asa 5505 showing weird ping values
jrs91
Member Posts: 64 ■■□□□□□□□□
I just got an ASA5505 and I'm testing it out. There is no real traffic going through it yet so the cpu is at around 9-12%. I am pinging a server in my dmz from a windows host and this is what it looks like:
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=-104ms TTL=64
I tried pinging my voip trunk provider (from the same windows host) and it looks like this:
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=55ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=-49ms TTL=53
Reply from 159.x.x.x: bytes=32 time=55ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
It seems to be adding 104ms a lot of the time and i'm not sure why... I also have some weird negative ping values in there. I've never used an ASA before I've never seen this pinging through our PIX.
When I run the pings from a linux server however, everything looks as I would expected through a device with no traffic:
64 bytes from 10.10.10.2: icmp_seq=45 ttl=64 time=0.428 ms
64 bytes from 10.10.10.2: icmp_seq=46 ttl=64 time=0.457 ms
64 bytes from 10.10.10.2: icmp_seq=47 ttl=64 time=0.442 ms
64 bytes from 10.10.10.2: icmp_seq=48 ttl=64 time=0.435 ms
64 bytes from 10.10.10.2: icmp_seq=49 ttl=64 time=0.428 ms
64 bytes from 10.10.10.2: icmp_seq=50 ttl=64 time=0.288 ms
64 bytes from 10.10.10.2: icmp_seq=51 ttl=64 time=0.247 ms
64 bytes from 10.10.10.2: icmp_seq=52 ttl=64 time=0.245 ms
64 bytes from 10.10.10.2: icmp_seq=53 ttl=64 time=0.281 ms
64 bytes from 10.10.10.2: icmp_seq=54 ttl=64 time=0.363 ms
64 bytes from 10.10.10.2: icmp_seq=55 ttl=64 time=0.471 ms
64 bytes from 10.10.10.2: icmp_seq=56 ttl=64 time=0.350 ms
Can anyone explain this? Obviously the windows and linux versions of ping calculate their time values differently. I'm thinking that maybe the windows version calculates it based on a timestamp in the packet itself and the linux ping keeps track of when it sent a packet out based on its own internal clock and when the ping comes back it calculates the difference? But why would I just be seeing this for the first time? Why did I never see this behavior through the pix?
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=-104ms TTL=64
I tried pinging my voip trunk provider (from the same windows host) and it looks like this:
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=55ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=-49ms TTL=53
Reply from 159.x.x.x: bytes=32 time=55ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
It seems to be adding 104ms a lot of the time and i'm not sure why... I also have some weird negative ping values in there. I've never used an ASA before I've never seen this pinging through our PIX.
When I run the pings from a linux server however, everything looks as I would expected through a device with no traffic:
64 bytes from 10.10.10.2: icmp_seq=45 ttl=64 time=0.428 ms
64 bytes from 10.10.10.2: icmp_seq=46 ttl=64 time=0.457 ms
64 bytes from 10.10.10.2: icmp_seq=47 ttl=64 time=0.442 ms
64 bytes from 10.10.10.2: icmp_seq=48 ttl=64 time=0.435 ms
64 bytes from 10.10.10.2: icmp_seq=49 ttl=64 time=0.428 ms
64 bytes from 10.10.10.2: icmp_seq=50 ttl=64 time=0.288 ms
64 bytes from 10.10.10.2: icmp_seq=51 ttl=64 time=0.247 ms
64 bytes from 10.10.10.2: icmp_seq=52 ttl=64 time=0.245 ms
64 bytes from 10.10.10.2: icmp_seq=53 ttl=64 time=0.281 ms
64 bytes from 10.10.10.2: icmp_seq=54 ttl=64 time=0.363 ms
64 bytes from 10.10.10.2: icmp_seq=55 ttl=64 time=0.471 ms
64 bytes from 10.10.10.2: icmp_seq=56 ttl=64 time=0.350 ms
Can anyone explain this? Obviously the windows and linux versions of ping calculate their time values differently. I'm thinking that maybe the windows version calculates it based on a timestamp in the packet itself and the linux ping keeps track of when it sent a packet out based on its own internal clock and when the ping comes back it calculates the difference? But why would I just be seeing this for the first time? Why did I never see this behavior through the pix?
Comments
-
kalebksp
Member Posts: 1,033 ■■■■■□□□□□
Your windows box doesn't happen to have an older AMD dual core processor, does it? There was problem with the timing between the two cores a while back: Negative Ping Time - Luke Jackson
-
jrs91
Member Posts: 64 ■■□□□□□□□□
Your windows box doesn't happen to have an older AMD dual core processor, does it? There was problem with the timing between the two cores a while back: Negative Ping Time - Luke Jackson
Wow. Good catch. That's exactly what the windows box has. Thanks.