IPerf is a tool to measure network throughput.
Maximum TCP throughput – the user experiences “low bandwidth” when up/downloading
Maximum TCP throughput calculations:
There are several important things what you should know before reading this.
Please check TCP/IP fundamentals at http://www.tcpipguide.com/free/index.htm
Common window sizes:
Standard 64KB
Windows XP 17.5KB
FTP 8KB
SCP 64KB
SMB 16K/4K
TCP throughput:
http://wand.net.nz/~perry/max_
http://www.babinszki.com/
Data throughput in TCP based on TCP window size and latency:
FTP TCP window 8KB -> 65356bit
RTT=60ms=0.06s
Maximum TCP transfer = 65356bit/0.06s=1.038Mbps
General TCP window 64KB -> 524288bit
RTT=60ms=0.06s
Maximum TCP transfer = 524288bit/0.06s=8738133,33bps = 8.533.33Mbps
DataMover TCP window 256KB -> 2097152bit
RTT=60ms=0.06s
Maximum TCP transfer = 2097152bit/0.06s=33.33Mbps
Throughput can never exceed window size divided by round-trip time.
window = 17520byte = 140160
rtt 60ms = 0.06s
Max link throughput (based on window and rtt) = 140160bit/0.06s=2336000 = 2281,25kbps
The capacity of a pipe is its bandwidth multiplied by round-trip time.
BW = 2Mbps = 2097152bps
rtt = 60ms = 0.06s
Max link capacity (based on BW and rtt) = 125829,12bit = 15728,64byte
Formula to calculate the optimal TCP window size:
Bandwidth-in-bits-per-second * Round-trip-latency-in-seconds = TCP window size in bits / 8 = TCP window size in bytes
BW = 2Mbps = 2097152bps
rtt = 60ms = 0.06s
2097152bps * 0.06s = 125829,12bit = 15728,64byte — ideal window size
Formula to calculate Maximum Latency for a desired throughput
TCP-window-size-bits / Desired-throughput-in-bits-
TCP window size = 17520byte = 140160bit
desired BW = 2Mbps = 2097152bps
140160bit / 2097152bps = ~0.067ms is the max RTT for the desired 2M throughput
Please consider that these values are IP packets, not frames (or Layer2 bandwidths) or the packets’ data transers.
Layer2 overheads will “decrease” the link capacity: http://sd.wareonearth.com/~phil/net/overhead/
2 hosts on different LANs cannot communicate to each other..
[HOST1]=[ETH SWITCH]=[ROUTER1 ** CLOUD ** ROUTER2]=[ETHSWITCH]=[HOST2]
HOST1: 10.0.0.100/24 – def.gw: 10.0.0.1
HOST2: 10.0.1.100/24 – def.gw: 10.0.1.1
You have access only to the routers.
HOST1 is pingable from ROUTER1 but not pingable from HOST2/ROUTER2.
Traceroute from HOST2 to HOST1 stops at the ROUTER1.
Traceroute from HOST1 to HOST2 has no hops.
Possible problems:
@0: Please check the router interface configurations: IPs and masks are correct?
@1: Please never trust the host settings:
If HOST1 has a bad default gateway then it can routes the ping/traceroute into a black hole.
@2: Please never trust the host settings:
If HOST1 has a bad subnet mask (255.255.254.0 instead of 255.255.255.0)
then HOST1 thinks that HOST2 is in the same LAN segment of her!
10.0.0.0/23 -> hosts: 10.0.0.1 .. 10.0.1.254 -> HOST2 is falling into this range.
You can see (on a Cisco router) if the problem is one of these by:
Please issue term mon and then deb arp and watch the incoming
ARP requests and look for the unreachable HOST1’s entries.
Ask HOST1’s operator to clear the ARP cache, HOST1 should resolve
the MAC address of the default gateway and you should see this
request on the router (ARP is L2 broadcast). You also should see
if HOST1 tries to resolve the MAC of HOST2. (If you have Junipers
you can user the monitor interface traffic commands to achieve the
same ARP wathing function).
Then ask the operator to check the host IP configuration (static/DHCP IPs?).
If this not lead into success please ask to check the HOST1 firewall rules
(may be HOST2 also) and the ACLs applied on the interfaces in the path.
Another problem:
HOST1 is conf’d to use DHCP to obtain IP address.
If the DHCP server not send an offer (not reachable for HOST1 or there
is a restriction for HOST1’s MAC address.. etc..) then a Windows host
will give an address to the interface of the link-local range 169.254.0.0/16
(zero config networking). If this happens the trace from HOST2 also stops
at ROUTER1. You can check this if you configure the interface IP of ROUTER1
(facing to HOST1) to 169.254.0.1/16 and ping the address 169.254.255.255
and HOST1 will reply, you will see the ARP entry in ARP cache and you can
say the MAC address of HOST1 to the operator to check if it is really HOST1.
