Network Packet Loss Caused by configuring routing rings for Static Routing (3)

Analyze the network traffic of this host

After determining that a large volume of sent traffic on the host is the main cause of network congestion, we need to further analyze the traffic on the host, that is, what the host is doing on the network, it can be referred to as analyzing his network behavior.

First, we analyze the network traffic flow of the host, that is, to whom it sends packets. We use the Matrix Function of Sniffer to monitor.

Host session

Through the Matrix of Sniffer, we found that the packets sent from hosts whose IP address is 10.22.0.25 are scattered. We investigated that hosts whose IP address is 10.22.0.25 are the network management system hosts of the network, the packet is sent to the IP address of the Municipal router in the network. That is to say, the network management host sends a large number of network packets to the local router, resulting in abnormal network traffic and packet loss, make the network unstable.

After finding this problem, we removed the network connection of the network management host and found that the Network was immediately restored to normal without packet loss, it seems that this network problem is completely caused by this network management host, but this phenomenon is hard to understand. Why does the network management host cause network problems.

We use the Decode function of Sniffer to Decode the captured network traffic to analyze the content of the packets sent by the network management host to see what data packets it sends, to further analyze network behavior.

Decode and analyze the traffic sent to the network

We found through the Decode of Sniffer that this network host sent a large number of ICMP Echo packets to the municipal routers in the network, that is, Ping packets. We analyzed the ICMP Echo packets sent to 10.22.127.246, A strange phenomenon was found.

The next packet in the ICMP Echo packet sent from 10.22.0.25 to 10.22.127.246 is decoded. Figure 3-16 shows the 739th packets sent by the packet, figure 3-17 shows the 740th packets sent by the packet. The IP Identification of these two packets is the same, both of which are 15633. Each IP packet has a specific Identification to indicate its uniqueness, this indicates that the two packets we captured are actually the same IP packet.

The analysis process of the network traffic of the host caused by the packet loss caused by the routing ring is described. Continue reading:

Network Packet Loss Caused by configuring routing rings in Static Routing 1)

Network Packet Loss Caused by configuring routing rings in Static Routing 2)

Network Packet Loss Caused by configuring routing rings in Static Routing 4)

1. Router POS access technology and Solutions
2. Configuration method of router log information record
3. For beginners, refer to the CISCO router tutorial.
4. How to Set rootkit on a vro Intranet
5. Describes vro settings to ensure security