05-28-2007 06:24 AM - edited 03-03-2019 05:10 PM
Hello everyone,
We have a monitoring tool here which indicated that one of our routers was experiencing high ping responses.
This router is connected to a router at a seperate office via a T1.
What is the best method of troubelshooting this issue? The ISP has been contacted, the line was brough down and tested and the results we're positive with no issues.
Router 1 = the router which was giving ping issues
Router 2 - router on the other end.
Router 1:
last clearing of counters: 0:28:01
27 input errors
19 crc
1 abort
router 2
last clearing of show interface: 00:29:11
4 input errors
1 crc
3 frame
router 2 had the following issues before the counter was reset:
last clearing of show interface counters 7w2d
14235 input errors
6428 crc
547 aborts
277 interface resets
Does anyone see any issues here? How can you determine what is causing the errors?
Thanks
05-28-2007 06:55 AM
Hi,
Ask the carrier to execute a BERT test for at least 2hr, and be try to be present to observe the results with your own eyes. That might have not be done and they just executed a "continuity" test.
Then with a succession of loopbacks hopefully they can get to trace the faulty portion. It may even be the local cabling.
05-28-2007 11:10 AM
Thanks, I can try that.
When you refer to the cabling, are you referring to the csu.dsu cabling? Do you think the prelude csu/dsu box can be at fault as well and possibly need a replacement? I don't see any errors on the box itself.
Is there anything which I can do locally to try and test and diagnose...
Thanks
05-28-2007 01:53 PM
Hi,
yes also dsu/csu cabling should be checked and redone as necessary. What you can do to test are various types of loopback, what router interface do you have ?
05-30-2007 05:10 AM
Thanks,
How do I perform the loopback tests?
What do you mean by the type of router interface? Are you referring to the model? It's a cisco 2500.
05-30-2007 06:12 AM
Hi,
You have basically two choice to make BER test.
1. Put a hardware loopback on the DTU port.
2. Ask telco to put a software loopback on the DTU
The only question is in which direction do you want to make the testing.
In respect to the interface type it is most probably X.21, V.35 RS-232
You can easily identify it by inspőecting your cable.
If you want to do the loopback test you have to have BER tester to be connected to the DTU. This device is sending bit stream on the transmit and hears on the receive and if the sent and received bits are the same then there are no error. If you haven't this kind of box let's ask the telco to ride to your site and make the test from your end (in this case the loopback should be set on the other end of the circuit).
Hope it clears,
Krisztian
05-31-2007 05:09 AM
Thanks a lot for the response. We're running a V.35 cable here. I may have to contact them back then b/c we don't have the hardware to do the BER testing.
We had the same issue last night. It's usually at a specific time in the morning when no traffic is traversing (or shouldn't be)
I may have to setup a syslog server to determine the packet flow at that time.
Does anyone know if a syslog server can be setup on a windows machine, or does it have to be setup on a linux/unix box? Anyone have any links or instructions on the setup of a syslog server?
Thank again
05-31-2007 05:18 AM
You can setup a syslog on windows. Try this kiwi's sylog daemon. it is free up to 5 clients
05-31-2007 03:23 PM
I agree with others about the hard loop. Often times, the carrier will loop to the NIU, and depending on your scenario, will leave an extended demarc untested.
Based on what I've read, and since this looks like a p2p, I would suggest looking at the clocking on the controller. You would need to check with the SP, but from my experience clocking isn't provided on a p2p. You'll need one controller set as line/network, and one as internal.
I've seen quite a few crc/frame error problems resolved with clocking.
05-31-2007 04:55 PM
[edited - pls ignore]
06-01-2007 05:32 AM
Thanks a lot everyone, I will look in to the loopbacks.
I setup the syslog server (kiwi). It doesn't log anything though. All it logs are the changes that I did on the router (informational changes). Doesen't log traffic, etc. I witnessed syslogs from a pix firewall to a linux box and it displayed much more. Is it just the application or am I doing something wrong? I setup the kiwi syslog daemon and issued logging 10.1.1.1. The logs went over to the server but only 2 from the changes I did.
Any ideas?
Thanks
06-01-2007 05:37 AM
have you tried the debug command for the relevent info you need ?
06-01-2007 05:55 AM
HI,
If you want to log interface counters than use snmp instead of syslog. Syslog will send message related to the interface state change (up/down) but nothing about the traffic.
Hope it helps,
Krisztian
06-01-2007 06:07 AM
If you want to do do logging based on IP connections try NTOP on windows. It will give you lot of packet wise Graphs & reports.
Its free
06-01-2007 09:14 AM
Thanks a lot everyone
I got a bit confused b/c I witnessed Syslog enalbed on a Pix Firewall and it obtained all of the traffic. Maybe it's different for routers...
I can look in to the snmp and NTOP. For snmp, is there any application or programs you recommend to sniff the traffic?
Basically my goal is to monitor what is traversing on the line, what type of traffic is passing through this specific router, etc
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: