Today I found in Orion the Packet loss of a device had arrived 60%. When I log on to the Orion server to ping the device I found it's good and there were no packets dropped. So I want to know how the packet loss calculated? and the packets loss is the device's packets loss or the interface's (which IP is added to Orion) packets loss??
any comments will be appreciated.
Packet loss is calculated from the number of ICMP packets that are dropped when polling the node.
Run a sniffer trace to that device using Ethereal or WireShark. If you are not seeing missing data, then you can be pretty sure that no SNMP packets are being lost, but the sniffer capture would tell you for certain.
Thanks for your help.
I know Packet loss is calculated from number of ICMP packets that are dropped when polling the node.
then what's the ICMP frequency? you know the device has lots of interfaces that each one has a IP address, and if I added the device using the interface A.
and I want to know the Packets loss is the interface A's packets loss or the device's packets loss? the polling engine polls the interface A or all the device's interfaces?
why in Orion I see the packets loss is 60% but when I ping the interface A's IP address there was no packets dropped??
Orion pings the IP address of the element you have in Orion.
Lets say its a L2 switch and you have VLAN1's IP in there 10.10.10.1. Orion will ping 10.10.10.1, but what you won't see is the L1 and or L2 connectivity because port 1/1 does not have an IP (1/1 is physically connected to the upstream router)
The same is true for a router monitored in Orion using it's Loopback0 IP address:
R1 - Loopback0 ip 10.11.254.1 S0 - 10.11.0.1
Orion is pinging 10.11.254.1, if your seeing drops (missing ICMP packets) then it's further upstream.
You can add S0's ip, but you will end up with duplicate hostnames in Orion.
If you have the SolarWinds Tool set, launch the traceroute utility and find out where the drops are occurring. If not from a cmd prompt on the Orion server (open 2 cmd) one ping -t xxx.xxx.xxx.xxx and once you start seeing drops , in the other DOS window type tracert xxx.xxx.xxx.xxx (whatever the IP is)
If my memory is correct the reported packet loss is a 10 poll moving average. So if it says 60% and you ping it then and it replies that is to be expected, unless of course the node is totally down. It means that over the last 10 pings 4 did not get a response. As for the interfaces involved, Orion will send the ICMP requests to the IP address specified for the node. It will not send ICMP requests to every interface on a system.
You may want to adjust the payload of the ping packet as well to see if that will improve the response percentage.
In your example of packet loss, if 10 pings were sent and 4 pings did not get a response . Doesn't that mean you had 40% packet loss? Only 60 percent received a reply? Just trying to understand what packet loss % means.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.