ICMP ping effecting network flow?

linux

    Next

  • 1. Decent program for drawing traffic shaping graphs
    Hi I have a Linux router between my home network and a cable modem which is happily traffic shaping and NATing etc. One of the programs I've used to view network traffic is iftop. It's great for looking at immediate traffic but, as far as I know, the data isn't saved over time so a graph over time can't be drawn. In order to analyse how the traffic shaping is going, I'd like a program to record traffic and speed data, then I can specify a filter or two and get a graph of them over some time period. For example, host A has a low traffic shaping priority. Port B has a high priority. I'd like to see a graph showing that as port B becomes used, host A is given less bandwidth. There are lots of programs out there to analyse network traffic, but I haven't found one with this capability yet. I've tried nagios, darkstat, ntop and a few others. Thanks Barry
  • 2. NIS-server refuses connects from clients
    Hello, I replaced an old server by a new one can't get NIS working again. At the clients I just altered the IP of the server, so they should be OK. Here is exactly what happens: client: <screen> r4:~ ypbind -debug parsing config file Trying entry: ypserver 192.168.0.6 add_server() domain: winux, host: 192.168.0.6, slot: 0 [Welcoms to ypbind-mt, version 1.41] ping host 192.168.0.6, domain winux Pinging all active server. </screen> the last two line are repeated about once per minute or so. At the server I get the following entry for every ping from the client in /var/log/messages: <messages> ... ypserv[pid]: refused connect from 192.168.0.4:32770 to procedure ypproc_domain_nonack (winux, ;0) </messages> How can I figure out why the connect is refused? Here my configuration: Client (SuSE 9.0) <defaultdomain> winux </defaultdomain> <yp.conf> ypserver 192.168.0.6 </yp.server> Server (SuSE 10.0) <defaultdomain> winux </defaultdomain> <yp.conf> ypserver localhost </yp.conf> <ypserv.conf> dns: no files: 30 slp: no xfr_check_port: no * : * : shadow.byname : port * : * : passwd.adjunct.byname : port </ypserv.conf> Thanks, Dieter
  • 3. WUSB11 v2.5 (Prism2) and linux-wlan and debian
    I can't seem to get the linux wlan drivers to work under debian. They worked on a slackware box okay with this same usb nic (linksys wusb11 ver. 2.5 with prism2 chip) and it works fine under windoze. I've tried it with two different debian boxes however, one running debian 3.0 with a 2.6.13 kernel and another running 3.1 with a 2.6x kernel. The module loads and discover starts looking for the dhcp server, but never seems to get a connection (or even an offer) from what I see in /var/log/messages. Also, the /etc/hotplug/wlan.agent seems to go crazy, eating up all the system resources until I kill it off. Has anyone got linux wlan and the prism2 usb nics working in debian?
  • 4. Slow DNS Lookup - Debian
    I've Google'd this problem plenty of times, but haven't seen many current posts on the subject. Here's the deal: A friend and I recently installed Linux on machines in our home networks. I used Debian Testing, and he used Linspire (Debian based.) We're now noticing that web pages take a VERY long time to load, the DNS lookup inparticular. Even weirder, Windows XP PC's on the same network load pages instantaneously! I could be loosing my mind, but I swear it wasn't this way when I loaded Debian onto this same PC about a year ago. The only advancement I can imagine would be IPv6, which I've uninstalled from the Kernel with "modconf" My /etc/resolv.conf is as follows: search ahvl.nc.charter.com nameserver 192.168.1.10 The nameserver being my router of course. Anyway, any help is appreciated. We've been trying to figure this out for a long time now. - Henson

ICMP ping effecting network flow?

Postby Roy L Butler » Sat, 13 May 2006 08:12:59 GMT

Everyone,

I was told by someone at a systems conference about 10 years ago that if 
you ping a server over the Internet while downloading a file from it, 
your download will take place quicker.  I thought it was bogus then and 
still kind of lean towards that.  I see no difference from some simple 
tests I've tried.  But, perhaps there's something to do with a common 
design of routers and traffic flows that I just don't get.  The guy who 
told me got a knowing nod from someone else and neither were in a 
position to just be pulling legs.  Were they both wrong and just trying 
to sound smart?  Any (real) info would be much appreciated.  It's 
tickled the back of my mind for a long time. :)


Roy

Re: ICMP ping effecting network flow?

