We use a PRTG server that's connected to a cisco 6500, which feeds a large network of about 1200 switches and radios in a router-on-a-stick topology. In PRTG I'm able to set a 'ping burst' sensor on a device, and I can set the ping size, count, timeout, and delay(between each count).
I have all my ping burst sensors to 32 bytes in size, a timeout of 5 seconds, a count of 100, with a delay of 100ms. So each minute 100 32 byte pings are sent with a 100ms delay between each.
I have more than several of these sensors set throughout the network, and one on the 6500. My problem is that the 6500 shows 5-8% loss spikes occasionally and almost consistent 1-2% loss, even though it's one 10 gig switch away. Is there a way to tell if the router is dropping these out of DOS suspicion?
I also have some scenarios where A feeds B and B feeds C, all 3 have the sensor, but sometimes A and C will show the same loss spike, but it will be missing from B. I'm having trouble understanding how that's possible. Would SNMP be more accurate than ping bursts?
show
command that reports on packets that were dropped because of a configured rate limiter. – Barmar Apr 16 '15 at 12:12