Duplicate icmp requests
-
Hello All,
pfSense-1.2.3-RELEASE
This is somewhat trivial but I was wanting anyone's input on a oddity experienced with one of the the two pfSense boxes I have had setup for about two years now.
When I ping the pfSense machine from my home PC in about 10-20 icmp requests i get a (DUP!),,and sometimes,there may about 2-3 consecutive DUP replies from the pfSense server.
Could this possibly be the load balancing factor of pfSense possibly?
The second pfSense at another school building never exhibits this behaviour. Everything works as expected on the router,but was simply curious is how to possibly pinpoint what may be causing this.Thank You,
Barry -
Wouldn't be load balancing. Most commonly that happens when you're using some kind of connectivity that has extreme buffering. 3G/4G is most common, happens with some wifi equipment and other wireless connectivity. It should be impossible that pfSense itself is sending dup replies, packet capture on the WAN you're pinging would confirm or deny that. See only one reply there, and something in between is dup'ing it. Doing various more packet captures from other points of reference will help narrow down where.
-
cmb,
Thank You for the reply.
In fact one of our two ISP connections is via a Wireless consortium in our area. I am wondering if this may be the culprit in the DUP reply(s).
I will fire up Wireshark and try and get engenius in doing packet captures, in regards to this when I have lots! of spare time.
It always turns out Wireshark ends up being a marathon for me. -
It doesn't have to be a marathon, or even much effort at all for something along these lines. Diagnostics>Packet capture, pick the affected WAN, filter on the IP you're pinging from, start the capture. Run the ping until you get duplicates and stop the capture. Then just a glance through the output will show echo request, echo reply, repeatedly. If you don't see more than one echo reply for each request, you know it's not coming from the firewall itself.
One being a wireless ISP, that's almost certainly where it's being duplicated. It's probably indicative of excessive buffering or another problem within their network, I would contact the ISP about it.