1838675 Members
5309 Online
110128 Solutions
New Discussion

Re: Network Problems

 
Greg OBarr
Regular Advisor

Network Problems

I have several things I need more information on. First, this is the output of my netstat -r command:
[cadb02a]# netstat -rn
Routing tables
Dest/Netmask Gateway Flags Refs Use Interface Pmtu
127.0.0.1 127.0.0.1 UH 0 1702833 lo0 4136
172.28.60.22 172.28.60.22 UH 0 7174243 lan2 4136
172.28.60.101 172.28.60.101 UH 0 0 lan1 4136
192.168.2.2 192.168.2.2 UH 0 17 lan0 4136
192.168.2.0 192.168.2.2 U 2 0 lan0 1500
172.28.60.0 172.28.60.22 U 2 0 lan2 1500
127.0.0.0 127.0.0.1 U 0 0 lo0 4136
default 172.28.60.1 UG 0 0 lan2 1500

Notice that the default gateway shows NO use. Do I have something configured wrong or is this just the way it's supposed to look?
Next, notice that the PMTU size is different on some interfaces than others. This 4136 MTU size has caused problems before and we had to set "large frames" on the switch to make it handle the large frame sizes. I would like to set them all to 1500 since the WAN can support only 1500 MTU size.
11 REPLIES 11
Ron Kinner
Honored Contributor

Re: Network Problems

My 11.0 system shows exactly the same non use of the default gateway even after a ping to a non local IP address that should have required its use. I'd say netstat is broken in 11.0. I checked my 10.0 system and it shows that it uses the default gateway quite often.

The PMTU is not really a problem. If you look at it very carefully you will see that the only times it uses the 4136 is when it is talking to itself. (the 127.0.0.0 and 127.0.0.1 as well as the three IP addresses for its network cards) This never goes out on the wire so your switch won't see it. When it talks to a network (addresses ending in .0 in your table) or the default it uses 1500. Your large frame problem may have been caused by VLAN tagging. This adds a few extra bytes to each packet so a max size packet will be seen as too big by some switches that don't know what is going on.

Ron
Hai Nguyen_1
Honored Contributor

Re: Network Problems

Greg,

My config is the same as yours. I do not see anything abnormal.

Hai
Patrick Wallek
Honored Contributor

Re: Network Problems

Have a look at the netstat cumulative patch. It appears to address your issue.

PHNE_17434
http://www1.itrc.hp.com/service/patch/patchDetail.do?patchid=PHNE_17434&context=hpux:800:11:00

This patch has no dependencies and does not require a reboot.
Greg OBarr
Regular Advisor

Re: Network Problems

Thanks Patrick. That patch looks like it may give me some more accurate information from netstat. Now, to get the opportunity to reboot the system is another story...

As for the PMTU, I found this information (below).. Looks like there is not a way to set the MTU to a "fixed" value. There are two options for setting the "discovery strategy" using the ndd command:

p_pmtu_strategy:

Set the Path MTU Discovery strategy: 0 disables Path MTU
Discovery; 1 enables Strategy 1; 2 enables Strategy 2.

Because of problems encountered with some firewalls, hosts,
and low-end routers, IP provides for selection of either
of two discovery strategies, or for completely disabling the
algorithm. The tunable parameter ip_pmtu_strategy controls
the selection.

Strategy 1: All outbound datagrams have the "Don't Fragment"
bit set. This should result in notification from any intervening
gateway that needs to forward a datagram down a path that would
require additional fragmentation. When the ICMP "Fragmentation
Needed" message is received, IP updates its MTU for the remote
host. If the responding gateway implements the recommendations
for gateways in RFC??1191, then the next hop MTU will be included
in the "Fragmentation Needed" message, and IP will use it.
If the gateway does not provide next hop information, then IP
will reduce the MTU to the next lower value taken from a table
of "popular" media MTUs.

Strategy 2: When a new routing table entry is created for a
destination on a locally connected subnet, the "Don't Fragment"
bit is never turned on. When a new routing table entry for a
non-local destination is created, the "Don't Fragment" bit is
not immediately turned on. Instead,

o An ICMP "Echo Request" of full MTU size is generated and
sent out with the "Don't Fragment" bit on.

o The datagram that initiated creation of the routing table
entry is sent out immediately, without the "Don't Fragment"
bit. Traffic is not held up waiting for a response to the
"Echo Request".

o If no response to the "Echo Request" is received, the
"Don't Fragment" bit is never turned on for that route;
IP won't time-out or retry the ping. If an ICMP "Fragmentation
Needed" message is received in response to the "Echo Request",
the Path MTU is reduced accordingly, and a new "Echo Request"
is sent out using the updated Path MTU. This step repeats as
needed.

o If a response to the "Echo Request" is received, the
"Don't Fragment" bit is turned on for all further packets
for the destination, and Path MTU discovery proceeds as for
Strategy 1.

