Submit a ticketCall us

AnnouncementsTHWACKcamp 2018 is here

2018 is the seventh year for THWACKcamp™, and once again we’ll be live October 17 – 18 with packed session tracks covering everything from network monitoring and management, to change control, application management, storage, cloud and DevOps, security, automation, virtualization, mapping, logging, and more.

Register for online sessions.

Home > Success Center > Network Performance Monitor (NPM) > NPM - Knowledgebase Articles > NetPath graph issue: Missing all intermediate nodes

NetPath graph issue: Missing all intermediate nodes

Created by Anthony.Rinaldi_ret, last modified by Anthony.Rinaldi_ret on Jan 04, 2017

Views: 1,429 Votes: 1 Revisions: 9

Updated December 8, 2016

Overview

The NetPath graph seems to be missing many nodes.

The NetPath graph jumps directly from the starting point to the endpoint, with no expected internal or external nodes in between. There is a possibility that some specialized network appliances, such as as web proxies and WAN optimizers, intercept TCP conversations and act as the endpoint.

Environment

  • NPM 12.0 and later

Resolution

Step 1: Check the NetPath graph for the same endpoint but non-web traffic

  1. Create a new service for the same endpoint on the same NetPath probe, but with the following settings:
    • Five-minute interval
    • A well-known non-web port, such as 25 or 53 (It is OK if those ports are not open on the endpoint)
  2. Wait 5 - 10 minutes, and then check the graph.
  3. Check if the graph contain external nodes, or if it has the same problem without any external nodes.

Does the graph contain external nodes?

Step 2: Check the distance from the endpoint to the NetPath agent

  1. Capture the NetPath probing response packet (TCP ACK).
    1. Find the IP address and port from the service that has issue.
    2. Find the IP address of the NetPath agent that probes the service.
    3. Download and install Wireshark.
    4. In Wireshark, use the following capture filter to capture response packets:

      tcp and src host endpoint_IP_address and src port endpoint_port

  2. Extract the TTL value from the response packet header.

    10-wireshark-3.png

  3. Find the minimal positive number N from N1 to N4 below.
    • N1 = 255 - TTL
    • N2 = 128 - TTL
    • N3 = 64 - TTL
    • N4 = 32 - TTL

    The minimal positive number is the estimated distance (in nodes) between the packet sender and the NetPath agent.

Is the distance less than or equal to one?

Step 3: Check if the next node gateway has proxy or WAN optimizer enabled

  1. Do you have access to the default gateway configuration?
    • Yes: Check if the proxy or WAN optimizer is enabled.
    • No: Skip to the next step.
  2. Run a Trace Route from the NetPath probe to the endpoint, and count the number of response nodes. Check if there is more than one response node.

Is the proxy or WAN optimizer enabled?

 

Last modified

Tags

Classifications

Public