Exercise 4.1: Create an intermittent network issue and prove it is broken

RonaldBarnes

I used the tc command to drop 40% of packets, per instructions:

tc qdisc add dev enp3s0 root netem loss random 40

The solution of using ping to assess the packet loss worked as intended.

My question is, why didn't my first idea work - using ip?

e.g. ip -s link show enp3s0?

I expected ip to be able to give status at level 2 of OSI model, yet it showed 2 dropped RX packets, 0 dropped TX packets vs ping showing 20% packet loss.

Thank you in advance for helping me understand this better!

lee42x

Hello RonaldBarnes,
The ip command is showing L2 problems but we are watching at a higher level.
The ping command shows dropped icmp packets but there is no MAC level error, so it is up to a higher layer to detect the problem . When we use ping, it is ICMP which does not track the packets, we need the ping program to do the tracking. If ssh is used the TCP layer will do the necessary re-transmissions to get the data through. There are some newer tools becomming available on some distro's that use eBPF which will show more information like retransmissions.

Lee