[109687] in North American Network Operators' Group
Re: Recommendation of Tools
daemon@ATHENA.MIT.EDU (=?ISO-8859-1?Q?Anders_Lindb=E4ck?=)
Thu Dec 4 11:06:39 2008
In-Reply-To: <alpine.LRH.2.00.0812041500530.8919@netcore.fi>
From: =?ISO-8859-1?Q?Anders_Lindb=E4ck?= <list-only@dnz.se>
Date: Thu, 4 Dec 2008 17:05:53 +0100
To: Pekka Savola <pekkas@netcore.fi>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
On 4 dec 2008, at 14.05, Pekka Savola wrote:
> On Wed, 3 Dec 2008, Anders Lindb=E4ck wrote:
>> Mtr is even less usefull then that, in its default mode it does a =20
>> traceroute and then proceeds to ICMP Ping flood each IP in the =20
>> list generated by the traceroute, the result is usually completly =20
>> useless on WAN topologies due to asym-routing, ICMP node =20
>> protections by carriers and punting etc..
>
> No, it doesn't try pinging the routers in the middle, at least not =20
> anymore (I just re-checked with 0.71 and 0.75). I vaguely recall =20
> behaviour like that in the past, however, so it's possible that =20
> long time ago mtr did behave that way.
>
According to the 0.75 sorcecode ICMP is still the default prot used, =20
and the definition of MTR from bitwizards homepage disagress with you:
"mtr combines the functionality of the 'traceroute' and 'ping' =20
programs in a single network diagnostic tool.
As mtr starts, it investigates the network connection between the =20
host mtr runs on and a user-specified destination host. After it =20
determines the address of each network hop between the machines, it =20
sends a sequence ICMP ECHO requests to each one to determine the =20
quality of the link to each machine. As it does this, it prints =20
running statistics about each machine. For a preview take a look at =20
the screenshots."
Even if you use UDP/TCP or whatever, the return packet will be ICMP =20
and that will be ratelimited by any carrier worth there salt...
>> And using UDP will not really provide better results due to the =20
>> same thing, and IIRC Cisco from 12.0 has a standard setting of no =20
>> more then 1 ICMP Unreach per 500ms..
>
> This is true and the point I was getting at, though I believe the =20
> bucket is much larger in any recent software release (also in 12.0 =20
> series). Actually, 5 years ago, you could see spot Cisco routers =20
> in "traceroute6" because they dropped the rate-limiter didn't =20
> respond to the middle packet and it resulted in a star. The rate-=20
> limiter has long since been fixed to be more lenient.
>
According to the 12.4T refrence it is still set to 1 packet / 500ms =20
as default, however changes where made to how you can controll this =20
in 12.4(2)T.
> --=20
> Pekka Savola "You each name yourselves king, yet the
> Netcore Oy kingdom bleeds."
> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
------------------------------
Anders Lindb=E4ck
anders.lindback@dnz.se
