Cisco

IOS ping with rotating data pattern/payload

moonie

Mar 28, 2011 • 2 min read

Came across an interesting problem where depending on the ping payload the loss would vary quite a bit when being sent over a WAN link. Pings using windows machines were seeing higher loss than from linux boxes. It turns out windows uses a rotation from A-W for its ping payload while linux just pads with 0s as a default. Cisco IOS uses ABCD repeated as its payload.

Pinging using a linux machine with the defaults made the line look fine but with a windows machine the WAN link looked quite bad. We tried to replicate this using our network equipment.

The initial pings dont really show any problem (using all 0s to fill the payload):

Router1#p ip
Target IP address: 192.168.1.1
Repeat count [5]: 1000
Datagram size [100]: 1470
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 192.168.2.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]: 0000  <-------------------------[HERE!!]
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 1000, 1470-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.1
Packet has data pattern 0x0000
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (999/1000), round-trip min/avg/max = 20/24/44 ms

Now using the rotate data pattern (from 0x000 to 0xFFFF). I couldn't find any online documentation to link to the rotate option.

Router1#p ip
Target IP address: 192.168.1.1
Repeat count [5]: 1000
Datagram size [100]: 1470
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 192.168.2.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]: rotate  <-------------------[type in "rotate"]
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 1000, 1470-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.1
Packet has rotating data pattern starting with 0x0000 <------- [See rotating pattern confirmed here!!]
!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!.!!!!!!!!!!.!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!.!!!!.!!!!!!.!!!!!!!!.!!!!!!!!!!
!!!!!!!!!!!.!!!!!!.!!!!!!!!!!!!!!!!.!!.!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!
!!!!!!!!!!!!!!!!.!!!!!!!.!.!!.!!.!!!.!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!.!!!!!!!!!!!!!!!!.!!!!.!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!.!!
!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!.!!!!!.!.!!!!.!!!!!!!.!!!!!!!!.!!!!
!!!!!!!!!!!!!!!!.!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!.!!!!.!!!!!!!!!!!!!.!
!!!!!..!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!.!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!.!!!!!!!!.!!!!.
!.!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!..!!!!!!!!!.!!!.!!!!!!!!!!!!!.!!!!!!
!!.!!!!!!!!!!!!!!.!!!!!!!!!!!!!!.!!!!!!!.!!!!!!!!.!!!!!!!.!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!.!!.!!!!.!!!!!!!!!!!!!!!!!.!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 93 percent (932/1000), round-trip min/avg/max = 20/23/36 ms

Quite a difference just from varying the payload! :o
Cisco also suggest trying the following payloads to find issues

0x0000 (All 0s)
0xFFFF (All 1s)
0xAAAA (Alternating 1s and 0s)

From Cisco.com
Some physical links might exhibit data pattern dependent problems. For example, serial links with mis-configured line coding.

Our issue was resolved buy our friendly WAN SP. After we convinced them that there really was a problem (and could demonstrate with them how to replicate it) they swapped out a GE interface card.

m00nie :)

Sign up for more like this.