where does the slowness comes from?

wuh · ‎02-18-2009

A subnet on one of our sites has two printers: P1 x.x.x.10 and P2 x.x.x.11. They are on the same access switch. The site connects to our HQ through 100M and giga link.

When I (in HQ) ping p1 average RTT=7ms, P2 =1ms.

Tracert to both shows the paths for the 2 are the same.

pathping to both show that only the last hop has time different p1 is 7ms and p2 1ms.

But when I ping from the second last hop which is router there to both printers, it is all 1ms.

How so? can anyone help me find where it causes the slower response?

thanks,

Han

b.julin · ‎02-18-2009

Do you have any queueing or policing? What type of policies are applied?

Do you have any etherchannel bundles?

wuh · ‎02-18-2009

Brian:

Thanks! As the policing, i think it wont make any difference.

Interesting to know the etherchannel bundle can affect it. please elaborate in what way it can.

thanks,

han

b.julin · ‎02-18-2009

The etherchannel bundles divide up traffic based on a hash calculated using the source and/or destination MAC addresses and in some cases IP addresses can even be snooped from L3. This is to prevent packet reordering, by keeping all packets from one conversation in the same interface queue.

That means if you have one particular pair of hosts that use a lot of traffic, they may soak one of the links, and any other conversations on that link will experience queueing delay.

hobbe · ‎02-20-2009

It could be that there are two different softwares on the printers.

since you are pinging and it sounds like you are going through a router and there could be differences in how the printers interpret the default gateway and so on.

The easiest way to solve this little mystery is to monitor the slow printers switchport and set a packetsniffer (wireshark) and look in the timings there while pinging it. Then you know if it is the printer that is slow to respond to the pings or if it is something in the network.

if it is something in the network just keep mooving the packet sniffer towards you step by step and you will find the source of the delay.

wuh · ‎02-22-2009

Hobbe:

I've caught a pair of ping/reply but not fully understand and detect. Can you take a look?

Thanks,

Han

Frame 3 (74 bytes on wire, 74 bytes captured)

Arrival Time: Feb 22, 2009 09:20:29.450845000

[Time delta from previous captured frame: 0.045376000 seconds]

[Time delta from previous displayed frame: 0.045387000 seconds]

[Time since reference or first frame: 0.045387000 seconds]

Frame Number: 3

Frame Length: 74 bytes

Capture Length: 74 bytes

[Frame is marked: False]

[Protocols in frame: eth:ip:icmp:data]

[Coloring Rule Name: ICMP]

[Coloring Rule String: icmp]

Ethernet II, Src: Dell_48:fa:06 (00:14:22:48:fa:06), Dst: All-HSRP-routers_17 (00:00:0c:07:ac:17)

Destination: All-HSRP-routers_17 (00:00:0c:07:ac:17)

Address: All-HSRP-routers_17 (00:00:0c:07:ac:17)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: Dell_48:fa:06 (00:14:22:48:fa:06)

Address: Dell_48:fa:06 (00:14:22:48:fa:06)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: IP (0x0800)

Internet Protocol, Src: 172.24.223.73 (172.24.223.73), Dst: 172.17.85.16 (172.17.85.16)

Internet Control Message Protocol

No. Time Source Destination Protocol Info

4 0.054114 172.17.85.16 172.24.223.73 ICMP Echo (ping) reply

Frame 4 (74 bytes on wire, 74 bytes captured)

Arrival Time: Feb 22, 2009 09:20:29.459572000

[Time delta from previous captured frame: 0.008727000 seconds]

[Time delta from previous displayed frame: 0.008727000 seconds]

[Time since reference or first frame: 0.054114000 seconds]

Frame Number: 4

Frame Length: 74 bytes

Capture Length: 74 bytes

[Frame is marked: False]

[Protocols in frame: eth:ip:icmp:data]

[Coloring Rule Name: ICMP]

[Coloring Rule String: icmp]

Ethernet II, Src: Cisco_d7:ac:0a (00:13:5f:d7:ac:0a), Dst: Dell_48:fa:06 (00:14:22:48:fa:06)

Destination: Dell_48:fa:06 (00:14:22:48:fa:06)

Address: Dell_48:fa:06 (00:14:22:48:fa:06)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: Cisco_d7:ac:0a (00:13:5f:d7:ac:0a)

Address: Cisco_d7:ac:0a (00:13:5f:d7:ac:0a)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: IP (0x0800)

Internet Protocol, Src: 172.17.85.16 (172.17.85.16), Dst: 172.24.223.73 (172.24.223.73)

Internet Control Message Protocol