ICMP packet size?

Similar Questions

• UDP EDNS packet size

  Hey everybody

  I have a BIND server 9.8.1 - P1 on the local network behind a firewall UTM5 running firmware 1.3.15 - 28.

  My DNS lookups are horribly slow to BIND. Ask the journal I found that server complains that, "after having reduced the size of package UDP EDNS announced at 512 bytes", it can make a successful determination.

  Now, that tells me that the UTM5 cannot accept UDP greater than 512 EDNS packets.

  ISS this correct?

  I also see a lot of these errors:
  error (no valid RRSIG) resolve "prosecure.com/DS/IN": 4.2.2.2 #53

  The maximum size of the DNS default UDP packets is 512. Most of the routers on the Internet will be blocking the packets UDP exceeds this size.

  http://StackOverflow.com/questions/1098897/what-is-the-largest-safe-UDP-packet-size-on-the-Internet

• MDS Http POST packet size restriction?

  Hello

  I have a problem with my application and a device connected to a BES for applications (MDS_4.1.7.16)

  I have this code example:

        connection = (HttpConnection) Connector.open(this.url,Connector.READ_WRITE,true);
  
        connection.setRequestMethod(HttpConnection.POST);
  
        connection.setRequestProperty("User-Agent", "MyUseragent";
  
        connection.setRequestProperty("Content-Type", "multipart/form-data" + "; boundary=" +  boundary);      
  
        connection.setRequestProperty("Content-Length","" + data.length);       connection.setRequestProperty("Connection","close");
  
        if (data != null && data.length > 0) {
  
          output = new DataOutputStream(connection.openDataOutputStream());        System.out.println("output opened");        output.write(data,0,data.length);        System.out.println("output wrote");           //output.flush();         //output.close();  input = new DataInputStream(connection.openInputStream());        System.out.println("input opened"); .... ....      }
  
  And then I close all my connections in a finally block
  

  To resume I've got this output:

  exit open
  output wrote

  When I try to write a few bytes on my outputstream there is no problem (got the entry 'opens'), but when I try to write about 29kilobytes, everythings seems good, but after the output.write (), the connection seems damaged... My input stream cannot be opened lock on it without any errors. I try with a flush() function and a close() after writing and then it is hunting water or closing that block my thread without exception more.

  Y at - it no limitation with the BES/MDS of MESSAGE size? I do my testing on a Blackberry Curve 8900 with OS 4.6.1.310

  Can I see any error on my bes log error? Could not find any information in the log folder...

  I have this problem only when I push my application via BES and not when I deploy it with JavaLoader. There is the default policy for the user and the cause of the application this is a new installation.

  Thank you in advance, I really need your help!

  Good bye

  Hello

  I found a solution that allow me to download my packages of 25 KB.

  I added a line in the header of the border: "Content-Transfer-Encoding: binary\r\n";

  After:

  ' Content-Disposition: form-data; name =-"o"; ("filename =------'b\' \r\n ');
  "" Content-Type: application/octet-stream\r\n ");"

  But now I have another problem.

  When my BES is offline my packages come up on a public MDS who?

  And when it is in offline mode I have the same problem of packet size, the ' Content-Transfer-Encoding: binary "seems to be not taken into consideration by the public MDS?

  How can I do, there are other properties that I can put?

  Thanks in advance,

  bloobi

• fall of site to site vpn icmp packets

  Hello

  I test site to site vpn between ASA and cisco router with GNS3, topology is base the tunnel is up but the question when the remote host ping from both sides it is drops icmp, see router command and ASA do not include droppings. Here is a sample output from ping when I try to remote client ping. any help is appreciated :)