Postby Rick Jones » Sat, 13 May 2006 09:00:56 GMT



I'd chalk it up to leg-pulling.  The only way I could see a ping
helping a transfer would be if it was _just_ enough to help keep the
NICs' interrupt throttles from being too aggressive.  

rick jones
-- 
The glass is neither half-empty nor half-full. The glass has a leak.
The real question is "Can it be patched?"
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

Re: ICMP ping effecting network flow?

Postby ibuprofin » Sun, 14 May 2006 10:05:07 GMT

On Thu, 11 May 2006, in the Usenet newsgroup comp.os.linux.networking, in




Anecdotal evidence - no observed difference.  Why?  Because the services
have nothing to do with each other.    On the server, the 'ftp' or 'web'
server is an application running at the top of the networking stack. With
most operating systems, 'ping' (ICMP Echo) is a network service that is
part of the networking stack.   At the client side, 'ping' is normally
just another application - which if anything is stealing CPU cycles that
could ordinarily be used for something more useful.


As far as the routers are concerned, it's just another packet. An ICMP
packet _MAY_ be processed at a lower priority than TCP or UDP, because
ICMP is more used as an error, or diagnostic, while the others are
carrying "useful" data.


Why not?   Are you the "boss" that they dare not lie to? Or was their boss
present and would not take kindly to such humor?


Ten years ago - to late to do anything. The right thing to do AT THE TIME
would have been to ask them to explain why they felt this to be true.

        Old guy

Re: ICMP ping effecting network flow?

Postby Roy L Butler » Sun, 18 Jun 2006 08:16:05 GMT

 > I was told by someone at a systems conference about 10 years ago that if
 > you ping a server over the Internet while downloading a file from it,
 > your download will take place quicker. I thought it was bogus then and
 > still kind of lean towards that. I see no difference from some simple
 > tests I've tried. But, perhaps there's something to do with a common
 > design of routers and traffic flows that I just don't get. The guy who
 > told me got a knowing nod from someone else and neither were in a
 > position to just be pulling legs. Were they both wrong and just trying
 > to sound smart? Any (real) info would be much appreciated. It's
 > tickled the back of my mind for a long time. :)

I've come across documentation that some routers place ICMP traffic in 
their high-priority queue.  Both these guys were heavily certified 
(which I know doesn't always mean qualified), one of them was presenting 
on a loosely-related topic and the other troubleshot national banking 
networks.  My guess is that they might have thought (wrongly?) that 
certain vendors' routers placed all traffic to/from a source address 
issuing echo_requests in such a queue, elevating lower-priority protocols.

I can't remember their names and I agree the time to ask was back then. 
  Unfortunately, I didn't. :(


Roy

Re: ICMP ping effecting network flow?

Postby Constant Meiring » Sun, 18 Jun 2006 21:04:30 GMT



Ten years ago, pings wouldv'e eaten up your bandwidth... making
downloads slower :)


Re: ICMP ping effecting network flow?

Postby ibuprofin » Mon, 19 Jun 2006 07:47:07 GMT

n Fri, 16 Jun 2006, in the Usenet newsgroup comp.os.linux.networking, in
article <e6ve3l$mu3$ XXXX@XXXXX.COM >, Roy L Butler wrote:



That still doesn't sound right. Lessee, 10 years ago... On 31 Dec 1995,
the Internet consisted of 1.05 billion IP addresses assigned to 40865
networks world wide (for comparison, the figures earlier this week were
2.318 billion hosts and 73466 IPv4 networks) (Source: RIR Zone files
dated 06/15/2006). If you look at any contemporary documentation
(examples - the man page for the common LBL version of traceroute, or
W. Richard Stevens 'TCP/IP Illustrated Volume 1 - the protocols", Addison
Wesley, ISBN 0-201-63346-9, copyright 1994) you'd see that many
connections over the Internet require at least 6 hops (routers) to get
anywhere - a more common value is over a dozen. In the traceroute man
page, it took 18 hops to go from Lawrence Berkeley Labs (about 45 miles
Southeast of Oakland) to MIT in Boston - and no less than 13 to get from
LBL to a specific server in Berkeley (not more than 50 miles away). The
Stevens book shows similar hop counts as well. It's a bit of a stretch
to think that ten or fif{*filter*} intermediate routers would note a ping
going by from "A" to "B", and therefore remember to pass TCP datagrams
between those hosts with higher priorities. While not very likely at
that era, it is also possible that pings could have been routed over
different intermediate hops compared to TCP.

