Trouble shooting Jumbo frames

[Carter Bullard via Argus-info]

Hey Monah,
There is a lot of support for monitoring fragmentation in argus, as it does do fragmentation tracking and reassembly analysis in the sensor.  In some cases, just knowing that fragmentation exists is a tell tale sign of issues, i.e. MTU discovery failure, etc.  If you suspect that errors in fragmentation are an issue, argus can give you some good info.

For IPv4, fragmentation can occur anywhere along the path, and there are complex issues when the end system fragments a packet to one MTU, and a router along the path fragments the fragments to a smaller size. MTU discovery is suppose to eliminate this possibility.  In order for argus to report on fragmentation, it must be “down the line” from the fragmentation process.

Argus will indicate fragmentation on a given flow with the ‘F’ in the flags field.  When argus sees a partial fragment, where it didn’t see the “zero offset” fragment, it will show an ‘f’ in the flags field.

When there are problems with fragments, if the network actually supports fragmentation end to end, which is not a given, there are complex problems that arise when there is loss generally above 2-3%. When the first packet of a fragment is lost, none of the subsequent fragments that are generated can be processed, putting undue load on the network, as any retransmissions will also be fragmented, which can be thought of as a multiplier.  When other fragments are lost, the delay needed to realize that the whole packet isn’t going to show up, can be longer than the protocols retransmission timer, and so you can get really weird behavior, and poor performance.  Argus has the data to provide indications for these conditions.

You can filter for “frags” and you will get all the flows that have experienced frags, whether they are complete flows or if argus saw partial frags. If the network is configured to not support fragmentation, which is common, you should get ICMP unreachable need fragmentation messages. nThe filter for that is “unrfrag”.

Argus has a lot of performance information that it reports for partial fragments, such as fragmentation duration (time to get the frag out), max size of fragment, which is the perceived MTU, , which are all a part of the jitter information that is  in fragmented DSRs, but that may take some magic to print those values.

I suggest that you verify that you are seeing fragments and or partial fragments between the two hosts.  If you are seeing partial fragments, (‘f’ in the flags field), that will tell you that you’ve got a loss condition that will make the QoS of your fragmented flow sucks.  Maybe all that you need to know.

If you would like argus to tell you more about fragments, holler !!!

Carter

> On Apr 26, 2016, at 11:44 AM, Monah Baki via Argus-info <argus-info at lists.andrew.cmu.edu> wrote:
> 
> Hi all,
> 
> We have 2 NetApps in 2 different remote sites, on occasion (triggered
> by the admin or schedule) they send traffic to each other but that
> traffic has some issues and breaks before finishing. They are
> suspecting issues with jumbo frames fragmentation, but for now they
> have no good tools to analyze and prove it.
> 
> Can Argus shed some light into this?
> 
> 
> Thanks
> Monah
>