# ping output

Oct 18th, 2007

Hi,

I hope someone can explain to me the following:

1) based on the ping output below. when min=0ms, max=771ms, how can average=0ms? how are they computed?

2) Could the ping from the PC to the webserver server having round trip time of Maximum = 771ms cause intermittent slowness in network? e.g. user open internet explorer to access to the webpage is intermittently slow?

ping output from PC command prompt

==================================

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Ping statistics for 1.1.1.1:

Packets: Sent = 11178, Received = 11178, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 771ms, Average = 0ms

Control-C

Thanks,

Christina

Overall Rating: 4 (1 ratings)

## Replies

Edison Ortiz Thu, 10/18/2007 - 04:30

The average is the sum of all milliseconds divided by the number of packets sent.

Based on your output, you've sent 11178 packets and let's assume the maximum millisecond occurred only once or twice during the ping process.

If it occurred once, you have 771/11178 = 0ms average. If it occurred twice, you are still averaging 0 (1542/11178)

As for question #2, it depends. When you are constantly pinging a device, that device will place ICMP replies in low priority in order to avoid Denial of Service.

HTH,

neo_christina Thu, 10/18/2007 - 05:01

Hi,

Do you think that the 771ms can be caused by the network or the server or application slowness? or it is only the network?

There are some OutDiscards on the interface when do a "sh int count err" on the router. Any idea what does this means?

Users are complaining accessing to the webpage is intermittently slow asking how to reduce the no of intermittent surges in network response (max 711ms).

Thanks!

Edison Ortiz Fri, 10/19/2007 - 06:41

Have you checked the server's CPU ?

Is the server located in the same IP subnet as the workstation ?

What type of switch are you using ?

Have you checked for speed/duplex mismatches ?

neo_christina Fri, 10/19/2007 - 06:59

1) there are OutDiscards but neligible.

2) server's CPU seems fine. will be reviewing the monitoring agent log on the server.

3) server and workstation are on diff segment. tried to simulate using the same segment, but the intermittent web access slowness was not experienced. hence, do not know if it's ok on the same segment. if both server and pc are on same segment, does it mean that we will need to look into the server and web application instead?

4) cat6500

5) server and switch speed/duplex settings matched

below are the findings.

ethereal trace from PC to server. experience slow/hang for about 9.635539s(logs below)

======================================================================================

187 0.319896 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

188 0.656240 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

189 1.203115 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

190 2.406213 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

191 4.812429 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

192 9.635539 PC.windows.ap.com Server.ap.com TCP 3614 > http [SYN] Seq=0 Len=0 MSS=1260

a lot of TCP CHECKSUM INCORRECT as shown below.

===============================================

3399 > http [ACK] Seq=10291 Ack=7285 Win=64804 [TCP CHECKSUM INCORRECT] Len=0

POST /test_weblink/start.swe HTTP/1.1[Unreassembled Packet [incorrect TCP checksum]]

Edison Ortiz Fri, 10/19/2007 - 10:53

1) What interface is this ? The one connected directly onto the server NIC ?

3) If you are still having problems on the same IP subnet, then it's not a routing issue but a layer2 or layer1 issue.

5) It looks like a MTU issue based on that trace. Packets are being fragmented.

neo_christina Fri, 10/19/2007 - 19:55

1) FastEthernet interface

3) so far, have not encountered the intermittent slowness on the same IP subnet yet.

5) appreciate if you can explain more on the fragmentation part. as my application team mentioned that they are planning to do defragmentation of their tables. perhaps it would help in the intermittent slowness?

Thanks!

Edison Ortiz Fri, 10/19/2007 - 20:01

1)FastEthernet connected to the server ?

3)When the connection is a problem, what kind of remote connection is this ? Over a Wide-Area Network or inter-vlan routing in the same geographic location ?

5)Fragmentation is when a packet is too large to fit in the Maximum Transmission Unit. Ethernet, by default, has the MTU value of 1500. If you are trying to send packets larger than 1500, it will be fragmented causing retransmission.

neo_christina Sat, 10/20/2007 - 04:24

there is also a number of TCP Dup ACK. appreciate if you can share your understanding on this.

Thanks!

neo_christina Fri, 10/19/2007 - 20:27

1) yes

3) LAN. cat6500 provide inter-vlan routing to the same as well as remote office in the same geographic location.

5a) users feedback that it took about 10s to get the web page. based on the ethereal trace,

191 4.812429 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

192 9.635539 PC.windows.ap.com Server.ap.com TCP 3614 > http [SYN] Seq=0 Len=0 MSS=1260

do you think it is related to the http [SYN] after the TCP retransmission.

5b) it seems that incorrect TCP checksum seems ok?

based on your experience, what do u suspect as the cause of the problem? network/firewall, application or server?

Thanks!