[lug] Dropped packet question

[Chip Atkinson]

Thanks.  I'm not seeing errors or dropped packets in ifconfig, which is
kind of weird, isn't  it?  If ping reports dropped packets, wouldn't that
droppage appear in the output of ifconfig?  

On Fri, 27 Sep 2013, Dan Ferris wrote:

> Start with something easy.  Check ifconfig and see if there are errors 
> on the interface.  If so, then start by checking hardware. You could 
> have a bad cable, bad nic, bad switch port, or a duplex mismatch.
> 
> Dan
> 
> On 9/27/2013 9:31 AM, Davide Del Vento wrote:
> > Since you control the server, don't the logs tell you something about
> > the dropped packets? Since you don't see drops with the netbook, you
> > can rule out the rest of the network: it must be the server box.
> >
> > It may be dropping packets for a variety of reasons, just to mention a
> > couple of stupid ones: a defective network card or too high CPU load.
> >
> > Cheers,
> > Davide
> >
> > On Thu, Sep 26, 2013 at 8:48 AM, Chip Atkinson <chip at pupman.com> wrote:
> >> Greetings all,
> >>
> >> Due to the recent flooding I had to change data centers from my parents'
> >> basement to mine, which resulted in re-doing my network.
> >>
> >> Now that I've moved and re-IPed the server, I'm seeing large numbers of
> >> dropped packets, slow ping times, basic network malaise.  I've been
> >> running a series of 100 pings 5 sec apart and then looking at the reported
> >> loss figures.
> >>
> >> With comcast's help, I believe that we've eliminated them and their
> >> hardware.
> >>
> >> I put a small linux netbook on the network in place of the server and was
> >> able to ping it from outside (vpn to work and out from there) and the
> >> ping response time and dropped packets were basically gone.  Besides being
> >> newer hardware and OS, the netbook had no services (web, dns, email).
> >>
> >> I then connected the server and see the dropped packet and slow ping time
> >> issue again.
> >>
> >> I was using tcpdump and noticed that a large portion of the traffic is DNS
> >> lookups:
> >>
> >> 08:42:23.411809 IP (tos 0x0, ttl  64, id 42252, offset 0, flags [+],
> >> length: 1500) 173.14.7.2.53 > 108.174.149.7.2305:  13490| 250/0/1
> >> bitstress.com. SOA[|domain]
> >> 08:42:23.411817 IP (tos 0x0, ttl  64, id 42252, offset 1480, flags [+],
> >> length: 1500) 173.14.7.2 > 108.174.149.7: udp
> >> 08:42:23.411822 IP (tos 0x0, ttl  64, id 42252, offset 2960, flags [none],
> >> length: 1150) 173.14.7.2 > 108.174.149.7: udp
> >>
> >> Googling found this:
> >> http://dnsamplificationattacks.blogspot.com/2013/09/domain-bitstresscom.html
> >>
> >> My question is whether or not the dns traffic could be responsible for all
> >> the dropped network packets or should I start looking elsewhere for the
> >> problem?
> >>
> >> I switched network interfaces and took the original server network
> >> interface off the network, thinking that it could be broadcasting a bunch
> >> of noise but still am seeing packet losses, though perhaps not as severe.
> >>
> >>
> >> Thanks in advance for any insight and help.
> >>
> >> Chip
> >>
> >>
> >> _______________________________________________
> >> Web Page:  http://lug.boulder.co.us
> >> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> >> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
> > _______________________________________________
> > Web Page:  http://lug.boulder.co.us
> > Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> > Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>