Weird dpinger and IPv6 issue?

pfsensation

@jknott said in Weird dpinger and IPv6 issue?:

@pfsensation

No, I have never used dpinger.

Interesting, in that case what do you use for gateway monitoring?

JKnott

Whatever is built into pfsense, but generally I don't worry about it. With only a single Internet connection, it doesn't do much other than marking the interface down. When I have a problem, I run a shell script on my Linux computer that pings the gateway and records the failures.

johnpoz

@jknott said in Weird dpinger and IPv6 issue?:

Whatever is built into pfsense

which is dpinger ;) heheh

johnpoz

@pfsensation said in Weird dpinger and IPv6 issue?:

if I SSH into my pfSense box and run a ping6 I get no packet loss whatsoever.

Are you pinging with zero size? Dpinger I do believe out of the box uses a zero sized ping.. Have you tried changing your dpinger to use something other than zero?

I finally noticed that my he tunnel monitor was showing some low packet loss.. Going back through the history, it had been doing it for months.. Yet I was not having any issues with ipv6 during testing, and ping tests, etc. I don't normally use ipv6 for normal stuff anyway, served up some ntp via the pool for it, etc.

I then changed the pop I was connected to and the dpinger has now gone back to zero packet loss. Now this is bit different than what your seeing..

It was getting worse over time - it was very odd.. Previously going back as much history as I have about 4 years.. Loss of pings were actual outages, etc.. See from the above graph..

I had been on the same pop for years and years and never seen such an issue - I could find no reports of anything wrong with that pop.. But I changed to another one which was only a couple of ms different in overall time and so far the ping loss has gone away. This is different than your issue for sure - I could understand the loss of pings If I was also seeing loss of pings on my ipv4 network since I run a tunnel.. I put it down to something wrong with that pop specific, or my path to the pop having issues.

But for your testing, I would run your manual pings with the zero to your Ipv6 gateway, or change your dpinger to not use zero sized pings and see if that changes your reported loss.

pfsensation

@johnpoz said in Weird dpinger and IPv6 issue?:

@pfsensation said in Weird dpinger and IPv6 issue?:

if I SSH into my pfSense box and run a ping6 I get no packet loss whatsoever.

Are you pinging with zero size? Dpinger I do believe out of the box uses a zero sized ping.. Have you tried changing your dpinger to use something other than zero?

But for your testing, I would run your manual pings with the zero to your Ipv6 gateway, or change your dpinger to not use zero sized pings and see if that changes your reported loss.

Hi John,

Thanks for the response. When you mention zero sized pings, do you mean the packet size?

I've tried pinging from SSH using -s to set the packet size to zero, but I get a warning saying that its an illegal value.

How would I go about running a manual ping with the size set as zero? To be honest I wasn't aware that was even a thing.

johnpoz

@pfsensation yeah is it really zero? hmmm

But just sniffing for the monitoring you can see

Maybe they changed it to 1? Because some stuff will not respond if zero.. I thought it use to be 0.. But looks like the default now is 1

I know it use to be zero - here is old thread where I have a screenshot and the default for sure use to be zero

https://forum.netgate.com/post/852052

pfsensation

@johnpoz said in Weird dpinger and IPv6 issue?:

@pfsensation yeah is it really zero? hmmm

But just sniffing for the monitoring you can see

Maybe they changed it to 1? Because some stuff will not respond if zero.. I thought it use to be 0.. But looks like the default now is 1

I know it use to be zero - here is old thread where I have a screenshot and the default for sure use to be zero

https://forum.netgate.com/post/852052

I've changed the payload from 1 to 10, that may have been the magic value. Not seeing anymore loss, will continue to monitor and report back as this could help someone else in the future.

That's still pretty weird though, so on IPv6 the gateway doesn't like a smaller payload?

johnpoz

@pfsensation yeah its really odd to be sure, I have seen in the past device not answering zero at all. Maybe that is why they changed it to 1? But intermittent not really sure, it could be they just get dropped if really small?

But it is a good test to do if your saying normal pings from your client not having loss, I believe normal ping size is like 32 bytes.. At least on windows, linux might be different but 32 is what I believe the standard default is.

Generally when using ping that you send 24/7/365 every half second or so - you would want to keep those with zero or very low data.. It does add up ;)

pfsensation

@johnpoz said in Weird dpinger and IPv6 issue?:

@pfsensation yeah its really odd to be sure, I have seen in the past device not answering zero at all. Maybe that is why they changed it to 1? But intermittent not really sure, it could be they just get dropped if really small?

