[afnog] High return time on linux server

[Brian Candler]

On Thu, Apr 27, 2006 at 01:16:16AM -0700, Yahaya Wara wrote:
> I installed Mandrake linux 9.2 on HP Compaq server
> with following services running:
> 
> 1. Named (Bind 9.2.3)
> 2. Apache2 with two virtual sites, but hope to host
> more.
> 3. Shorewall firewall to filter traffic.(permit only
> http, DNS to and from the server and permit icmp from
> the server to internet.)
> 
> The problem is, if I ping my ISP router the return
> time will be fluctuating between 2000 ms to 8000 ms.
> But I remove the ethernet cable attached to the
> server's public NIC or I issued service network stop
> and ping my ISP router on another machine the return
> time come down to 500 ms to 700 ms. Please any help ?

Can we be a bit clearer about this? A diagram would help.

                   R1
                   |
                   | satellite
                   |
                   R2
       +-----------+----------+
       |                      |
       S1                     S2

R1 is the "ISP router" you were talking about, S1 is the Mandrake server,
and S2 is some other machine. R2 is your own local router, which I presume
you have, unless the satellite line is bridged.

Let me be clear what happens:

- If you ping R1 from S1 or S2, you see a RTT of 2-8 seconds
- If you unplug S1, and ping R1 from S2, you see a RTT of 500-700ms

Is that correct?

If true, what that would imply to me is that S1 is generating a large amount
of traffic, so much that the link is congested.

If you have admin control of R2, you can enable SNMP and use a tool such as
MRTG or Cricket to graph the line utilisation throughout the day. If the
line is full, it will probably 'flat line' at the maximum available to you.

If S1 is either pulling down or uploading so much traffic that your line is
full, then you need to understand why. As mentioned before, some careful
tcpdumping (over several minutes, not just one second) might be helpful.

You can also try stopping individual services on your machine - e.g. apache,
bind - to see whether it's one or other of those.

HTH,

Brian.