datagrams(?).

By the way, the doc doesn't says how the router handles fragments with the "ip virtual-reassembly" feature disabled. Domestic test shows packet loss with the thing enabled or disabled.

In a production router I have not seen so much packet loss compared with my dynamips test.

It seems my windows machine can handle all those fragments because I got no fragments discards:

C:\PerlProgramms\SnmpTest>netstat -ps IP

IPv4 Statistics

Packets Received = 6300144
Received Header Errors = 0
Received Address Errors = 73786
Datagrams Forwarded = 0
Unknown Protocols Received = 1
Received Packets Discarded = 820
Received Packets Delivered = 7191596
Output Requests = 6586862
Routing Discards = 0
Discarded Output Packets = 32472
Output Packet No Route = 41
Reassembly Required = 26271
Reassembly Successful = 1816
Reassembly Failures = 0<----
Datagrams Successfully Fragmented = 2202
Datagrams Failing Fragmentation = 0<------
Fragments Created = 14675

With Cisco routers the story is very different.

At the end got some reasonably arguments to convince the client.

Source:http://www.cisco.com/en/US/docs/ios/12_3t/12_3t8/feature/guide/gt_vfrag.html

Errata: min path MTU between the two hosts be 18024.

Wendell Odom style.

Is this a ping to or from a windows machine...and to and from what?

Sent from my HTC One X using Tapatalk 2