the fragment table has reached its maximum threshold 16

[shafik.khan9]

Hi,

I there anyone can help me on this..

Cisco C881G-4G-GA-K9 (revision 1.0)

Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.4(3)M4

ERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000269: *Jul 2 08:22:02.951 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000270: *Jul 2 08:22:35.175 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000271: *Jul 2 08:23:06.899 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000272: *Jul 2 08:23:39.010 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16

[Julio E. Moisa]

Hi

The size by default is 16, you could increase that using: virtual-reassembly <max-reassemblies>, also check if you are not having a fragment attack. 

Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_frre/configuration/xe-3s/frre-xe-3s-book/virt-frag-reassembly.html

Please don't forget to rate the comment if it is useful.

:-)

[Georg Pauwen]

Hello,

in addition to Julio's suggestion, when you issue the command 'show ip traffic' you can see how many fragments you are actually receiving (check for 'Frags' in the 'IP Traffic' section). If there are many fragments, there might be a problem with a device along the path sending too many...

[shafik.khan9]

Here are the details,

Is any problem with the Router or Routes 

IP statistics:
Rcvd: 252747 total, 112606 local destination
0 format errors, 0 checksum errors, 15728 bad hop count
63 unknown protocol, 0 not a gateway
0 security failures, 0 bad options, 6627 with options
Opts: 0 end, 0 nop, 0 basic security, 0 loose source route
0 timestamp, 0 extended security, 0 record route
0 stream ID, 0 strict source route, 6627 alert, 0 cipso, 0 ump
0 other
Frags: 472 reassembled, 0 timeouts, 0 couldn't reassemble
83304 fragmented, 166608 fragments, 2975 couldn't fragment
Bcast: 25045 received, 1507 sent
Mcast: 0 received, 0 sent
Sent: 40497 generated, 15077211 forwarded
Drop: 74 encapsulation failed, 0 unresolved, 0 no adjacency
12 no route, 0 unicast RPF, 0 forced drop
0 options denied
Drop: 0 packets with source IP address zero
Drop: 0 packets with internal loop back IP address
1 physical broadcast
Reinj: 0 in input feature path, 0 in output feature path

ICMP statistics:
Rcvd: 1 format errors, 0 checksum errors, 0 redirects, 1 unreachable
724 echo, 26 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 timestamp replies, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
0 time exceeded, 0 info replies
Sent: 0 redirects, 0 unreachable, 164 echo, 724 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp, 0 timestamp replies
0 info reply, 125 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements

UDP statistics:
Rcvd: 96361 total, 0 checksum errors, 85676 no port 0 finput
Sent: 3739 total, 0 forwarded broadcasts

TCP statistics:
Rcvd: 15429 total, 0 checksum errors, 243 no port
Sent: 11031 total

BGP statistics:
Rcvd: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh, 0 unrecognized
Sent: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh

EIGRP-IPv4 statistics:
Rcvd: 0 total
Sent: 0 total

PIMv2 statistics: Sent/Received
Total: 0/0, 0 checksum errors, 0 format errors
Registers: 0/0 (0 non-rp, 0 non-sm-group), Register Stops: 0/0, Hellos: 0/0
Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0
Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0
Queue drops: 0
State-Refresh: 0/0

IGMP statistics: Sent/Received
Total: 0/0, Format errors: 0/0, Checksum errors: 0/0
Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0
DVMRP: 0/0, PIM: 0/0
Queue drops: 0

OSPF statistics:
Last clearing of OSPF traffic counters never
Rcvd: 0 total, 0 checksum errors
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks
Sent: 0 total
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks

ARP statistics:
Rcvd: 44163 requests, 22 replies, 0 reverse, 0 other
Sent: 7216 requests, 20828 replies (0 proxy), 0 reverse
Drop due to input queue full: 0

[Georg Pauwen · Accepted solution]

Hello,

the fragment count looks high. I assume the router is connected directly to the Internet ? Can you post the full configuration ?

[shafik.khan9]

Yes, the router is connected to directly to the internet,

and this is the log for today's 

show log
Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: level critical, 1 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level warnings, 536 messages logged, xml disabled,
filtering disabled
Exception Logging: size (8192 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: disabled

