[Techtalk] 2nd networking question

[Maria Blackmore]

On Tue, 3 Sep 2002, BUNTER MATTHEW wrote:
> No packet filtering, plain vanilla setup.

hmm, ok

> Not sure what cards (I'm not the
> admin) industrial strength since on Gigabit Ethernet though, yes lots
> between the two computers that I was initially testing (one in France the
> other in Sweden) but did the ping -1500 to lots of other computers with the
> same prob. Ping -1470 works.

hmmm, fascinating. </spock>

what about if you transfer a large file, eg with ftp ?
does the file itself transfer ok, or is it just icmp?

if you have root privs, try running a tcpdump on the machine whilst you
transfer the file, eg

tcpdump -nvv not port 20 and not port 21

which will display anything that isn't ftp very verbosely, see if there's
any ICMP or anything going on.

if the ftp transfer stalls too, or goes very slowly, switch to a small
file, just a few kB (more than 9 kB)

and do

tcpdump -nvv -s 9000 -w dumpoutput tcp port 20 or tcp port 21 or icmp

before making the ftp connection and transfering the file.
(9000 because you're using gigabit ethernet, gigabit ether supports Jumbo
frames up to 9000 bytes in size, which is Funky(tm) )

once you have dumpoutput then you can take the file back to your
workstation, if neccesary splitting the file into 1400 byte chunks :) so
long as you put it back together at your workstation.

on your workstation you need to install a copy of ethereal
(http://www.ethereal.com/) and feed in dumpoutput and read the analysis

are there any multiple retransmissions, icmp coming in, does the
connection stop dead for no apparent reason?


> Yes loads of other machines on the same network (corporate) - several
> thousands of PCs, Unix boxen, VMS Alphas and two mainframes. No
> problems to do with the pinging other than normal run of the mill
> network issues because people are screwing around with their settings.

Is there a network department whom you can ask for help?
If the network is large then I would imagine they have encountered this
problem some time before.

> I am pretty convinced that there is something to do with ICMP and
> fragmentation. When I have more time I'll investigate further.

If it is a large switched network, my first suspect would be the switches
closest to the machine having problems.  Can you test to a machine that is
on the same IP subnet?

have fun and stuff, I have to do work now :)

Maria