As far as prioritizing ICMP - can you give some cite? The IP header has
a TOS variable, and one of those is the "minimize delay" flag (see page
29 of RFC0791). These flags have in general been ignored, even back in the
early 1990s (see the Stevens book). RFC1340 (superseded by RFC1700, which
in turn was replaced by on-line databases) and RFC1349 (from July 1992)
specified how these flags were to be set, and the 'Minimize Delay' flag
was only set for 'Telnet/Rlogin', FTP control (but not data), TFTP, SMTP
(command phase, not data) and DNS queries using UDP. These were generally
interactive or setup conditions. There is also a 'Maximize throughput'
flag which was set for bulk data transfers (FTP or SMTP data, DNS zone
transfers).


A lot depends on the certifying organization. Certifications are generally
most useful in getting past the hiring filters set by HR and PHBs. The
actual experience/knowledge would be determined in interviews with the
technical people.


How much memory do you think is in the "average" backbone router? How
much traffic do you think it might see in any given moment? (If you were
traveling by air in the 60s-80s, you probably knew that if you traveled
anywhere in the "South" of the United States (actually meaning Southeast),
you couldn't go ANYWHERE without changing planes in Atlanta. By the mid-90s,
the Internet was a good bit better than that, but there were still a lot of
routes where the path from "A" to "B" went through major hubs like SFO,
Denver, Chicago, and New York - even if you were going from Dallas to
Atlanta.


You might try 'comp.protocols.tcp-ip' or even 'alt.folklore.computers'.
My news server also lists a 'alt.folklore.internet' which might be useful.

Old guy

Re: ICMP ping effecting network flow?

Postby Roy L Butler » Wed, 21 Jun 2006 02:30:55 GMT

oe Trin wrote:

Thanks for all of the good info. My specific source stating routers may
be configured to treat ICMP echoes as high-priority packets is section
6.5 of _Wide-Area Data Network Performance Engineering_, by Cole &
Ramaswamy (AT&T engineers), written in 2000. They do mention that the
opposite (lower-priority) is common and I can understand how the whole
thing seems even less plausible on a packet-switching architecture...
I'll give up the position of devil's advocate. :)


Roy

Re: ICMP ping effecting network flow?

Postby ibuprofin » Thu, 22 Jun 2006 11:09:29 GMT

On Mon, 19 Jun 2006, in the Usenet newsgroup comp.os.linux.networking, in




That's certainly possible, but I don't see it being used to treat all
packets to/from the host that pinged with higher (or lower) priority.
This is basically saying that all routers along the way would have to
allocate some memory to remember which host has sourced or replied to
a ping in the last second or so. Probably not a big deal for a stub
router in a home situation, but likely to play merry he!! on a
backbone router connecting a couple of OC-3s (155 Megabit fiber) or
wider.


Sounds good.

        Old guy

Similar Threads:

1.[CORRECTION] ICMP ping effecting network flow?

I wrote:

>You might try 'comp.protocols.tcp-ip' or even 'alt.folklore.computers'.
>My news server also lists a 'alt.folklore.internet' which might be useful.

Forget that 'alt.folklore.internet' group - it's not job-site safe, being
overrun with spam and pr0n ads.   Sorry.

        Old guy

2.Ping from cron not having same effect as ping from console

I'm running a RedHat Enterprise 2.1 server as a group development
platform.  We're having some network problems which are being worked
on, but right now I need a workaround.  The problem is that this
server drops off of the network a couple of times a day.  I've found
that if I just ping another server from that server it comes back on
the network, everybody can see it and everything is fine.

