System buffer for incoming ICMP responses

[Fat Scrape]

Can i increase system buffer for incoming ICMP responses?.
My problem depends on netmon options, follow an extract of netmon (man)

PLEASE NOTE: If you increase the ICMP-queue-length too much,you may find that interfaces may be declared Critical when they are actually up. This is because there is a limited system buffer for incoming ICMP responses, and having too many arriving at the same time can cause some to be lost.

Tank you

D.M.

[Andreas Voss]

Hi,

here an extract of an document:

ICMP: resolving ICMP source messages
Current Path Home
Score
Document Type EN
Date 2000 Jun 14
Description ICMP: resolving ICMP source messages
Document Id S3100005739
Search String

You may provide feedback on this document

View the printer friendly version of this document



--------------------------------------------------------------------------------

PROBLEM
Upon pinging an 11.0 system, I am seeing a packet loss and Internet
Control Message Protocol (ICMP) source quench messages.

Why am I getting these messages?


CONFIGURATION
Operating System - HP-UX
Version - 11.0
Subsystem - Internet Control Message Protocol (ICMP)

RESOLUTION
ICMP source quench messages are generated when an IP packet is
received by the 11.0 system that can't be delivered to the socket
buffer of the receiving application. The intent is to inform the
sender of the full buffer condition so the rate of the transmission
is slowed down until the buffer can be read by the receiving
application.

Setting the ndd parameter ip_send_source_quench to 0 can be an
effective way to deal with the messages.

Programs that use icmp protocol, such as ping, use a type of
socket called SOCK_RAW. The nature of using raw IP sockets is
that ALL packets received that match the protocol type of the raw
socket are delivered to ALL the sockets using that protocol. It is
up to the application to read all the data in it's socket buffer
and discard the data it's not interested in. If any of these
sockets are full, the icmp source quench message will be generated.

One process that uses one of these sockets is part of DCE, and it
is 'rpcd'. This program opens a raw socket in order to listen for
icmp messages, which it uses to monitor the health of other systems
on the network running DCE. In this case 'rpcd' used a 32K buffer,
and processed the messages received every 5 minutes, which led to
the buffer full condition.

PHSS_17810 addresses the problem by increasing
the buffer size to 128K and processing the messages every 2 minutes.


Regards