Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Network Performance Monitor (NPM) > Troubleshooting an unexplained high ping time

Troubleshooting an unexplained high ping time

Table of contents
Created by William Muhle, last modified by MindTouch on Jun 23, 2016

Views: 23 Votes: 0 Revisions: 3

Overview

There are cases where it appears that there's a high latency or packet loss from the Orion server. This can often times result in the thought that Orion itself is causing these issues, or that the software is misrepresenting the correct information. This article describes how to check if it is actually an issue with ARP.

Environment

All versions of NPM

Steps

  1. Identify the destination hosts that have a large ICMP latency.
  2. Run a continuous ping to one of the hosts having the same issue.

  Notes:

  • When there is large delay and packet loss, identify that the first several packets are Reply from 10.10.192.100: Destination Host Unreachable [Symptom - The ip address that is displayed here is not the same as the ip address you pinged]
  • 10.162.20.76 is the local host that runs the ping.
  • The message means the local host does not know how to send packet to the destination host.
  • If the destination is in the same subnet, it is related to ARP, which controls the mapping from destination IP address to MAC address.
  • If the destination is not in the same subnet, it is routing issue, which controls the next hop to forward the packets to.

  3.  Check the subnet mask of the host 10.10.192.100 and destination host 10.10.192.168.

Note: 

  • Both of them have a mask of  size 24, which means they are in the same subnet. This leads us to focus on ARP.

 

To verify the cause of the problem:

  1. Check the ARP cache table on host 10.10.192.100 using the command arp -a.

Note:

When the ARP cache entry for 10.10.192.168 is present in the ARP table, the ping should have no issues.

  2.  Delete the ARP entries for 10.10.192.168.

Note:

The ping should show large delays and packet loss. The behavior is the same when Orion is running or not. After a while, the ARP entry will show in the table again, and the ping will work fine again. This verifies that the ICMP issue is caused by the ARP cache management at the host. 

 

Last modified

Tags

Classifications

Public