NetPath graph issue: Missing all intermediate nodes

11/15/2018 11:01 AM

5/3/2022 12:19 AM

The NetPath graph seems to be missing many nodes.

The NetPath graph jumps directly from the starting point to the endpoint, with no expected internal or external nodes in between. There is a possibility that some specialized network appliances, such as as web proxies and WAN optimizers, intercept TCP conversations and act as the endpoint.

Network Performance Monitor

Step 1: Check the NetPath graph for the same endpoint but non-web traffic 

1. Create a new service for the same endpoint on the same NetPath probe, but with the following settings:
   • Five-minute interval
   • A well-known non-web port, such as 25 or 53 (It is OK if those ports are not open on the endpoint)
2. Wait 5 - 10 minutes, and then check the graph.
3. Check if the graph contain external nodes, or if it has the same problem without any external nodes.

Does the graph contain external nodes?

• Yes: Go to step 3 .
• No: Go to step 2 .

Step 2: Check the distance from the endpoint to the NetPath agent 

1. Capture the NetPath probing response packet (TCP ACK).
   1. Find the IP address and port from the service that has issue.
   2. Find the IP address of the NetPath agent that probes the service.
   3. Download and install Wireshark. 
   4. In Wireshark, use the following capture filter to capture response packets:

      tcp and src host endpoint_IP_address and src port endpoint_port

       

2. Extract the TTL value from the response packet header.
3. 
4. Find the minimal positive number N from N1 to N4 below.
   • N1 = 255 - TTL
   • N2 = 128 - TTL
   • N3 = 64 - TTL
   • N4 = 32 - TTL

   The minimal positive number is the estimated distance (in nodes) between the packet sender and the NetPath agent.

5. Is the distance less than or equal to one?

6. Yes: Go to step 3 .
7. No: Submit a ticket to technical support.

Step 3: Check if the next node gateway has proxy or WAN optimizer enabled

1. Do you have access to the default gateway configuration?
   • Yes: Check if the proxy or WAN optimizer is enabled.
   • No: Skip to the next step.
2. Run a Trace Route from the NetPath probe to the endpoint, and count the number of response nodes. Check if there is more than one response node.

Is the proxy or WAN optimizer enabled?

• Yes: This is a known proxy issue. See the following workaround:

  To see intermediate nodes:

  • Add the NetPath probe to the proxy white-list or add a pass-through rule for the NetPath probing traffic.
  • For Riverbed Steelhead, add a pass-through in-path rule. (©2018 Riverbed Technology, Inc, available at https://support.riverbed.com/ obtained on 15 Nov 2018)
  • For Cisco WAAS with AppNav redirection (not WCCP or PBR), add a pass-through rule to the AppNav policies.  (© 1992-2018 Cisco, available at www.cisco.com, obtained 15 Nov 2018)

  To see nodes from the proxy server to the endpoint:

  • Add the NetPath probe to the proxy server subnet. See Network paths in NetPath end early  for more information.
• No: Submit a ticket to technical support.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.