  Instant topology is attached, also configs

  Thank you

  84 bytes from 10.20.20.5 icmp_seq = 59 ttl = 63 times = 79,004 ms
  10.20.20.5 icmp_seq = timeout 60
  84 bytes from 10.20.20.5 icmp_seq = 61 = ttl 63 times = 70,004 ms
  10.20.20.5 icmp_seq = timeout 62
  84 bytes from 10.20.20.5 icmp_seq = ttl 63 time = 63 = 59,004 ms
  10.20.20.5 icmp_seq = 64 timeout
  84 bytes from 10.20.20.5 icmp_seq = 65 = ttl 63 times = 50,003 ms
  10.20.20.5 icmp_seq = timeout 66
  84 bytes from 10.20.20.5 icmp_seq = 67 ttl = 63 times = 59,003 ms
  10.20.20.5 icmp_seq = timeout 68
  84 bytes from 10.20.20.5 icmp_seq = 69 = ttl 63 times = 50,003 ms
  10.20.20.5 icmp_seq = timeout 70
  84 bytes from 10.20.20.5 icmp_seq = 71 ttl = 63 times = 58,003 ms
  10.20.20.5 icmp_seq = timeout 72
  84 bytes from 10.20.20.5 icmp_seq = 73 = ttl 63 times = 50,003 ms
  10.20.20.5 icmp_seq = timeout 74
  84 bytes from 10.20.20.5 icmp_seq = 75 ttl = 63 times = 69,004 ms
  10.20.20.5 icmp_seq = timeout 76
  84 bytes from 10.20.20.5 icmp_seq = 77 ttl = 63 times = 237,013 ms
  10.20.20.5 icmp_seq = timeout 78

  R1 ipsec crypto #sh her

  Interface: FastEthernet0/0
  Tag crypto map: map, local addr 100.100.100.2

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (10.20.20.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.20.10.0/255.255.255.0/0/0)
  current_peer 100.100.100.1 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: 14, #pkts encrypt: 14, #pkts digest: 14
  decaps #pkts: 28, #pkts decrypt: 28, #pkts check: 28
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  ciscoasa # sh crypto isakmp stats

  Global statistics IKEv1
  The active Tunnels: 1
  Previous Tunnels: 1
  In bytes: 1384
  In the packages: 12
  In packs of fall: 0
  In Notifys: 8
  In the constituencies of P2: 0
  In P2 invalid Exchange: 0
  In P2 Exchange rejects: 0
  Requests for removal in his P2: 0
  Bytes: 1576
  Packet: 13
  Fall packages: 0
  NOTIFYs out: 16
  Exchanges of P2: 1
  The Invalides Exchange P2: 0
  Exchange of P2 rejects: 0
  Requests to remove on P2 Sa: 0
  Tunnels of the initiator: 1
  Initiator fails: 0
  Answering machine fails: 0
  Ability system breaks down: 0
  AUTH failed: 0
  Decrypt failed: 0
  Valid hash fails: 0
  No failure his: 0

  Hello

  On router R1, you gave the default route as output interface. Instead of using the output interface replace the IP address of the next hop. It will solve the issue of the reduction of ping.

  IP route 0.0.0.0 0.0.0.0 FastEthernet0/0

  IP route 0.0.0.0 0.0.0.0 100.100.100.1

  HTH

  "Please note the useful messages and mark the correct answer if it solves the problem."

• BIS/BES - best HTTP packet size?

  Hello there, we need a large amount of data (up to several tens of MB) to be paid by the server by using HTTP. Somewhere, there is information that it is best to divide the data into small pieces with size about 20 KBs to pass to the Blackberry. Does anyone have information:-is it true? -different sizes of piece? -It is only limit BIS/BES? Thanks in advance!

  There is a limit of BES, it was once 128KB, now usually much larger.  I'm not aware of a BIS limit.

  I've seen other people recommend 64 KB as the largest block to download.  I can see why because it will take a reasonable amount of time to pass more wireless (especially not 3G).  You must take into account the time of retransmission and the possibility of a problem (such as a phone call, especially on phones not 3G) and does not have the size too large.

  But with this size of data, you should really be sure that you're in WiFi before download should not you!

• I am connected but the network properties window does not show the size of the packets to all the

  I am connected but the network properties window does not show the size of the packets to all the

  Hi asaimas,

  You can follow this link & check if it helps:

  Configure the Option of configuring server network packet size

  Hope the helps of information.

• Packet ICMP of Linksys outside x 3000

  Dear people,

  At this moment we have a Linksys x 3000 configured as a modem on a connection ADSL (PPPoA)
  Since our monitoring server, we send ICMP packets to see if the connection is active (or not).
  The problem is when we turn off the SP1 ipV4 firewall and do not check the: "Filter anonymous Internet requests," we are still getting timeout of external guests don't. Is this a bug? And if not; How can we enable the ping from outside networks?
  We really want to allow Ping because the monitoring software.

