How to check for packet loss and possible network issues

How to check for packet loss and possible network issues.

If you experience packet loss, or if you hear from others that your server or website is not reachable, your server is not always the problem. Because server requests always pass more then one router, issues could be somewhere in the communication between the requester and your server.

The very first network test: Can I ping it?

The first thing to test is to ping your server. Therefore you have to make sure ping is allowed on your server. In debugging issues it is important to check everything. So please make sure you do a proper ping test!

If you can ping the server there is not blockage. But there might be some packet loss on the way. Now we have to find where the packet loss comes from.

My server seems to have has packet loss

If you are experiencing packet loss, then we will need some evidence of this. Simple statements such as "my ping is bad" or "there is packet loss to my server" are unfortunately not enough for an error analysis.

A trace (in both directions) with at least 100 packets with a tool like mtr/WinMTR is useful. mtr can be installed via the package manager of the Linux distribution, while for Windows it can be downloaded from a specific website.

The following table lists the ways this tool can be installed/downloaded for different Operating Systems.

Linux  
- Debian/Ubuntu: apt-get update && apt-get install mtr-tiny
- SuSE: zypper install mtr
- Gentoo: emerge -av mtr
- Red Hat/CentOS: yum install mtr
Windows  
- All versions  http://winmtr.net/


Please follow these guidelines to create traces that are useful for our technicians:
 - At least 100 packets should be sent
 - Each trace should be done in both directions, i.e. externally to the server and from the server back

In Linux based systems use this command:

mtr -r -w -c 100 www.google.com

For IPv6, please use a command like:

mtr -6 -r -w -c 100 www.google.com

The test usually takes about 5 minutes.

Examples of good output. The target is reached, there is no network problem with your server:

NO PROBLEMS AT ALL:
# mtr -r -w -c 100 www.heise.de
HOST: kvm-lps-de02                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- gw.de.ffm.edis.at                             0.0%   100    0.4   3.3   0.4  11.3   3.6
  2.|-- tnggbt.meitner.router.frankfurt.de.velia.net  0.0%   100    0.5   5.5   0.4  25.6   6.5
  3.|-- te0-0-2-3.c350.f.de.plusline.net              0.0%   100    1.2   1.5   0.9   4.4   0.8
  4.|-- 82.98.102.5                                   0.0%   100    0.8   2.1   0.6  25.7   4.2
  5.|-- 212.19.61.13                                  0.0%   100    0.9   1.1   0.8   2.9   0.3
  6.|-- www.heise.de                                  0.0%   100    0.8   0.9   0.7   1.5   0.1

PACKET LOSS on the way, is just saying the router on the way is not reacting on ICMP requests. The target is reached, there is no network problem with your server:
# mtr -r -w -c 100 www.heise.de
HOST: kvm-lps-de02                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- gw.de.ffm.edis.at                             0.0%   100    0.4   3.3   0.4  11.3   3.6
  2.|-- tnggbt.meitner.router.frankfurt.de.velia.net  0.0%   100    0.5   5.5   0.4  25.6   6.5
  3.|-- te0-0-2-3.c350.f.de.plusline.net              0.0%   100    1.2   1.5   0.9   4.4   0.8
  4.|-- 82.98.102.5                                  90.0%   100    0.8   2.1   0.6  25.7   4.2
  5.|-- 212.19.61.13                                 90.0%   100    0.9   1.1   0.8   2.9   0.3
  6.|-- www.heise.de                                  0.0%   100    0.8   0.9   0.7   1.5   0.1

Output with problems:

PACKET LOSS at the end means the target is not reached or with much loss. There is an issue:
# mtr -r -w -c 100 www.heise.de
HOST: kvm-lps-de02                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- gw.de.ffm.edis.at                             0.0%   100    0.4   3.3   0.4  11.3   3.6
  2.|-- tnggbt.meitner.router.frankfurt.de.velia.net  0.0%   100    0.5   5.5   0.4  25.6   6.5
  3.|-- te0-0-2-3.c350.f.de.plusline.net              0.0%   100    1.2   1.5   0.9   4.4   0.8
  4.|-- 82.98.102.5                                   0.0%   100    0.8   2.1   0.6  25.7   4.2
  5.|-- 212.19.61.13                                 70.0%   100    0.9   1.1   0.8   2.9   0.3
  6.|-- www.heise.de                                 90.0%   100    0.8   0.9   0.7   1.5   0.1

LOOPS between two routers can be caused by a poorly configured router on the way. The target will not be reached. There is an issue:
# mtr -r -w -c 100 www.heise.de
HOST: kvm-lps-de02                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- gw.de.ffm.edis.at                             0.0%   100    0.4   3.3   0.4  11.3   3.6
  2.|-- tnggbt.meitner.router.frankfurt.de.velia.net  0.0%   100    0.5   5.5   0.4  25.6   6.5
  3.|-- te0-0-2-3.c350.f.de.plusline.net              0.0%   100    1.2   1.5   0.9   4.4   0.8
  4.|-- 82.98.102.5                                   0.0%   100    0.8   2.1   0.6  25.7   4.2
  5.|-- 212.19.61.13                                  0.0%   100    0.0   0.0   0.0   0.0   0.0
  6.|-- 212.19.61.12                                  0.0%   100    0.0   0.0   0.0   0.0   0.0
  7.|-- 212.19.61.13                                  0.0%   100    0.0   0.0   0.0   0.0   0.0
  8.|-- 212.19.61.12                                  0.0%   100    0.0   0.0   0.0   0.0   0.0
  9.|-- ???                                           0.0%   100    0.0   0.0   0.0   0.0   0.0
 10.|-- ???                                           0.0%   100    0.0   0.0   0.0   0.0   0.0

If this shows a problem, please submit a ticket via https://support.edis.at/ or by simply writing a mail to support@edis.at. Please include all mtr reports (also as screenshot if not possible to copy/paste it) and the IP address of your server in the mail and make sure to write it in plain text or Monospace font to make it readable for us.

Extra info:

Please do not use flood pings for troubleshooting use. This will be seen in many networks (not just at EDIS) as an attack and can cause the originating server to be very quickly removed from the network!

 

 

 

Add Feedback