Y
Y
Yaroslav Zelensky2021-05-07 13:19:13
Computer networks
Yaroslav Zelensky, 2021-05-07 13:19:13

Where does the strange “downward” Ping come from from the server?

About a couple of weeks ago, Zabbix started swearing at one of the servers that it had a high ping.
The error appears for 15 minutes and disappears. - I thought it was an overload of the network adapter, I was looking for what loads, if there are backups or tasks for these intervals. As it turns out, there is nothing like that.

I started to dig deeper and saw this picture - a sharp jump in ping and its slow decline. This happens only on every second packet:

Response from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Response from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Response from 192.168.0.9: number of bytes= 4 time<1ms TTL=128 Response from 192.168.0.9: number of bytes=4 time=774ms TTL=128 Response from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Response from 192.168.0.9: number of bytes=4 time=779ms TTL=128
Response from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=737ms TTL=128
Reply from 192.168.0.9: byte count=4 time=1ms TTL=128
Response from 192.168.0.9: byte count=4 time=700ms TTL=128
Response from 192.168.0.9: byte count=4 time<1ms TTL=128
Response from 192.168. 0.9: byte count=4 time=668ms TTL=128
Response from 192.168.0.9: byte count=4 time<1ms TTL=128
Response from 192.168.0.9: byte count=4 time=648ms TTL=128
Response from 192.168.0.9: byte count=4 time<1ms TTL=128
Response from 192.168.0.9: byte count=4 time=610ms TTL=128
Response from 192.168.0.9: byte count=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=563ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=514ms TTL=128
Reply from 192.168.0.9: byte count=4 time<1ms TTL=128 Response from 192.168.0.9: byte count=4 time=339ms TTL=128 Response from 192.168.0.9: byte count=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=469ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=436ms TTL=128
Reply from 192.168.0.9: byte count=4 time<1ms TTL=128
Response from 192.168.0.9: byte count=4 time=388ms TTL=128
Response from 192.168.0.9: byte count=4 time<1ms TTL=128 Response from 192.168. 0.9: byte count=4 time=299ms TTL=128 Response from 192.168.0.9: byte count=4 time<1ms TTL=128 Response from 192.168.0.9: byte count=4 time=269ms TTL=128 Response from 192.168.0.9: byte count=4 time<1ms TTL=128 Response from 192.168.0.9: byte count=4 time=253ms TTL=128 Response from 192.168.0.9: byte count=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=208ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time=158ms TTL=128
Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128 Reply from 192.168.0.9: number of bytes=4 time=72ms TTL=128 Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128 Reply from 192.168. 0.9: number of bytes=4 time=35ms TTL=128 Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128 Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128 Reply from 192.168.0.9: number of bytes=4 time<1ms TTL=128 The driver is new. There have been no recent policy or network configuration changes. On the contrary, he even reduced the load on the network to please remote workers.
Response from 192.168.0.9: byte count=4 time=113ms TTL=128
Response from 192.168.0.9: byte count=4 time<1ms TTL=128

Where to dig? What to do?

Answer the question

In order to leave comments, you need to log in

2 answer(s)
U
unseriously, 2021-05-07
@unseriously

Does it occur at the same time?
What is the ping from other nodes? From other nodes while zabbix swears what ping?
Do other nodes from the Zabbix server ping without similar problems?

A
Alexander Buliterov, 2021-05-17
@bullitufa

Not enough info!
You may have a problem in 3 places: on the PC that is pinging, the network, the PC (server) that is being pinged.
In my opinion, there is no problem to exclude 1 and 2: we ping from other PCs from other networks.
Linux server? Twist the server logs, Wireshark to hang up on the ICMP protocol on the server.
Good luck!

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question