North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Extreme Slowness

  • From: Adam Rothschild
  • Date: Fri Oct 27 00:25:01 2006

Elijah,

On 2006-10-26-16:34:18, Elijah Savage <[email protected]> wrote:
[HTML mail stripped]
> It seems anything traversing level3 has very high latency along with
> what seems overloaded capacity as if they are running in a degraded
> mode I have connections with Time Warner, AT&T, and MCI [...]

On 2006-10-26-16:48:15, Elijah Savage <[email protected]> wrote:
[HTML mail stripped]
> Say like this traceroute. This is from TW to a Broadwing DS3.
> 
> 5  tenge-3-2.car1.Cincinnati1.Level3.net (4.78.216.13)  153.267 ms   
> 207.125 ms
>     tenge-3-1.car1.Cincinnati1.Level3.net (4.78.216.9)  218.920 ms
> 6  ae-5-5.ebr2.Chicago1.Level3.net (4.69.132.206)  36.976 ms  26.923  
> ms  57.770 ms
> 7  ge-11-0.core2.Chicago1.Level3.net (4.68.101.37)  254.145 ms
>     ge-11-1.core2.Chicago1.Level3.net (4.68.101.101)  258.522 ms
>     ge-11-2.core2.Chicago1.Level3.net (4.68.101.165)  227.223 ms
> 8  broadwing-level3-oc12.Chicago1.Level3.net (209.0.225.10)  231.451 ms
> 9  so-1-1-0.c1.gnwd.broadwing.net (216.140.15.1)  53.269 ms  35.568  
> ms  22.511 ms

Your postings appear to be missing two key pieces of information which
would help with the community diagnosis requested: source and
destination IP addresses.  From the information you did provide, one
can deduce that you're behind a TW/RoadRunner cable modem:

  13.216.78.4.IN-ADDR.ARPA domain name pointer tenge-3-2.car1.Cincinnati1.Level3.net
  14.216.78.4.IN-ADDR.ARPA domain name pointer ROADRUNNER.car1.Cincinnati1.Level3.net
  9.216.78.4.IN-ADDR.ARPA domain name pointer tenge-3-1.car1.Cincinnati1.Level3.net
  10.216.78.4.IN-ADDR.ARPA domain name pointer ROADRUNNER.car1.Cincinnati1.Level3.net

Now, the jitter and high latency you're seeing could be a result of
one or more factors, including but not limited to RF/plant issues, TWC
running their transport and/or Level(3) transit hot (which seems to be
a common occurrence these days), ECMP across two circuits of uneven
loading, or your neighbor might be jacking wifi and downloading a
bunch of torrents -- we, the readers, just don't know.

Of note when performing armchair troubleshooting across Level(3)'s
network: the 'ebr's (PTR record of ebr*.{pop}.level3.net == Force10
E1200; Experimental Backbone Router?) tend to drop a lot of diagnostic
traffic (such as, say, 'ping' and 'traceroute') as a part of overly
aggressive control-plane policers.  This loss is, of course, strictly
cosmetic, and has no bearing on end-to-end performance.  Hence, the
old "to it, not through it" rule applies.

smokeping[1] and iperf[2] (to end hosts) are your friends.

As an aside, I've noticed your string of postings today were all
HTML-tagged.  While not expressly forbidden (or even discouraged) by
the current Mailing List AUP, this is generally regarded as bad form;
you might wish to reconfigure your mail client accordingly...

Hope this helps,
-a

[1] <http://oss.oetiker.ch/smokeping/>
[2] <http://dast.nlanr.net/Projects/Iperf/>