Networking bottleneck

[T W_1]

Hi,

I have a bottleneck in my network and am wondering the best way to locate it. I can see duplicate packets in a tcpdump, but can't pin down the where the speed issue is. Any Tips?

Thanks in advance

tim

[Ludovic Derlyn]

hi,

perhaps, that netstat -s will be interesting
and after work by lan , with netstat -I lan0 5

regards

[Steven E. Protter]

Shalom,

Might want to figure out what kind of traffic it is.

ethereal is available on HP-UX, Linux and Windows for free and can let you look at the traffic and see where its coming from.

http://hpux.cs.utah.edu/hppd/hpux/Gtk/Applications/ethereal-0.10.14/

http://hpux.cs.utah.edu/hppd/hpux/Gtk/Applications/ethereal-0.10.11/

I'm providing two links because there are some Q&A issues with software posted to the above site.

SEP

[T W_1]

Thanks for the answers both of you, I know where the traffic is coming from and to but there seems to be a problem in the network between. There is to much to check manually.

[Mustafa Gulercan]

hi;
the lanadmin command display general network packet transmission statistics for a single system.
1-execute the lanadmin command.
2-from the main menu,selact lan.
3-from the lan menu,select display
Fields of interests;
Collision Frames :these fields indicate the number of collisions detected by the system.Collisions slow NFS performance,as the network has to subside before any packets can be sent following a collision.
Inbound/Outband: This is the total of all packet types being sent and received from the Packets system.Compare this to the total number of deamon-related packets transmitted/received to obtain a ratio of total network traffic relative to the specific traffic.


regards;
mustafa

[rick jones]

Duplicate packets - could be a busted router, perhaps a device in promiscuous mode that is then acting as a router? In the tcpdump trace have tcpdump display the ethernet headers and see if the duplicates show the same source MAC address.

WRT collisions, "regular" collisions mean virtually nothing for performance, and would not result in duplicate packets on the network.

What initially led you to believe there was a network bottleneck?

[Michael Steele_2]

Well, this probably won't work because it requires 'spray' on every network node. spray sends a very disrupting burst of icmp packets by ip address. For exmaple:

spray ip -c 5 -l 1500

But this requires a copy of spray active on every node and is acitivated in in /etc/service.

control -h out of the command and analyize the network based upon this bomb burst of icmp packets. Note, do during off peak hours. Here's the link:

http://docs.hp.com/en/B2355-60103/spray.1M.html

Note: spray has been around a long time but has been mostly obsoleted by other network analyzers. But for lack of 'etheral' or something else it comes in every unix O/S.

[T W_1]

So if I install ethereal this will make things alot easier then? I have only used it to analyize packets and to to check.

[T W_1]

Rick,

I am checking the trace now, basically the I am sending data from one machine to another and its taking a long time, so the application on the sending host is timeing out. But the receiving host shows no issue just slow data transfer.

Tim

[T W_1]

Rick,

The MAC addresses are the same, basically the I am sending data from one machine to another and its taking a long time, so the application on the sending host is getting to the point it times out and send a fin to initiate tcp session close. But the receiving host shows no issue just slow data transfer.

Tim

[rick jones]

Lets take the application out of the equation - can you install and run netperf on both sides? If your application is generating lots of unidirectional traffic run a netperf TCP_STREAM test, otherwise run a TCP_RR test with request and response sizes set to be "close" to what your application does.

Does netstat on either end report duplicate packets? Do the lanadmin stats count the duplicates? We want to see if the duplicates are "real" or an artifact of running tcpudmp.