IP层相互网络分析技术介绍.ppt

Try It Now! Background: A Microsoft client reports slow network response. Open trace file ICMP-Redirects-Ignored-3a.caz. Use the Expert Connection Diagnosis to filter the Local Routing scenario. As you peruse the filtered trace, you will notice there are two commands from the client, and a single response from the server in packets 8 to 13. Does this situation repeat itself in the remainder of the trace? Navigate back to the Decode tab. Do you see many ICMP Redirects? If the client had actually used the ICMP Redirect to create a Host-Specific Route for the server, would its default gateway continually send these ICMP Redirect packets? In your estimation, where does the problem lie – with the client or with its default gateway? Summary MAC addresses change across router hops, but IP addresses remain the same from end to end. UDP-based protocols and ICMP Echo may need to fragment to smaller MTU-based networks. Expert uses the IP ID and IP TTL fields to determine if a routing loop is in progress before posting a diagnosis. Local Routing scenarios can tax routers unnecessarily and contribute to user reports of slow network response. IP Options can be exploited by hackers to gain information about your network. Quality of Service, QoS, can be utilized via IP TOS or DiffServ bits. DiffServ Expedited Forwarding is recommended for VoIP. Group Discussion If you then examine the IP TTL field and notice it is continually decrementing at a rapid rate, what can you narrow your choice to? Does this present a problem? How would users be affected? If you have detected node A sending packets to node B, and the IP ID is consistently the same in each packet, what could be occurring? IP Fragmentation? Local Routing? Routing Loop? Question? * Sniffer? University Internet Protocol TCP/IP Network Analysis Troubleshooting Version 2.0 ? 2005 Network General Corporation. All Rights Reserved * * Sniffer? University Internet Protocol TCP/IP Network Analysis Troubleshooting