  The firmware is the latest version: 1.0.0.1

  Thanks in advanced for any help.

  Juice all let you know, I just talked to Linksys support and it's a bug:

  (Cisco technician) to all Participants:
  I just checked my resources & is the problem that you are facing a problem for 3000 X & our we are currently working on a resolution.

  (Cisco technician) to all Participants:
  I will need to escalate this matter to the climbing team & they'll get back you the same thing.
  (Cisco technician) to all Participants:
  As I mentioned, our research team working on it. Meanwhile, I will increase the same case, so someone from the climbing tema will be able to get back to you about the same. If you have a preference for contacing, please let me know that as well.

  (Cisco technician) to all Participants:
  Alright.
  I thank you for the opportunity to serve you through Live Chat Cisco Support for Linksys products.
  Good day.

  Topic can be closed.

  (Mod Note: message has been modified.) ID of the technician's badge has been removed.)

• Limits on the size of the UDP packets

  I can't receive packets UDP only larger than the size of 8192 bytes. I can receive packets that are lower (or equal) of 8192 bytes.

  Also if a 8193 bytes packet is sent from the server not only make time trying to receive (i/o operation has expired), but I can't receive all the smaller packages later. It's like this big package breaks any subsequent extraction. I keep time after him. I tried to increase the timeout, but it doesn't help.

  I was under the assumption that the limit of a UDP packet is 65507 (this is the output of datagramConnectionBase.getMaximumLength ()). Is there something that I am missing, or is this a limit?

  Here is a snippet of the code I use:

  private DatagramConnectionBase datagramConnectionBase;
  private Datagram udpDatagram = null;
  

  //Init UDP
  String url = "datagram://:" + getConnectionSuffix();
  datagramConnectionBase = (DatagramConnectionBase) Connector.open(url, Connector.READ_WRITE, true);
  
  //Send UDP
  String data = "HELLO UDP SERVER! [" + System.currentTimeMillis() + "]";
  byte[] buffer = data.getBytes();
  
  url = "datagram://" + txtHost.getText() + ":" + txtHostPort.getText() + getConnectionSuffix();
  udpDatagram = datagramConnectionBase.newDatagram(buffer, data.length(), url);
  datagramConnectionBase.send(udpDatagram);
  

  In a thread:

  datagramConnectionBase.setTimeout(1000);
  udpDatagram = datagramConnectionBase.newDatagram(datagramConnectionBase.getMaximumLength());
  
  datagramConnectionBase.receive(udpDatagram);
  byte[] b = udpDatagram.getData();
  
  logThis("Bytes: " + udpDatagram.getLength());
  

  Just to close this message. In the end, I never found any official or unofficial word on the maximum UDP packet size.

  The solution we have implemented was ventilation packets sent in 508 bytes and reassemble at destination. This seems to work great although it seems that there are times that the unit is being overwhelmed with packages it to drop some... but that's for another post.

• PIX does not allow packets loarge

  I can ping with l - 992, but fail with-l 993.

  Ping 172.16.17.1 with 992 bytes of data:

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Ping statistics for 172.16.17.1:

  Packets: Sent = 4, received = 4, lost = 0 (0% loss),

  Time approximate round trip in milli-seconds:

  Minimum = 1ms, Maximum = 1ms, average = 1ms

  Ping 172.16.17.1 with 993 bytes of data:

  Request timed out.

  Request timed out.

  Request timed out.

  Request timed out.

  Ping statistics for 172.16.17.1:

  Packets: Sent = 4, received = 0, lost = 4 (100% loss),

  I also see that attached to the devices in the DMZ are taken excessively long time.

  The MTU size on all interfaces is always the default value of 1500.

  Hi Jimmysturn:

  Which is likely happened here is that you have ID political attack linked to your external interface with the action 'drop' or 'reset' all packages that match the signature in the category of the attack.

