cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
603
Views
5
Helpful
4
Replies

Question about Ping: Source Quence Response

samuel.shen
Level 1
Level 1

Hi folks,

I saw a message regrading the ping command:

64 bytes from 16.40.2.1: icmp_seq=372. time=5 ms

64 bytes from 16.40.2.1: icmp_seq=373. time=5 ms

64 bytes from 16.40.2.1: icmp_seq=374. time=4 ms

64 bytes from 16.40.2.1: icmp_seq=375. time=5 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=376. time=7 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=377. time=5 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=378. time=5 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=379. time=5 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=380. time=5 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=381. time=6 ms

ping: Source Quence response from 16.40.2.1

64 bytes from 16.40.2.1: icmp_seq=382. time=7 ms

Could anyone explain the meaning of the "source quence response'?

I did some knowledge search about ICMP, is any relationship with the situation?

Thanks in advance.

-----------------------------------------------------

The Internet Control Message Protocol (ICMP) is part of the internetwork layer and uses the IP datagram delivery facility to send its messages. ICMP sends messages that perform the following control, error reporting, and informational functions for the TCP/IP protocol suite:

Flow control. When datagrams arrive too quickly for processing, the destination host or an intermediate gateway sends an ICMPsource quench message back to the sender. This message instructs the source to stop sending datagrams temporarily.

4 Replies 4

marikakis
Level 7
Level 7

Your knowledge search is absolutely relevant to the situation.

Ping sends ICMP echo requests, and gets back ICMP echo replies.

Requests are usually rate-limited by most common ping utilities,

otherwise the destination could be overwhelmed.

So, I am curious what kind of naughty tool are you using to achieve this quench.

M.

marikakis
Level 7
Level 7

The destination 16.40.2.1 is part of the 16.0.0.0/8 block of AS33,

and is assigned to Digital Equipment Corporation.

So, now I am curious what exactly are you trying to accomplish with this naughty tool.

Are you overwhelming your own devices or is this some lab test ?

M.

Hi Maria,

Appreciate your response and sorry for posting this issue on other forums to confuse you.

It's our lab test for some telecom cutomers, 16.0.0.0/8 is HP(or Compaq) own IP pool, we're doing some stress test on HP, Cisco and Nokia network elements.

Actually, I didn't use any special tool, just use the normal ping command on UNIX server to the Cisco and Nokia equipments, then for a while, I saw this kind of message. Does it mean my network elements get HW problem?

Thanks a lot!

marikakis
Level 7
Level 7

Hello Samuel,

I am terribly sorry for my curiosity.

I try hard, but I sometimes fail to stop it :-)

I am Greek and perhaps my English is not very good, but I haven't managed

to find the word "Quence" (printed by your utility) even in dictionaries on the Internet.

You mean that the Unix machine has a ping utility with typos on messages ?

I have never achieved to quench a device by using unix ping utilities,

but perhaps I have never tried hard enough.

I think that usually there is a 1 second period between successive ICMP echo requets.

Can you confirm that your utility does that with some sniffer ?

If it does, then probably the quench was achieved because you probably

tried from many locations to hit the Device Under Test.

I remember seeing somewhere that cisco devices won't send a quench

back to the source beginning with some software versions and later.

I think this quench is deprecated.

Just curious (again!), but have you managed to get a quench response

from any of the cisco DUTs you have in your lab ?

Regarding the meaning of quench, usually this means some queue is full

and the device starts dropping packets.

If you are very persistent, you might push the system to its limits and crash it.

The crash could be initiated from software or hardware (watchdog),

but does it really matter ?

You probably do black-box testing with those other vendors devices.

Unless you are a developer and want to fix the device or extend the system limits.

Also have in mind that the packet size you use while testing

can have a significant effect on the test results.

Hitting devices with high-rate small packets from multiple locations

is not what I would say tender.

This way you are not simulating real traffic patterns.

Only perhaps DDoS can compare to this.

Of course, it can be useful to know how much evil

your DUTs can handle.

Maria