To keep the server on the network I set up a cron job to ping another
server every two minutes.  I can see this ping running every two
minutes with "ps -e | grep ping".  However, the machine still drops
off of the network.  When the server drops off of the network I wait
until I see the cron ping as above and then verify that it is still
off of the network.  So the cron ping doesn't get the machine back on
the network.  Then I do a ping from a console and the server comes
back on the network.

For some reason the cron ping doesn't have the same effect that a ping
from the console does.  The crontab ping entry is by the same user
that I am logged in as when I do the ping from the console.

Anyone have any suggestions?  Why does a ping from the console have a
different effect than a ping from cron.

3.how to disable ICMP: "Echo Request" (ping)

title says it. Have already configured firewall to disallow everything
but ICMP still coming thru. How do I stop it? All side effects of
disabling ICMP desired.

SUSE 9.3

4.ICMP, the minimum to ping the internet but not the pix to pinged

Hi guys,

I am dealing with a PIX 515 at the moment with VPN.

The network behind interface inside is 192.168.10.0/27. Going to the 
internet, the hosts are nated to the external if.

The access-list for internet traffic is

access-list internet_out; 5 elements
access-list internet_out line 1 permit udp any any eq domain (hitcnt=458)
access-list internet_out line 2 permit tcp any any eq www (hitcnt=2237)
access-list internet_out line 3 permit tcp any any eq https (hitcnt=81)
access-list internet_out line 4 permit tcp any any eq ftp (hitcnt=0)
access-list internet_out line 5 permit icmp any any (hitcnt=365)

I've got also this access-list

access-list ANY_ICMP; 1 elements
access-list ANY_ICMP line 1 permit icmp any any (hitcnt=69)

and the access-group is

access-group ANY_ICMP in interface external

It works but the firewall can be pinged from the outside Internet. I do not 
like it.

What is the commands to type to have only the inside hosts to ping the hosts 
on the internet and the PIX to do not being pinged on its external 
interface?

Thank you very much,

Alexandre 


5.Strange network problems - pings to host are fine, pings from host fail

Sorry for the long post - I've tried to outline the symptoms of my 
problem, and what I've tried to fix it.


I'm having some networking problems with a PC running an old version of 
Red Hat (kernel 2.2).  The PC came with a machine we have bought 
second-hand - as far as I know, everything was working before the 
machine was moved to our company.

To keep things simple, we have the Red Hat machine connected to a 
Windows XP machine that came with it, with only a simple switch in 
between.  Each machine is set up with a fixed IP address on the same 
network.

 From the XP machine, I can ping the Red Hat machine reliably and 
quickly.  From the Red Hat machine, pings to the XP machine /generally/ 
fail - typically there are about 80%-90% failures.  Those pings that 
don't fail, are fast (reply time about 1 ms).  On the XP machine, it's 
easy to see the packet counters showing packets in and replies out.  On 
the Red Hat machine, ifconfig shows similar packet rx and tx counts, and 
zero error counts.

arping to the XP machine from the Red Hat machine is reliable and fast.

When we try a browser on the XP machine and address the web server on 
the Red Hat host, there is generally a long pause (perhaps minutes), 
then suddenly the page appears.

We have tried using another Linux box in place of the original XP 
machine, with the same results from the Red Hat system.

We have tried replacing the cables and switch, with no effect - given 
that arpings are working perfectly it's hard to see how it could be a 
hardware problem.

I'm not very familiar with Red Hat or a 2.2 kernel (my experience is 
mostly with Debian and related distros, and with 2.4 and 2.6 kernels). 
But "ipchains -L" shows no firewalling (everything accepted), "ifconfig" 
and "route -n" have the expected setup, and I could not stop anything 
unexpected with "sysctrl".

One of my colleagues will try a different network card this evening.


Any ideas or tips would be much appreciated.  We've tried pretty much 
every sensible idea we can think of, so I'm ready to listen to any crazy 
or unlikely tricks.

mvh.,

David

6. Tracking per TCP flow network traffic load

7. Network Issue possibly from ICMP host unreachables

8. Network Identification/Administration/Flow Control/Error pattern in C



Return to linux

 

Who is online

Users browsing this forum: No registered users and 19 guest