  Signature 2151 (large ICMP) will drop packets hit the PIX off interface or those who pass through the PIX outside interface when you ping with large packet size (+ 993 bytes):

  From your post, you must have had the following policy of IDS on your PIX:

  IP audit name attackpolicy attack action fall

  (or

  IP audit name attackpolicy action fall attack alarm

  or

  attack IP audit name attackpolicy raz action alarm

  or both)

  If you want to ping with big package, there are several things you can do:

  (1) remove the policy of "attackpolicy" completely from your external interface. It will turn off all of the IDS signatures in the category of the attack.

  Carefully look at this and see if it's what you want to do.

  To achieve the above, issue the following command:

  "no interface verification ip outside of attackpolicy"

  (2) turn off the signature 2151 by running the command:

  "disable signature verification ip 2151.

  That would disable only the big signing of ICMP attack while leaving the other signatures of attacks in the category of GIS attack ON.

  (3) set signature action to open a session (a syslog server or the internal buffer) large ICMP packets instead of dropping. Again, this should be determined carefully as option 1.

  To achieve the above goal, issue the following command:

  IP audit alarm action name attackpolicy attack

  It will be useful.

  Please indicate the position accordingly if you find it useful.

  Sincerely,

  Binh

• Camera GigE of NI VBAI lost packets

  We run VBAI on a fast PC with an Intel Pro/1000 card and a switch GigE of jumbo-frame to a large number of Basler Ace GigE cameras.

  It is understandable that multiple cameras cannot transfer complete images to the PC to the full flow of 1000 MHz because of the limited bandwidth between the PC and the Switch simultaneously.

  A way around this is to strangle the maximum for each camera down data flow so that the sum is not greater than 1,000 MHz.

  However, this means that transfers images always take more time, even if only a single camera to enter service, a large part of the time.

  What is a fundamental limitation of GigE Vision, or are smart enough work as soon as possible of the GigE Vision cameras... via returns package loses casual?

  Nelson

  We have found a solution.

  The problem is that the cameras, switch, network card and VisionBuiilder cannot treat all cases where more than one camera sends images to VisionBuilder where the total of the rates of data for these cameras is never more than 1 GB of band bandwidth network card.

  (It would be nice if someone did a network switch that has a little more package buffer memeory...) 100 MB?... so that the images of the garbage does not have the occasional collision while allowing most of the captures operate at maximum speed.)

  Solution:

  (1) we have added 3 ports on network 1 Gb additional to our pc of mink.

  (2) in order to redistribute traffic camera in more than one network port, we assigned to each network adapter and corresponding cameras, to a different subnet.

  (3) we have lowered the rate of data for less urgent cameras.

  Even after the lowering of the data rates for multiple cameras in NOR-MAX up to 200 Mb/s such as lost packets should no longer be possible, we stil seen.

  After a detailed examination, we found that the stages of acquisition image VisionBuilder are not careful the data rates that you assign to NOR-MAX and always default to 1000 MB/s maximum rate, so saturated flow and lost packets.

  The solution to this problem proves to be explicitly set to the flow desired in each stage of the acquisition of Image VisionBuilder, using the attributes tab.  While you're there, you should also check other critical parameters, such as the packet size, are also correct and update if not.

  After you explicitly fix rates given in every stage of image acquisition, we ran a stress test of capture image that ran all the process of vision (several programs running at the same time) about 10 times faster than necessary and observed no lost in all packets.

  Problem solved.

• How to choose right for the WAN Interface MTU size?

  Hello

  I would like to know How to determine the right size MTU to set in the properties of the WAN interface (in my case, NSA appliances).

  First of all. I noticed that with SonicOS Enhanced 5.9.x, there is a Tool of diagnosis called PMTU discovery:

  

  This tool is not available with SonicOS Enhanced 5.8.x.

  I guess using this built-in tool is a way to determine the right MTU size to apply.

  Second, for SonicOS versions that do not have this tool and to understand just how to manually determine the size MTU, I would like to know what is the method to follow.

  On the Internet, I found this method by using the ping-f-l command. Once you have determined the largest possible packet size, it ask you to Add 28 to that number and you get the MTU size to define the interface.

  Case study:

  In my business, there are 2 sites: 1 in China and 1 in South Korea. Both have a firewall SonicWALL NSA.

  To determine the MTU size that is applicable from the Chinese site, I get the same results with the 2 methods mentioned above.

