Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Strange ping output

Hi Friends,

While doing an extended ping, i found a strange ping output and not sure what exactly it means (QQQQQ). Kindly advice if anyone of you have come across such thing earlier. Thanks in advance

Router#ping ip

Target IP address: A.B.C.D

Repeat count [5]: 1000

Datagram size [100]: 1000

Timeout in seconds [2]:

Extended commands [n]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 1000, 1000-byte ICMP Echos to 10.192.148.132, timeout is 2 seconds:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQ

Success rate is 25 percent (254/1000), round-trip min/avg/max = 8/22/80 ms

Router#

8 REPLIES
Hall of Fame Super Gold

Re: Strange ping output

Q is source quench, very rate to get, check what router is sending that.

Re: Strange ping output

Hello,

Yes, as Paolo already said, this Q denotes a Source Quench (http://en.wikipedia.org/wiki/ICMP_Source_Quench) in Cisco routers. The ping output you posted is from a router and routers normally rate limit their outgoing ping packets (1 ping packet every second or something like that and you cannot change this behavior as far as I know), so I would not consider the particular router ping (even with 1000 packets of 1000 bytes each) being solely responsible for the Quench. Perhaps you ping an already "tired" destination (from other sources besides your ping).

Kind Regards,

M.

Re: Strange ping output

ICMPv4 Source Quench messages are sent by a device to request that another reduce the rate at which it is sending datagrams. They are a rather crude method of flow control compared to more capable mechanisms such as that provided by TCP.

Check the cisco link below.

http://www.cisco.com/warp/public/63/ping_traceroute.html

What's interesting about the Source Quench format is that it is basically a “null message”. It tells the source that the destination is congested but provides no specific information about that situation, nor does it specify what exactly the destination wants the source to do, other than to cut back on its transmission rate in some way. There is also no method for the destination to signal a source it has “quenched” that it is no longer congested and to resume its prior sending rate. This means the response to a Source Quench is left up to the device that receives it. Usually, a device will cut back its transmission rate until it no longer receives the messages any more, and then may try to slowly increase the rate again.

In a similar manner, there are no rules about when and how a device generates Source Quench messages in the first place. A common convention is that one message is generated for each dropped datagram. However, more intelligent algorithms may be employed, specially on higher-end routers, to predict when the device's buffer will be filled and preemptively quench certain sources that are sending too quickly. Devices may also decide whether to quench all sources when they become busy, or only certain ones. As with other ICMP error messages, a device cannot count on a Source Quench being sent when one of its datagrams is discarded by a busy device.

The lack of information communicated in Source Quench messages makes them a rather crude tool for managing congestion. In general terms, the process of regulating the sending of messages between two devices is called flow control, and is usually a function of the transport layer. The Transmission Control Protocol (TCP) actually has a flow control mechanism that is far superior to the use of ICMP Source Quench messages.

Another issue with Source Quench messages is that they can be abused. Transmission of these messages by a malicious user can cause a host to be slowed down when there is no valid reason. This security issue, combined with the superiority of the TCP method for flow control, has caused Source Quench messages to largely fall out of favor.

Hall of Fame Super Gold

Re: Strange ping output

Re: Strange ping output

thats intresting.

New Member

Re: Strange ping output

Hi,

Can u please see the below. It seems with smaller byte count, its fine, however as the byte count increases, then the QQQQ output increases too. However, ping to other servers on the same LAN seems to be working perfectly fine. So this seems to be more like a particular server issue rather than a router issue. Is that right.

Router#ping ip

Target IP address: 10.192.148.132

Repeat count [5]: 400

Datagram size [100]: 500

Timeout in seconds [2]:

Extended commands [n]: y

Source address or interface: 10.222.68.14

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 400, 500-byte ICMP Echos to 10.192.148.132, timeout is 2 seconds:

Packet sent with a source address of 10.222.68.14

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Success rate is 100 percent (400/400), round-trip min/avg/max = 1/1/4 ms

Router#ping ip

Target IP address: 10.192.148.132

Repeat count [5]: 500

Datagram size [100]: 500

Timeout in seconds [2]:

Extended commands [n]: y

Source address or interface: 10.222.68.14

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 500, 500-byte ICMP Echos to 10.192.148.132, timeout is 2 seconds:

Packet sent with a source address of 10.222.68.14

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Q

QQQQQQQQQQ

Success rate is 97 percent (489/500), round-trip min/avg/max = 1/1/4 ms

Router#ping ip

Target IP address: 10.192.148.132

Repeat count [5]: 600

Datagram size [100]: 500

Timeout in seconds [2]:

Extended commands [n]: y

Source address or interface: 10.222.68.14

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 600, 500-byte ICMP Echos to 10.192.148.132, timeout is 2 seconds:

Packet sent with a source address of 10.222.68.14

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

Success rate is 81 percent (490/600), round-trip min/avg/max = 1/1/4 ms

Router#

Regards,

Manoj

Hall of Fame Super Silver

Re: Strange ping output

Hello,

so your destination is a server NIC and not a router interface ?

other servers can be pinged correctly with any size/number of packets on the same LAN.

This might be the result of some form of ICMP rate limiting where instead of simply dropping packets exceeding the rate limit the server sends back source quench.

It could be a form of protection from ICMP attacks.

Interesting issue

best regards

Giuseppe

Blue

Re: Strange ping output

Giuseppe is right.

Whichever device is sending the source quench, it is interpreting your excessive PINGs as a possible DoS attack.

Victor

1078
Views
26
Helpful
8
Replies
CreatePlease to create content