archive mirror
 help / color / mirror / Atom feed
From: Christian Hammers <>
Subject: icmp_ratelimit seems to be too low (related to NAT?)
Date: Mon, 5 May 2003 11:35:23 +0200	[thread overview]
Message-ID: <> (raw)


icmp_ratelimit has, as of kernel 2.4.20, a default of 100 (which unit
btw?). This seems to be too low as I have packet loss when doing two
"mtr" to the same 4 hops away host simultaneously. As this suggerates
packet loss on the network to the administrator, a too low limit will 
certainly annoy network admins as it gives wrong information.

My tests gave the following results:

src. linux --> SNAT'ing linux router --> cisco1 --> cisco2 --> dst. linux

On the src linux host I opened _two_ mtr at the same time and watched
the packet loss at the first host after 30 rounds (seconds).

	icmp_ratelimit | loss at hop1 for both mtr
	0		 0
	10		 0
	20		 0
	40		 0
	80		 34% and 37%
	100		 44% and 57%	(default)
	160		 64% and 75%
	320		 87% and 83%
	999		 100% and 100%

For 2*(4*icmp_request + 4*icmp_timeexceeded/reply) = 16 packets per 
second the loss seems to be a bit high at the default value of 100.

Is this related to any other setting? Maybe NAT?
My /proc/net/ip_conntrack only has 1200 lines and the max in 
/proc/sys/net/ipv4/ip_conntrack_max is 32767.



Christian Hammers             WESTEND GmbH  |  Internet-Business-Provider
Technik                       CISCO Systems Partner - Authorized Reseller
                              Lütticher Straße 10      Tel 0241/701333-11                D-52064 Aachen              Fax 0241/911879

             reply	other threads:[~2003-05-05  9:23 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-05-05  9:35 Christian Hammers [this message]
2003-05-05 14:53 ` Randy.Dunlap

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \
    --subject='Re: icmp_ratelimit seems to be too low (related to NAT?)' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).