Problem solve Get help with specific problems with your technologies, process and projects.

Diagnosing packet loss

I am experiencing 84% packet loss based on statistics provided by pathping on my Windows 2000 network. I am using...

static IP addressing with two 3Com Netbuilder 222 routers. The network is, my near end router Ethernet is, serial across a 56K DDS circuit to my far end router. The far end router is to Ethernet I have a pc on the far end LAN at It appears I am having 84% packet loss between the far end serial and Ethernet interfaces. Do you have any suggestions as to WHY or how I could diagnose this problem? Thanks in advance for your suggestions. Packet loss is a particular network behavior. And it is not just a simple as it sounds. Loss at 84% is a gross statistic that indicates that you have a problem - of course you knew that part. But that number won't tell you what the problem is or where. And yes, it is possible to do that.

Pathping should show you at which Layer 3 hop the loss first appears. That should help you isolate the issue, which is a big step forward. However, it won't tell you what type of problem you have.

There are very few tools that will do that job. appareNet by jaalaM Technologies, is designed specifically for that. The challenge is getting resolution on the behavior - how precisely can you define the type of loss, how it varies with different kinds of traffic, and what other behaviors accompany the loss? In some senses, it is like imaging - to resolve the "shape" of the problem, you need a precise instrument and the capability of pattern recognition.

Pathping and other generally available tools are too crude to provide the necessary detailed information. And of course they don't have an expert system attached. Consequently it is left to the engineer to build up a mental picture and make educated guesses until the problem is resolved.

The two options open to you are:

i) Collect together as many of the available tools as you can lay hands on (like pathping, traceroute, iPerf, pchar), develop some familiarity and a regular practice with each one, and then apply them as problem arise to best effect.

ii) Get a more sophisticated network imaging system like appareNet that is automated and does on-the-fly diagnosis.

There isn't much in between that I am aware of.

If ii) isn't an option for you and i) isn't terribly inviting, contact me through SearchNetworking and we'll arrange to do a remote evaluation of the problem for you.

This was last published in May 2003

Dig Deeper on Network Infrastructure