Bogus IP Header Length Packet Sniff

Ruien · #11 06-19-2015, 11:07 AM

Guys,

There are idiosyncrasies about the way that MTR (and, by extension, WinMTR) reports packet loss. 87% packet loss to ae-8.r23.nycmny01.us.bb.gin.ntt.net (129.250.2.148) means nothing if you consistently get 9% to a node past that. It just means that the router is de-prioritizing ICMP ECHO but forwarding normally.

Here's my MTR report to 66.55.145.2:

Code:

root@RyanDesktop:~# mtr --no-dns -r -w -c100 --interval=0.2 -s 56 66.55.145.2
Start: Fri Jun 19 22:50:47 2015
HOST: RyanDesktop    Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 192.168.1.1     0.0%   100    0.2   0.2   0.2   0.3   0.0
  2.|-- 100.68.128.1    0.0%   100   21.0  10.2   1.2  96.8  15.7
  3.|-- 61.188.202.181 35.0%   100    5.3   4.4   3.1  44.3   5.1
  4.|-- 171.208.203.13  0.0%   100   11.1  12.6   9.8  45.2   3.5
  5.|-- 202.97.36.225   0.0%   100   44.8  47.1  44.7  49.6   1.0
  6.|-- 202.97.33.238  86.0%   100   44.6  45.0  44.4  45.7   0.0
  7.|-- 202.97.60.146  80.0%   100   46.5  52.3  46.0  80.4  11.4
  8.|-- 202.97.58.230   2.0%   100  409.3 392.2 372.9 416.9  11.5
  9.|-- 202.97.50.22    8.0%   100  216.4 217.8 214.9 220.1   1.1
 10.|-- 129.250.9.9     8.0%   100  200.6 198.7 196.8 200.6   0.4
 11.|-- 129.250.5.69    1.0%   100  218.5 220.1 215.7 249.8   5.5
 12.|-- 129.250.3.188   5.0%   100  276.8 277.5 275.4 291.4   2.3
 13.|-- 129.250.2.148  75.0%   100  314.5 291.7 288.6 314.5   6.9
 14.|-- 129.250.4.149   1.0%    99  277.0 276.7 274.1 279.5   0.8
 15.|-- 128.241.2.250   2.0%    99  285.0 292.7 283.7 349.5  11.2
 16.|-- ???            100.0    99    0.0   0.0   0.0   0.0   0.0

We know that 66.55.145.2 doesn't respond to ICMP and speculate that it's hop 16. We can't know that for sure, since it could be 128.241.2.250 refusing to forward upstream ICMP to us. But presumably once we've arrived at 129.250.* network there won't be much additional loss to 66.55.145.2, so the average packet loss to the most reliable node in this network is our most accurate assessment of the packet loss.

I'll just use the farthest visible hop as it's about the same:

Code:

root@RyanDesktop:~# ping -i 0.2 -c 1000 -q 128.241.2.250
PING 128.241.2.250 (128.241.2.250) 56(84) bytes of data.

--- 128.241.2.250 ping statistics ---
1000 packets transmitted, 996 received, 0% packet loss, time 200776ms
rtt min/avg/max/mdev = 271.787/301.339/509.617/37.038 ms, pipe 3

So the real packet loss here is 0.4%.

The problems I am seeing are not caused by packet loss to the server. According to Wireshark, both Emerald Jungle and Trakanon's Teeth use 66.55.145.2, and I have problems only in TT. If I had a terrible connection to that IP, then I'd see the same issues in both zones.

Wisteso, you may have slightly more packet loss than I do, but not significantly so.

towbes, you are seeing packet loss issues, but the problem shows up very early in your network route. Run some manual pings like I did in my example; are you seeing any consistently low loss to any hops along the way? Either you're looking at an anomaly (maybe your VPN hates ICMP) or else you're getting loss at the third hop. Try pinging with TCP to an open port with tcping if you have access to linux.