[nsp] Strange packet drops

[Jan Gunnik Hope]

Hello !

I have a strange problem:

R1 - (Internet) - R2 - FW - R4
                   |
                  R3

R1 - R3 : Almost error free communication (0 - 0,1% loss)
R3 - R4 : Almost error free communication (0 - 0,1% loss)
R1 - R4 : Significant amount of drops (3-6% packet loss)

We have measured packet drops mostly using extended pings.
In the FW device, the ruleset which allows communication R1-R4 and R3-R4
is contained in the same rule => Should be handled the same; logged the
same.
I don't think TTL is an issue, there is less than 20 hops from R1 to R3,
and only the hops shown from R3 to R4.
The packet that don't get dropped have a typical round trip time R1-R4
of less than 100 ms.  We have tried increasing the timeout in ping with
no result, it seems that the packets are really dropped, not just
delayed.
R3 and R4 is in the same prefix, and the same AS; the path from R1 to R4
is merely an extension of the path from R1 to R3, except for the last
hops shown.

Needless to say, we would like to improve the R1-R4 path, or at least
understand why we get the high drop rate R1 - R4.

Any ideas in what to do next ?


Jgh

Jan Gunnik Hope
ID Comnet as
www.idcomnet.no