Assuming that all routers properly implement Path MTU Discovery,
Strategy 1 is generally better - there is no extra overhead for the
ICMP "Echo Request" and response. Strategy 2 is available
only because some routers, or firewalls, or end hosts have been
observed simply to drop packets that have the DF bit on without
issuing the "Fragmentation Needed" message. Strategy 2 is more
conservative in that IP will never fail to communicate when using
it. [0,2] Default: Strategy 2
Patrick Wallek
Honored Contributor

Re: Network Problems

Greg,

If you notice in the patch description, and in my last message, that patch does NOT require the machine to be rebooted.
rick jones
Honored Contributor

Re: Network Problems

s has been pointed-out the PTMU routes for the local IPs are not going to cause larger packets to be sent onto your LAN. They are there simply to make local (intra-machine) traffic more efficient. When a machine sends traffic to one of its own IP addresses, that traffic will _not_ go out onto the wire (even without those PMTU routes.)

The use of ip_pmtu_strategy == 2 is discouraged by HP because it can be used by malicious remote systems to trigger a Denial of Service attack.

The route command, with the -p option can be used to specify a specific PTMU to a specific remote host.
there is no rest for the wicked yet the virtuous have no pillows
Greg OBarr
Regular Advisor

Re: Network Problems

Rick, I saw a white paper on the HP site that said that beginning with version 11.0, the command "route -p MTU" was no longer used and the ndd command was to be used instead. Should I disregard this?

And also, you guys are telling me that the large frame sizes are not going out on the wire. But we had problems that indicated that they were. I had two HP-UX 11.0 systems plugged into a Cisco switch. I had NFS mounts going from one system to another. I was copying very large (1-2Gb) files from Oracle backups across the NFS mount to write to tape. The symptoms were that the copy would start out quick, the dest. file size would grow rapidly, and then stop and begin to grow very slowly. It would take literally all day to copy what should have been done in 5-10 minutes. The Cisco analyst used the sniffer to see what was happening and the switch was having to chop up large frames coming in, causing alot of retries. He turned on a setting called "jumbo frames", I believe it was, on the Cisco switch, and the problem went away! That tells me that large frames ARE going out on the wire.
rick jones
Honored Contributor

Re: Network Problems

If you could give a pointer to that white paper I'll go take a look. ndd and ip_pmtu_strategy is the "global" switch that turns PathMTU Discovery on or off for everyone.

The route -p command is the "fine tune" if you will - allowing the setting of MTU's to use to reach specific destinations.

The two are complementary, not mutually exclusive.

Now as for the "large frames." There is of course always the possibility of a bug, but those host routes do not affect traffic that actually leaves the machine. I suspect that if frames larger than 1500 bytes were being sent onto the network it was for some other reason. Also, large frames would not "kick-in" in the middle of a file transfer, they would be there from the beginning.

Sometimes a duplex mismatch can result in a system thinking it has seen a large frame. Other times, vlan tagging might cause that.

It would be best to get a packet trace of the frames to see just what is being sent.

I have heard that the "large frames" supported by Cisco kit only go as far as 2000-odd bytes (perhaps Cisco varies from kit to kit here). If those routes were causing "large frames" I would have expected them to be ~4136 bytes, which would still be larger than the MTU available on the Cisco.
there is no rest for the wicked yet the virtuous have no pillows
Ron Kinner
Honored Contributor

Re: Network Problems

For what it's worth Cisco supports two different oversize packet sizes. Baby Jumbo (MTU = 1552) and Giant (MTU = 8092 upto 9216 depending on port card used)

See:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a008010edab.shtml

I don't quite understand how an HPUX could be generating oversize frames unless as Rick said there is a bug or you have accidentally turned on VLAN tagging on the HPUX. Understand this is possible with some of the later versions. It is also unlikely that they would start to be generated only after the download had progressed for a while.

I would look for a duplex mismatch or bad cable or port which would generate a lot of collisions or a buffer problem on the receiving end. Could also be a bottleneck or noisy link somewhere and you start dropping packets from the queue which would shrink the window size and cause it to slow down. Had a T1 once which worked fine at low speed but would start slipping under load. Turned out someone had set the distance parameter to the shortest value because the two boxes were right next to each other. Turned out there was a 250' roll of cable connecting them that was hiding under the floor board.

Ron
rick jones
Honored Contributor

Re: Network Problems

I suspect those "baby jumbos" are for vlans and whatnot.

i'm not sure what HP-UX tagged vlans does, if it keeps a 1500 byte MTU and thus has slightly larger frame sizes, or if it drops the MTU and keeps the maximum frame size. for "jumbo frames" we do 9000 byte MTU, only on the Gig, not the 100BT and nothing else between 1500 and 9000
there is no rest for the wicked yet the virtuous have no pillows
Greg OBarr
Regular Advisor

Re: Network Problems

Looks like I already have the PHNE_17434 patch installed. I found two other networking patches though that may make a difference. There were 4 in the bundle, but 2 of them I already have installed earlier. They are:

PHNE_21767 (already installed)
PHNE_22566 (already installed)
PHNE_22962
PHNE_25580

I'm going to install the last 2 this weekend. They do require a reboot.

Rick, I've been looking for that white paper I was talking about, but haven't been able to find it yet.