<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2650.12">
<TITLE>RE: operational: icmp echo out of control?</TITLE>
</HEAD>
<BODY>
<BR>
<BR>
<P><FONT SIZE=2>> -----Original Message-----</FONT>
<BR><FONT SIZE=2>> From: Richard A Steenbergen [<A HREF="mailto:ras@e-gerbil.net">mailto:ras@e-gerbil.net</A>]</FONT>
<BR><FONT SIZE=2>> Sent: Thursday, May 23, 2002 4:36 PM</FONT>
<BR><FONT SIZE=2>> To: Mark Kent</FONT>
<BR><FONT SIZE=2>> Cc: nanog@merit.edu</FONT>
<BR><FONT SIZE=2>> Subject: Re: operational: icmp echo out of control?</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> Path latency doesn't change much, you can determine this with very few</FONT>
<BR><FONT SIZE=2>> probes. Reachability does not need to be continuously probed, </FONT>
<BR><FONT SIZE=2>> you can take</FONT>
<BR><FONT SIZE=2>> cues from other data to decide if you need to re-probe. </FONT>
</P>
<P><FONT SIZE=2>I wonder if this can be used to profile a network for the sales droids? If one of your routers is being pinged continuously, this might be an indication they are using some sort of "Route Optimization/Failover" box. Especially if you ask them why they are pinging you on the order of 1-5pps and they can't really give an answer and don't turn it down. Sic-em! Sell them that managed BGP!</FONT></P>
<P><FONT SIZE=2>For instance, the FatPipe box does this sort of thing "so you don't have to use BGP" to (sort of) multihome. Link failure is detected by loss of ping response. Failover (link and DNS) is under five seconds, so to prevent premature failover, ping often, and only failover if you take, say, three lost packets. </FONT></P>
<P><FONT SIZE=2>The question for network operators is (just so this is kind of OT), is this kind of monitoring by the customer more of an annoyance, or a real item of operational concern? How would you react if you had a customer pinging the router on your side of his link (or farther upstream) that refused to limit the pings?</FONT></P>
<P><FONT SIZE=2>James H. Smith II NNCDS NNCSE</FONT>
<BR><FONT SIZE=2>Professional Services - Network Engineer</FONT>
<BR><FONT SIZE=2>The Presidio Corporation</FONT>
</P>
</BODY>
</HTML>