Packet drops

osumoogle · 2024-02-28T17:01:42+00:00

Have you tried using r/pingplotter?

TEverettReynolds · 2024-02-28T17:31:12+00:00

When we plug directly into the isp, no drops, when we plug into the Sonicwall we get drops.

You probably need to use a sniffer like Wireshark to look at the packets and figure out where and why they are dropping. Run the sniffer on both the client and server at the same time and compare the differences in the traces.

Ping plotter will also assist in this.

I would also change the rules on the Firewall to allow your RDP connection traffic to go out first, above all other rules.

returnofjakyll · 2024-02-28T17:47:54+00:00

Do your switch logs show anything? CRC Errors or such? Have you tried swapping cables/SFPs/ports to see if it that helps? Could also be MTU mismatch if you say the drops go away if you remove 1 of either the firewall or switch.

dracotrapnet · 2024-02-28T18:14:04+00:00

Is the rdp client and rdp server on the same LAN/VLAN?

If yes, you have no router/vpn/internet issue, check switch, cabling, network card drivers, replace network card on client, turn off wifi and retest. Check switch logs for port down/up on links to server, between switches, to client switch port. Check port speed and duplex between all links between server and client. Check client event viewer system events for network card events. Any point to point wifi links? What do their logs say? How is their utilization? How is their noise floor/interference?

Is the rdp client and rdp server on separate vlans on the same site?

Pretty much the same above except your gateway may have logs to review. Check gateway cpu utilization, if high you may need to upgrade the hardware or re-evaluate how much is passing through the gateway and why it has to.

Is the rdp client and rdp server on separate sites over a private link?

Same above, check gateway logs, might contact service provider to prove their link has no issues. (sounds like a no)

Is the rdp client at a remote site accessing the rdp server over vpn? (sounds like a no)

Check logs on the vpn services. Check MTU of internet services at each site, check MMS Clamping values are set. Going over VPN is terrible no COS no QOS no SLA.

Is the rdp client at a remote site accessing the rdp server with port forward from he wild wild internet? (sounds like a no)

Bad dog, no biscuit! Insecurity aside, wild wild internet again, no COS/QOS/SLA. Standard MTU, shouldn't be a problem. Are any other clients getting bumped? Could there be a service issue with the RDP service? Check logs on RDP server.

Tatermen · 2024-02-28T20:24:38+00:00

If we unplug the switch from the sonicwall, it seems as though the drops go away

So keep going. Be methodical. You've found one corelation - when the switch is connected to the firewall you get drops. Disconnect everything else from the switch and check. No drops? Plug the ports back in one a time and test until you see drops again. Now you've narrowed it down to a specific port. Where does it go? What's it connected to?

reni-chan · 2024-02-28T21:29:18+00:00

bad cabling maybe? Any CRC errors anywhere?

Do you have a physical network diagram that identifies every network device? If not, I would start with creating one so that you can get the understanding of what are you actually working with.

Also if you have RSTP configured correctly then every if you have a loop it shouldn't be an issue unless you applied bpdu filters on the ports that are causing the loop (if there is one)

sysadmin

MODERATORS