Log Buffer (51200 bytes):
ing the connection from 193.201.224.214
000216: *Jul 3 07:56:59.989 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000217: *Jul 3 07:58:05.988 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000218: *Jul 3 07:59:22.912 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000219: *Jul 3 08:00:59.499 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.214
000220: *Jul 3 08:01:04.878 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000221: *Jul 3 08:02:05.546 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000222: *Jul 3 08:03:12.769 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000223: *Jul 3 08:04:11.557 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000224: *Jul 3 08:05:03.312 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.214
000225: *Jul 3 08:07:31.934 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000226: *Jul 3 08:08:05.154 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000227: *Jul 3 08:09:00.089 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000228: *Jul 3 08:09:09.317 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.158
000229: *Jul 3 08:09:45.193 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000230: *Jul 3 08:10:28.433 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.158
000231: *Jul 3 08:11:49.196 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000232: *Jul 3 08:12:24.403 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000233: *Jul 3 08:12:58.843 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000234: *Jul 3 08:13:35.211 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000235: *Jul 3 08:14:05.238 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000236: *Jul 3 08:14:52.954 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000237: *Jul 3 08:15:29.577 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000238: *Jul 3 08:16:13.505 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000239: *Jul 3 08:16:45.569 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000240: *Jul 3 08:17:51.212 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000241: *Jul 3 08:18:13.424 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.158
000242: *Jul 3 08:19:25.987 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000243: *Jul 3 08:22:25.961 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.158
000244: *Jul 3 08:22:36.085 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000245: *Jul 3 08:24:00.484 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000246: *Jul 3 08:25:06.227 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000247: *Jul 3 08:26:25.926 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000248: *Jul 3 08:27:13.114 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000249: *Jul 3 08:28:15.345 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000250: *Jul 3 08:29:05.077 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000251: *Jul 3 08:29:35.092 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000252: *Jul 3 08:29:44.232 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.158
000253: *Jul 3 08:30:13.036 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000255: *Jul 3 08:30:41.576 PCTime: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 193.201.224.158
000256: *Jul 3 08:30:50.824 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000258: *Jul 3 08:31:25.135 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000259: *Jul 3 08:31:57.267 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000260: *Jul 3 08:32:32.191 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer0: the fragment table has reached its maximum threshold 16
000261: *Jul 3 08:33:02.810 PCTime: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer

[Georg Pauwen]

Can you post the configuration of your router ?

[shafik.khan9]

l

Current configuration : 10053 bytes
!
version 15.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname R1
!
boot-start-marker
boot system flash c800-universalk9-mz.SPA.154-3.M4.bin
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 warnings
logging console critical
enable secret 5 $1$Nmau$HiNrg055D1G1AseJUw.Hh1
!
no aaa new-model
clock timezone PCTime 4 0
!
crypto pki trustpoint TP-self-signed-3904044009
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3904044009
revocation-check none
rsakeypair TP-self-signed-3904044009
!
!
crypto pki certificate chain TP-self-signed-3904044009
certificate self-signed 01
3082025A 308201C3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33393034 30343430 3039301E 170D3134 30393035 30393031
32355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 39303430
34343030 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B5E6 97848889 C86FA33B 43F73ED2 03711312 8B6B2BDB ADBB562F 1587EC5C
850967B2 9F28C09C 1097301C A72F8F4E B689E50D A42C52D0 8E27BBC3 1656631A
67C04792 ED18B872 F488FD38 AC702D02 345B4E5C E9DF9A0F 5CDB6AE2 FF782D00
384CF16D F063FB9C 8B0195AA 23E54AAC D365EBE5 21488BDE 73E3ACFB 863AB927
D4C90203 010001A3 8181307F 300F0603 551D1301 01FF0405 30030101 FF302C06
03551D11 04253023 82214155 482D4146 472D4849 4C414C42 414E4B2E 6166672E
616C6661 7261612E 636F6D30 1F060355 1D230418 30168014 9D862044 F498AA84
04C66A50 F87921C3 01CBE605 301D0603 551D0E04 1604149D 862044F4 98AA8404
C66A50F8 7921C301 CBE60530 0D06092A 864886F7 0D010104 05000381 81008E43
DDA50EB4 754AE59A E9FF54BF A75911A1 CCAF4E46 BD4FA990 17395FD0 AC28507B
CF6BCD3A 32383729 B2D735C0 81C55457 2121F6FF EF4165ED B3A0C6B3 5460823B
BA540C0D 14211539 70A1A1D3 55803AC5 C03FD618 7E9F2C51 80912B3E 87038861
81A927EB 2F18AB64 AC71315B 5F513975 55A44D56 04F85E44 FF1EFB6D 5B98
quit
no ip source-route
!
!
!
!
!
!
!
!

!
ip dhcp excluded-address 192.168.57.1 192.168.57.100
!
ip dhcp pool CONSULTANT
network 192.168.50.0 255.255.255.0
dns-server 50.50.0.1 50.50.0.2 8.8.8.8 4.2.2.2 213.42.20.20
default-router 192.168.50.1
lease infinite
!
!
!
ip flow-cache timeout inactive 100
no ip bootp server
ip name-server 8.8.8.8
ip name-server 4.2.2.2
ip cef
no ipv6 cef
!

!
!
!
!
multilink bundle-name authenticated
!
!
chat-script du "" "ATDT*99#" TIMEOUT 30 "CONNECT"
chat-script lte "" "AT!CALL" TIMEOUT 20 "OK"
!
!
!
!
!
!
cts logging verbose
license udi pid C881G-4G-GA-K9 sn FCZ193190F1
!
!
archive
log config
hidekeys

