cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1181
Views
4
Helpful
9
Replies

ping output

neo_christina
Level 1
Level 1

Hi,

I hope someone can explain to me the following:

1) based on the ping output below. when min=0ms, max=771ms, how can average=0ms? how are they computed?

2) Could the ping from the PC to the webserver server having round trip time of Maximum = 771ms cause intermittent slowness in network? e.g. user open internet explorer to access to the webpage is intermittently slow?

ping output from PC command prompt

==================================

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Reply from 1.1.1.1: bytes=32 time<1ms TTL=126

Ping statistics for 1.1.1.1:

Packets: Sent = 11178, Received = 11178, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 771ms, Average = 0ms

Control-C

Thanks,

Christina

9 Replies 9

Edison Ortiz
Hall of Fame
Hall of Fame

The average is the sum of all milliseconds divided by the number of packets sent.

Based on your output, you've sent 11178 packets and let's assume the maximum millisecond occurred only once or twice during the ping process.

If it occurred once, you have 771/11178 = 0ms average. If it occurred twice, you are still averaging 0 (1542/11178)

As for question #2, it depends. When you are constantly pinging a device, that device will place ICMP replies in low priority in order to avoid Denial of Service.

HTH,

Hi,

Thanks for your explanation.

Do you think that the 771ms can be caused by the network or the server or application slowness? or it is only the network?

There are some OutDiscards on the interface when do a "sh int count err" on the router. Any idea what does this means?

Users are complaining accessing to the webpage is intermittently slow asking how to reduce the no of intermittent surges in network response (max 711ms).

Thanks!

Are the OutDiscards incrementing ?

Have you checked the server's CPU ?

Is the server located in the same IP subnet as the workstation ?

What type of switch are you using ?

Have you checked for speed/duplex mismatches ?

1) there are OutDiscards but neligible.

2) server's CPU seems fine. will be reviewing the monitoring agent log on the server.

3) server and workstation are on diff segment. tried to simulate using the same segment, but the intermittent web access slowness was not experienced. hence, do not know if it's ok on the same segment. if both server and pc are on same segment, does it mean that we will need to look into the server and web application instead?

4) cat6500

5) server and switch speed/duplex settings matched

below are the findings.

ethereal trace from PC to server. experience slow/hang for about 9.635539s(logs below)

======================================================================================

187 0.319896 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

188 0.656240 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

189 1.203115 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

190 2.406213 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

191 4.812429 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

192 9.635539 PC.windows.ap.com Server.ap.com TCP 3614 > http [SYN] Seq=0 Len=0 MSS=1260

a lot of TCP CHECKSUM INCORRECT as shown below.

===============================================

3399 > http [ACK] Seq=10291 Ack=7285 Win=64804 [TCP CHECKSUM INCORRECT] Len=0

POST /test_weblink/start.swe HTTP/1.1[Unreassembled Packet [incorrect TCP checksum]]

1) What interface is this ? The one connected directly onto the server NIC ?

3) If you are still having problems on the same IP subnet, then it's not a routing issue but a layer2 or layer1 issue.

5) It looks like a MTU issue based on that trace. Packets are being fragmented.

1) FastEthernet interface

3) so far, have not encountered the intermittent slowness on the same IP subnet yet.

5) appreciate if you can explain more on the fragmentation part. as my application team mentioned that they are planning to do defragmentation of their tables. perhaps it would help in the intermittent slowness?

Thanks!

1)FastEthernet connected to the server ?

3)When the connection is a problem, what kind of remote connection is this ? Over a Wide-Area Network or inter-vlan routing in the same geographic location ?

5)Fragmentation is when a packet is too large to fit in the Maximum Transmission Unit. Ethernet, by default, has the MTU value of 1500. If you are trying to send packets larger than 1500, it will be fragmented causing retransmission.

there is also a number of TCP Dup ACK. appreciate if you can share your understanding on this.

Thanks!

1) yes

3) LAN. cat6500 provide inter-vlan routing to the same as well as remote office in the same geographic location.

5a) users feedback that it took about 10s to get the web page. based on the ethereal trace,

191 4.812429 PC.windows.ap.com Server.ap.com TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

192 9.635539 PC.windows.ap.com Server.ap.com TCP 3614 > http [SYN] Seq=0 Len=0 MSS=1260

do you think it is related to the http [SYN] after the TCP retransmission.

5b) it seems that incorrect TCP checksum seems ok?

based on your experience, what do u suspect as the cause of the problem? network/firewall, application or server?

Thanks!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco