Description
The intention of the article is to provide steps to isolate packet loss between directly connected interfaces with larger frame sizes .
user@PE1> ping 192.168.1.1 source 192.168.1.2 size 9150 do-not-fragment count 100
PING 192.168.1.1 (192.168.1.1) from 192.168.1.2: 9150(9178) bytes of data.
9158 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=20.8 ms
9158 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=22.4 ms
9158 bytes from 192.168.1.1: icmp_seq=12 ttl=64 time=29.4 ms
>snip<
35 packets transmitted, 21 received, 40% packet loss, time 34388ms
rtt min/avg/max/mdev = 12.736/38.288/190.566/48.581 ms
Symptoms
Customer reported that on a newly turned up device when they are ping to a directly connected interface with Jumbo frames they are observing packet loss between 25-40% . Packet loss was however not seen with normal frame sizes.
Solution
To isolate the issue check for following.
1. Check for any L1 related issues first .
2. Check the MTU configured on both the local and remote interfaces .
3. Check to see if there are any interface related drops seen on both the local and remote interface.
4.Check for any PFE related drops seen increasing on the FPC’s for both local and remote .
If following checks looks good then we need to check other options.
1. Open two sessions for both the boxes . On one session start a ping and on the other session perform a packet capture matching icmp. Perform the step on both the boxes . Use below KB for reference. Keep an eye on the sequence number on both boxes to see if there are any missing sequence numbers and if there is then which box is reporting it .
https://supportportal.juniper.net/s/article/Junos-Sample-monitor-traffic-interface-CLI-commands-to-filter-and-capture-traffic?language=en_US
2. If from the above step we are unable to narrow down then configure firewall filter. It is important to make sure firewall filter is applied on both ingress and egress on both local and remote box.
user@PE1> show configuration | display set | match JTAC
Aug 09 05:14:20
set interfaces ae1 unit 0 family inet filter output JTAC_TEST
set firewall family inet filter JTAC_TEST term 1 from source-address 192.168.1.2/32
set firewall family inet filter JTAC_TEST term 1 from destination-address 192.168.1.1/32
set firewall family inet filter JTAC_TEST term 1 from protocol icmp
set firewall family inet filter JTAC_TEST term 1 then count TEST
set firewall family inet filter JTAC_TEST term 1 then accept
set firewall family inet filter JTAC_TEST term 2 then accept
user@PE1>show firewall
Aug 09 05:24:01
Filter: JTAC_TEST
Counters:
Name Bytes Packets
TEST 119314 13
Filter: JTAC_TEST_OUT
Counters:
Name Bytes Packets
TEST_O 137670 15
Filter: RE_IPV4_FILTER
Counters:
Name Bytes Packets
DROP 19763 385
Policers:
Name Bytes Packets
POLICER-ICMP 9178 1
---(refreshed at 2024-08-09 05:35:24 UTC)---
Filter: JTAC_TEST
Counters:
Name Bytes Packets
TEST 339586 37
Filter: JTAC_TEST_OUT
Counters:
Name Bytes Packets
TEST_O 413010 45
Filter: RE_IPV4_FILTER
Counters:
Name Bytes Packets
DROP 20617 393
Policers:
Name Bytes Packets
POLICER-ICMP 64246 7
From the firewall output we can see along with JTAC_TEST & JTAC_TEST_OUT the policer filter counter is also increasing , the number of dropped packets on the configured counter is matching with policer counter indicating that there might be rate limiting applied on the Protect RE filter which might be dropping the packet. Check with customer if the policer value can be modified .
Modification History
2024-08-20 : Article Created
Packet loss observed between directly connected interfaces with Jumbo frames .