time=424ms

[Ibrahim Jamil]

Hi Folks

How to start the Root cause analysis for the below ping

Reply from 10.220.100.100: bytes=32 time=424ms TTL=255
Reply from 10.220.100.100: bytes=32 time=213ms TTL=255

[vmiller]

trace route.

your times will accumulate.

[tj.mitchell]

kinda of hard to state...

where is it from and going to? -- Geographical locations?

what is the transport for the ICMP?

how much traffic was going over the circuit at that time?

what is that device 10.220.100.100?

who is the carrier, what are the SLA agreements?

what's is the QoS settings?

need to understand all this just to start understanding what is required to troubleshoot the issue..

[Ibrahim Jamil]

Expalin these:

what is the transport for the ICMP?

how much traffic was going over the circuit at that time?

[tj.mitchell]

Transport -- MPLS over T1/E1, bonded T1/E1, DS3, VPLS, Metro-E link,  direct fiber between locations... what is it traveling over for media?

Were the circuits pegged or completely utilized at the time. Where the circuits having no traffic on it what so ever.

These all are items to think about or understand prior to going down the root-cause. Pings are usually the lowest on the list of items that a device needs to answer. So if your pinging router/switch to router/switch then it's one of the lowest items in the processing of packets.

Just a few thoughts..

[Ibrahim Jamil]

Hi Tj

MPLS over direct fiber between Location

do you think that Delay  causing Latency and error when the Database replicate between Two Sites?

What utlitirs is usefull in troubleshooting from ur point of view id the ping has low Priority

[tj.mitchell]

If you are doing replication between locations, then yes the circuits are going to be use quite a bit more causing higher delay in ping packets.

Also, if you want look at the circuit interface stats and check the load for x/255, if the load is getting higher then your going to be waiting more ICMP packets typically.

Use a sniffer (wireshark is good) and capture the packets. Look through the captures and see if there are issues in there. You could also run netflow and verify traffic flows are what you expect. You could also try NBAR on the routers and see if there is anything there as well.

Just some thoughts??