When tracking down the source of network problems, where do you even begin? Network Instruments University™ instructor, Mike Motta shows you how to get to the root of network-layer issues with the top 4 timesaving tips.

1. Investigate double-sided captures for delay

Take packet captures from each side of the network conversation and use MultiHop Analysis within Observer® Expert to investigate whether any of the segments are the source of delay. Learn how to set up MultiHop Analysis.

2. Calculate TTL (time-to-live) value to know how many hops

When troubleshooting network delay between remote offices, it’s important to know where the delay occurs. If, for example, you know that packets take 13 hops on average from a remote office to headquarters, and now it's taking 20 hops, this would point to the source of the delay.

A simple formula to determine the number of hops over each route would be to calculate the difference between the TTL values from the source to the destination. By determining the number of hops, you can see if any are causing fragmentation.

Observer Infrastructure route maps automates this process by tracking routes and determining if the number of hops has increased at any point.

3. Configure filters to look for fragmentation fields in the header with More Fragments or Don't Fragment bits set

Fragmentation issues cause packets to be unnecessarily chopped into multiple packets, thus increasing workload and delay. Packets with the More Fragment bit set may indicate that a router along the path is fragmenting frames. While packets having the Don't Fragment bit set most likely indicate an application problem.

4. Build filters to search ICMP messages

If a router throws a packet away with the Don't Fragment bit set, it will notify the sender via ICMP (Internet Control Message Protocol). The message can determine the exact nature and source of the problem. ICMP messages (other than pings) indicate issues with the subnet, mask, routing, default gateway, or QoS.

If the network layer is determined to be error free, the next step will be to analyze application delivery and performance. To review Observer’s MultiHop Analysis and advanced application analysis capabilities, read through the Network Application Performance white paper. You can also sharpen your network and application troubleshooting skills by signing up for one of our Network Instruments University classes.

Thanks to Network Instruments for the article.