Investigate double-sided captures for delay
packet captures from each side of the network
conversation and use MultiHop Analysis within Expert Observer
whether any of the segments are the source of delay. Learn
how to set up MultiHop Analysis.
TTL (time-to-live) value to know how many hops
If you’re troubleshooting network delay between remote
offices, you need to identify where delay is occurring. If you know on
packets take 13 hops when in route from a remote office to headquarters
and now it’s taking 20 hops, this would point to the source of delay.
The number of hops
that occur over a route is determined by calculating the difference
TTL values from the source to the destination. Having determined the
hops, we’ll see if any of the hops are causing fragmentation.
filters to look for fragmentation fields in the
header with More Fragments
or Don’t Fragment
issues cause packets to be unnecessarily
chopped into multiple packets thus increasing workload and delay.
the More Fragment
bit set may indicate that a router along the path is
fragmenting packets. While packets having the Don’t
Fragment bit set
could get dropped by a router that is needing to fragment the packet,
filters to search for ICMP messages
a router throws a packet away with the Don’t Fragment
bit set, it will notify the sender via ICMP
(Internet Control Message Protocol).
The message can determine the exact
nature and source of the problem. ICMP messages other than pings
with the subnet mask, routing, default gateway, or QoS.
gateway incorrectly configured
mask incorrectly configured
port not listening or responding
route but box not answering ARP request
request answered but box not answering specific protocol request
does not have route to reach network
the network layer is determined to
be error free, the next step will be to analyze application delivery
performance. To review MultiHop Analysis and advanced application
analysis, read through the Network
Application Performance white paper.
You can also sharpen your network and
application troubleshooting skills by signing up for one of our classes.
For ICMP Messages
critical step in troubleshooting network-layer issues is
being able to quickly identify the source of delay along a network
messages provide an easy way to identify the network problem and
a filter to identify Redirects and Unreachable errors in Observer using
In the main Observer console screen, from the menu at the
top of the screen select
Actions and Filter
New Filter from the menu in
Active Filters window and title the filter ICMP.
In the Edit Filter window, select Edit
Edit Rule As, Protocol
Within the Protocol Filter window, scroll and
select ICMP and then
highlight the desired protocol filter. For this
example, select Destination Unreachable.
To add other ICMP messages to the filter, right-click on
the protocol filter and
select OR then Protocol,
creating an ICMP filter automates the
error-finding process, and will make it easier for you to assess
problem is occurring on the network or elsewhere. Remember that you can
apply the filter as a Pre Filter, Capture Filter or Post Filter.