!
!
!
!
!
controller Cellular 0
lte modem link-recovery rssi onset-threshold -110
lte modem link-recovery monitor-timer 20
lte modem link-recovery wait-timer 10
lte modem link-recovery debounce-count 6
no cdp run
!
ip tcp synwait-time 10
!
class-map match-any BLOCKED
match protocol http host "*youtube.com*"
match protocol http host "*facebook.com*"
match protocol http host "*orkut.com*"
match protocol http host "*www.facebook.com*"
match protocol http host "*espncricinfo.com*"
match protocol http host "www.facebook.com"
match protocol bittorrent
match protocol http host "*www.linkedin.com*"
match protocol http host "*starsports.com*"
match protocol http host "*twitter.com*"
match protocol http host "*aajtak.intoday.in*"
match protocol edonkey
match protocol fasttrack
match protocol gnutella
match protocol kazaa2
match protocol winmx
match protocol cuseeme
match protocol novadigm
match protocol youtube
match protocol streamwork
match protocol viber
match protocol yahoo-messenger
match protocol gtalk
class-map match-any url-block-class
match protocol http host "*youtube*"
match protocol http host "*yahoo*"
match protocol http host "*facebook*"
match protocol http host "*gmail*"
!
policy-map DROP
class BLOCKED
drop
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key
!
!
crypto ipsec transform-set cisco esp-3des esp-sha-hmac
mode tunnel
crypto ipsec df-bit clear
!
!
!
crypto map asa 10 ipsec-isakmp
set peer
set transform-set cisco
match address 101
!
!
!
!
!
!
interface Cellular0
no ip address
ip nat outside
ip virtual-reassembly in
encapsulation slip
shutdown
dialer in-band
dialer pool-member 2
async mode interactive
crypto map asa
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
switchport access vlan 57
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 57
no ip address
!
interface FastEthernet4
description **** INTERNET ****
no ip dhcp client request tftp-server-address
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
crypto map asa
crypto ipsec df-bit clear
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 50.57.1.1 255.255.0.0
ip access-group 114 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow monitor NETFLOW1 input
ip flow ingress
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan57
ip address 192.168.50.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow monitor NETFLOW1 input
ip flow ingress
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412
!
interface Dialer0
mtu 1492
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow monitor NETFLOW1 input
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname cons123
ppp chap password 7 0914491840514165E
ppp pap sent-username cons123 password 7 101685C43430F59
no cdp enable
crypto map asa
crypto ipsec df-bit clear
!
ip forward-protocol nd
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip flow-export source Vlan1
ip flow-export version 5
ip flow-export destination 50.50.9.100 9996
!
ip tftp source-interface Vlan1
ip nat inside source route-map nonat interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
ip ssh time-out 60
ip ssh authentication-retries 2
!
no logging trap
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
!
route-map nonat permit 10
match ip address 110
!

snmp-server ifindex persist
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.99.0.0 0.0.255.255
access-list 101 permit ip 50.57.0.0 0.0.255.255 50.50.0.0 0.0.0.3
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.9.3
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.8.35
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.0.15
access-list 101 permit ip 50.57.0.0 0.0.255.255 50.50.9.0 0.0.0.255
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.8.38
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.51.0.25
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.8.30
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.8.48
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.9.100
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.9.101
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.9.10
access-list 101 permit ip 50.57.0.0 0.0.255.255 host 50.50.0.25
access-list 110 deny ip 50.57.0.0 0.0.255.255 50.50.0.0 0.0.255.255
access-list 110 deny ip 50.57.0.0 0.0.255.255 host 50.51.0.25
access-list 110 permit ip 50.57.0.0 0.0.255.255 any
access-list 110 permit ip 192.168.50.0 0.0.0.255 any
access-list 114 permit ip any 86.96.100.64 0.0.0.15
access-list 114 permit ip any 86.96.138.160 0.0.0.31
access-list 114 permit ip any 10.0.0.0 0.127.255.255
access-list 114 deny tcp any any eq 445
access-list 114 deny udp any any eq 445
access-list 114 deny tcp any any eq 137
access-list 114 deny udp any any eq netbios-ns
access-list 114 deny udp any any eq netbios-dgm
access-list 114 deny tcp any any eq 138
access-list 114 deny tcp any any eq 139
access-list 114 deny udp any any eq netbios-ss
access-list 114 permit ip any any
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
privilege exec level 2 traceroute
privilege exec level 2 ping
banner motd ^C

^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line 3
script dialer du
no exec
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
scheduler interval 500
!
!
!
end

[Georg Pauwen]

Hello,

to find out what packet size is accepted without fragmentation, send pings with different sizes as in the example below. In your case, you have two destinations, encrypted traffic, and NATted traffic, so you would need to perform the below test for both. At what packet size do you get a reply ?

C:\windows\system32>ping -l 1500 -f 8.8.8.8

Pinging 8.8.8.8 with 1500 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\windows\system32>ping -l 1472 -f 8.8.8.8

Pinging 8.8.8.8 with 1472 bytes of data:
Reply from 8.8.8.8: bytes=64 (sent 1472) time=17ms TTL=45
Reply from 8.8.8.8: bytes=64 (sent 1472) time=15ms TTL=45
Reply from 8.8.8.8: bytes=64 (sent 1472) time=16ms TTL=45
Reply from 8.8.8.8: bytes=64 (sent 1472) time=17ms TTL=45

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 15ms, Maximum = 17ms, Average = 16ms

[shafik.khan9]

Thanks, let me check