How to simulate WAN delay/latency in GNS3
Add Microcore linux host to GNS3
How to check an actual Cisco IP Phone telephone call’s statistics on the phone itself
Switch port port-security maximum MAC address when using IP phone
Switch port port-security maximum MAC address when using IP phone
on the switch link with microswitch for PC connectivity on the phone:
Problem: [switch]–[IP Phone]–[PC]
If the user’s switchport config is like this:
errdisable recovery cause psecure-violation
errdisable recovery interval 600
!
interface x/y/z
switchport port-security aging time 5
switchport port-security aging type inactivity
switchport port-security violation shutdown
switchport port-security maximum 2
switchport port-security maximum 1 vlan access
switchport port-security maximum 1 vlan voice
Ideally this will work. But it will cause problems.
When the user turn on the PC he/she will see a system notification that
the link went down (and the phone switched of of PoE powered or loss
the connectivity to the switch). This is because of the port-security config
and a strange bahavior of the IP Phone.
At start the phone is using it’s MAC for CDP in both VLANs, in the native
and the voice also because at startup the the phone not know which is
the voice VLAN -> 2 MAC. When the PC come up and sends a single
packet (DHCP, ARP..) then we have a 3rd MAC. Until the MAC of the phone
in the data (native) VLAN not aged out the port will be secured. If you are
lucky then the phone remains up and got power and not forget the voice
VLAN. After the aging time expires and the auto recovery recovered the
port the PC can communicate because the MAC aging already deleted the
MAC of the phone from the data VLAN. And another problem: some phones
have a weird behavior. The phones have a feature of CDP: the host presence
type length value (TLV) to notify the switch of changes in the attached device’s
port link state. The phones generates this CDP frame in the voice VLAN – this
is a control message to the switch to remove the PC’s MAC from the CAM table.
But some phone plattforms (in my experience) generates this message in the
data (native) VLAN so the switch sees the phone’s MAC in both VLANs. This
leads to the problem that when the PC booted and send the first packet the
switch will secure the port because of the MAC violation. After the MAC aging
time and the automatic error recovery of the port the PC will be able to send
and receive packets on the port.
Solution:
interface x/y/z
switchport port-security maximum 3
switchport port-security maximum 2 vlan access
switchport port-security maximum 1 vlan voice
How to check packet marking and traffic instantly
#How to check packet marking and traffic instantly
##################################################
#Config part
interface ...
ip flow ingress
ip flow egress
# To see the result:
sh ip cache flow -- complete list of flows
sh ip cache verbose flow -- complete list of flows, each flow will be verbosely showed (example type of service field)
sh ip cache ip.network.to.check network.mask.for.that verbose flow -- flow will be verbosely showed for a specifig range of IP(s) (example type of service field ; netmask can be 255.255.255.255 to see only one host)
# If you have MLS:
# Config part
mls ip multicast flow-stat-timer 9
mls aging fast time 16
mls aging long 64
mls aging normal 64
mls flow ip interface-full
no mls flow ipv6
mls nde sender
mls qos
mls cef error action reset
# To check MLS QoS netflow
sh mls netflow ip <source|destination> <IP.you.want.to.see> qos nowrap | i <whatever..>
Sample outputs:
#sh ip cac fl
IP packet size distribution (20259790 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .364 .343 .094 .114 .001 .001 .000 .000 .000 .050 .000 .000 .000 .000
packet size distribution — 64 byte and .364 means 36.4% of the traffic
is between packet size 32byte and 64byte and so forth
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .019 .000 .006 .001 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
13 active, 4083 inactive, 11467910 added
277423652 ager polls, 0 flow alloc failures