  With the help of the PMTU discovery:

  I get 2 IPs: 8.8.8.8 and the Korean FW IP WAN. I get the same result: 1500.

  

  

  However, I noticed that the MTU size should be set to its maximum (1500) of size on the properties of the interface WAN for this test to work properly. Indeed, when I put in 1404 to test, PMTU discovery find 1404 such as MTU size:

  

  

  With the help of ping - f - l:

  When you use the ping with FW Korea WAN IP method, I found 1472 as the maximum packet size:

  

  According to the method I've read on the Internet, adding 28 will make me a MTU of 1500, same size as the PMTU discovery method.

  My question is: can you confirm that these 2 methods are correct determine the MTU size to set the WAN interface? Especially the one with the ping command? If not, how do?

  Thanks in advance for your comments.

  I can tell you that as technicians, we use the way to CMD line to adjust the MTU on WAN interfaces. We saw this as a number to work with.

  Thank you
  Ben D
  #Iwork4Dell

• Package IPSec - SHA256 digest size calculator?

  Hello

  I recently discovered the IPSec packet size calculator in this forum (see attachment).

  It is very useful calculate overhead when using IPSec, esp. DMVPN.

  Unforunately it contains no options for the following hashes:

  Hmac-sha256-ESP the ESP by using HMAC-SHA256 auth transformation

  The ESP by using HMAC-SHA384 auth hmac-sha384-ESP processing

  The ESP by using HMAC-SHA512 auth hmac-sha512-ESP processing

  Where can I get information on how great collection will be when you use 'hmac-sha256-esp' in my game of transformation?

  Someone is able and willing to implement these new options in the calculator?

  Thank you

  This has just been released a week ago:

  https://cway.Cisco.com/tools/IPSec-overhead-Calc/IPSec-overhead-Calc.html

  Thank you

  Wen

• 9.1 ASA 2 drops PING (icmp codes 0 & 8)

  Hello

  Im trying to ping DMZ on ASA to interface to the host from the INSIDE and vice versa. It does not work :( Trying to debug icmp however the icmp packet did not even touch the DMZ interface for the particular host. Doing so with packet - trace ASA displays all results under ALLOW. We could explain to me how to allow a host placed in X interface for PING Y interface itself?

  Thank you very much in advance!

  NB.

  The result of packet - trace is attached. What I'm trying to do, it's to ping interface DMZ (192.168.200.1) of the host from the INSIDE (192.168.100.10).

  Works as expected. The ASA does not support the rattling a foreign address. If your ping-host is located inside the interface, you can only ping the inside IP, if your ping-host is located in the demilitarized zone, you only can ping the DMZ IP. The ASA handles differently then a router.

  The only exception is with the 'management-access XXX' command when the ping goes through a tunnel.

• DF bit value IP sla icmp

  I want to put a mechanism to control the reachbility between two nodes by using the property intellectual ALS, but I find no definition df bit for ip sla icmp packets, y at - it ideas to do?

  Best regards.

  Hello

  int f1/0

  no ip policy map route df

  output

  local policy IP map route df

  Kind regards.

  Alain

  Remember messages useful rate.

• How Pix manages the rare IP protocol packets

  Does anyone know of a document explaining how the Pix handles, regarding the State, rare IP protocol packages such as ESP, AH, OSPF, GRE, etc. ? I'm concred with traffic flowing through the pix is not intended.

  I understand how TCP, UDP, and ICMP packets are handled, but I can't find anything on all others.

  Thank you.

  In General, the Pix must inspect any protocol passes through it accepts for TCP and UDP. The exception is a protocol which is managed by a '' correction '' like PPTP which has a correction to allow GRE (Protocol 47) traffic that results.

  If you want a different protocol than UDP/TCP to be allowed to get THROUGH, you almost create an ACL entry for her.

  The other exception is the traffic to the Pix itself as host. ACL have absolutely no effect on the traffic to the Pix as the host. For example, the packets OSPF intended for the Pix when running OSPF. Or packages ESP for the Pix for a VPN tunnel, it stops. Or ICMP traffic to the Pix itself (controlled using the command [icmp]). ACL don't apply to transit traffic.