But it is a good test to do if your saying normal pings from your client not having loss, I believe normal ping size is like 32 bytes.. At least on windows, linux might be different but 32 is what I believe the standard default is.

Generally when using ping that you send 24/7/365 every half second or so - you would want to keep those with zero or very low data.. It does add up ;)

Many thanks for the pointers and yep I figured, trying to keep the value as low as possible would be nice when it's running twice a second. With some trial and error I've figured out that a payload of 7 is the lowest amount that works without showing any loss. I'll stick to this as it now seems to be working perfectly.

Thanks again for your help John! Hopefully this thread can help others if they run into something similar in the future.

johnpoz

@pfsensation So that is pretty crazy, so if you use payload of 6 you show loss but if you change it to 7 you no reported loss? Very odd for sure..

pfsensation

@johnpoz said in Weird dpinger and IPv6 issue?:

@pfsensation So that is pretty crazy, so if you use payload of 6 you show loss but if you change it to 7 you no reported loss? Very odd for sure..

Yep, that's exactly it. Only thing I can think of is that this is some weird quirk in the ISPs network, but then how is it only affecting IPv6 ICMP traffic. Odd one for sure, it seems to be reporting no loss now.

JKnott

@johnpoz said in Weird dpinger and IPv6 issue?:

which is dpinger ;) heheh

Well, as I said, I don't use it as I don't see the need with only a single Internet connection. It might be useful if it could do something beyond marking an interface down, such as call a script.

johnpoz

@jknott said in Weird dpinger and IPv6 issue?:

It might be useful

It is very useful - it monitors the response time to your gateway, and loss to your gateway - so simple easy health check... If your seeing 10% packet loss on your connection - could explain why your having issues, etc.

Easy way to show your ISP, look having problems starting here date and time, etc. See before when there was no issue..

Yes in general it main function could be to switch your connection to a backup link, etc. But just because you only have 1 connection doesn't mean it can not be useful information.

pfsensation

@jknott said in Weird dpinger and IPv6 issue?:

@johnpoz said in Weird dpinger and IPv6 issue?:

which is dpinger ;) heheh

Well, as I said, I don't use it as I don't see the need with only a single Internet connection. It might be useful if it could do something beyond marking an interface down, such as call a script.

You're probably using it whether you've noticed or not, dpinger by default is used by pfSense to monitor a gateway and see if its up. It's not just something for multiple connections. If you have the widget on the dashboard you can see the latency etc.

I personally got it monitoring my VPN links, Internet connection and now my IPv6 gateway, but that's all good. We all configure more/less on pfSense based on needs, that's what's amazing about it.

JKnott

@johnpoz

I just set it up. the IPv4 monitor address was straight forward, but on IPv6, I had to use the first GUA that traceroute showed, as the gateway link local address wouldn't work, even when I added the interface after the address. I can't even ping that address, so it may not be responding to pings. It also doesn't return an address with traceroute6.

johnpoz

@jknott said in Weird dpinger and IPv6 issue?:

I just set it up. the IPv4 monitor address was straight forward

There is nothing to setup to be honest - you would of had to purposely disable it, since out of the box it would monitor the gateway your wan interface has for IPv4.

As to IPv6, I would think it would of done the same thing.. Mine auto came up when I created the tunnel.. If that was link local that didn't answer ping, then it would of shown your gateway as offline and you would have to had to on purpose disable it if you want the gateway to come up, etc.

Since my gateway via the tunnel is a GUA address, I am not sure about what would happen with only a link-local address etc..

But out of the box monitoring comes up on its own.. And would either show offline or pending for your gateways, etc.

JKnott

@johnpoz

Without configuration, the default is to use the gateway address, which is a link local address. However, that address appears to be unresponsive to ping or traceroute, so I went with the GUA of the next hop. I expect this is how my ISP configured the gateway, rather than a problem with pfsense. One curious thing I noticed is when I pinged the link local address, without the interface, it would fail after 6 pings. If I added the interface, it didn't do anything until I stopped it at 30 pings.

BTW, I see in the widget that the IPv4 gateway has a globe icon, but not IPv6.

pfsensation

@jknott said in Weird dpinger and IPv6 issue?:

BTW, I see in the widget that the IPv4 gateway has a globe icon, but not IPv6.

The globe means its the default gateway, you have two. One for IPv4 and one for IPv6.

JKnott

@pfsensation

So, why doesn't IPv6 have one?

pfsensation

@jknott said in Weird dpinger and IPv6 issue?:

@pfsensation

So, why doesn't IPv6 have one?

Mine does, under system > routing do you have it selected as the default gateway?