Active flows timeout in 5 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 34056 bytes
13 active, 1011 inactive, 11467886 added, 11467886 added to flow
0 alloc failures, 0 force free
1 chunk, 1 chunk added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
——– Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 568 0.0 36 41 0.0 3.3 12.3
TCP-WWW 184 0.0 3 328 0.0 0.6 7.3
TCP-BGP 1423795 0.3 5 56 1.9 35.1 14.5
TCP-other 7708 0.0 27 341 0.0 8.5 7.2
UDP-DNS 3539 0.0 1 74 0.0 0.3 15.5
UDP-NTP 150741 0.0 1 76 0.0 0.0 15.3
UDP-Frag 3 0.0 2 373 0.0 0.0 15.5
UDP-other 8590603 2.0 1 152 2.2 0.1 15.4
ICMP 1156084 0.2 1 96 0.4 4.4 15.4
Total: 11333225 2.6 1 108 4.7 5.0 15.3
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Gi0/1.100 10.207.3.17 Local 10.207.3.18 06 00B3 2B19 2
Protocol 06 (hex value) = TCP
Protocol 11 (hex value) = UDP
Protocol 01 (hex value) = ICMP
#sh ip cac ve fl
IP packet size distribution (20259839 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .364 .343 .094 .114 .001 .001 .000 .000 .000 .050 .000 .000 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .019 .000 .006 .001 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
9 active, 4087 inactive, 11467921 added
277423910 ager polls, 0 flow alloc failures
Active flows timeout in 5 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 34056 bytes
9 active, 1015 inactive, 11467897 added, 11467897 added to flow
0 alloc failures, 0 force free
1 chunk, 1 chunk added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
——– Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 569 0.0 36 41 0.0 3.3 12.3
TCP-WWW 184 0.0 3 328 0.0 0.6 7.3
TCP-BGP 1423797 0.3 5 56 1.9 35.1 14.5
TCP-other 7710 0.0 27 341 0.0 8.5 7.2
UDP-DNS 3539 0.0 1 74 0.0 0.3 15.5
UDP-NTP 150741 0.0 1 76 0.0 0.0 15.3
UDP-Frag 3 0.0 2 373 0.0 0.0 15.5
UDP-other 8590613 2.0 1 152 2.2 0.1 15.4
ICMP 1156084 0.2 1 96 0.4 4.4 15.4
Total: 11333240 2.6 1 108 4.7 5.0 15.3
SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs Pkts
Port Msk AS Port Msk AS NextHop B/Pk Active
Gi0/1.100——xx.xxx.xxx.xxx—Local———–10.212.200.132–11-00—10——–1
incoming and outgoing interface//source and destination IP addresses (next hops may be..)
007B /26 0 007B /32 0 0.0.0.0 76 0.0
Gi0/0 10.207.3.26 Local 10.207.3.25 06 C0–18——-3
ToS value is the 8 byte of the IP field : C0 -> 11000000 bin – DSCP CS6 – IP Precedence 6
423B /30 0 00B3 /0 0 0.0.0.0 52 13.3
Gi0/1.100 xx.xxx.xxx.xx Local 10.212.200.132 06 00 1A 3—- packet means packets per active seconds
0031 /26 0 D08D /32 0 0.0.0.0 47 0.1—- active seconds
Gi0/1.100 xx.xxx.xxx.xx Local 10.212.200.132 11 00 10 2
9BE7 /26 0 00A1 /32 0 0.0.0.0 76—–0.0—- bytes per packets
ToS <> DSCP
ToS ToS ToS ToS DSCP DSCP DSCP DSCP
dec hex bin prec bin hex dec name
bin
0 0×00 00000000 000 000000 0×00 0 none/default
32 0×20 00100000 001 001000 0×08 8 cs1
40 0×28 00101000 001 001010 0x0A 10 af11
48 0×30 00110000 001 001100 0x0C 12 af12
56 0×38 00111000 001 001110 0x0E 14 af13
64 0×40 01000000 010 010000 0×10 16 cs2
72 0×48 01001000 010 010010 0×12 18 af21
80 0×50 01010000 010 010100 0×14 20 af22
88 0×58 01011000 010 010110 0×16 22 af23
96 0×60 01100000 011 011000 0×18 24 cs3
104 0×68 01101000 011 011010 0x1A 26 af31
112 0×70 01110000 011 011100 0x1C 28 af32
120 0×78 01111000 011 011110 0x1E 30 af33
128 0×80 10000000 100 100000 0×20 32 cs4
136 0×88 10001000 100 100010 0×22 34 af41
144 0×90 10010000 100 100100 0×24 36 af42
152 0×98 10011000 100 100110 0×26 38 af43
160 0xA0 10100000 101 101000 0×28 40 cs5
184 0xB8 10111000 101 101110 0x2E 46 ef
192 0xC0 11000000 110 110000 0×30 48 cs6
224 0xE0 11100000 111 111000 0×38 56 cs7
linkek — Cisco interface and data analyzers
Cisco — How to change telnet port for a Cisco router — not the rotary group solution!
R2#tel 172.16.0.100 23
Trying 172.16.0.100 …
% Connection timed out; remote host not responding
R2#tel 172.16.0.100 9999
Trying 172.16.0.100, 9999 … Open
User Access Verification
Password:
R3>
<..omitted..>
Config on the R3 router:
___________________
ip nat inside source static tcp <desired IP address, ex. the loopback..> 23 <same IP as the previous..> <desired port>
interface <interface for the desired IP>
ip nat outside