Curious packet loss on leased line

We had a leased line installed at our office a month or so ago and it's performing well. I thought I'd check the TBBQM for it and since Thursday it's showing quite a lot of packet loss:

http://www.thinkbroadband.com/ping/share-thumb/8e877...

It doesn't seem to be affecting throughput but I can't replicate this using tracert to thinkbroadband.com. I don't see this on my home connection so I'm a bit puzzled. It seems a bit unlikely that our Cisco router is suddenly struggling to respond to pings especially since there seems plenty of bandwidth spare. It's only a 10/10 circuit anyway.

1 thinkbroadband-gw2.core-rs2.thdo.ncuk.net 3 3 1ms 4ms 9ms
2 gi4-47-10-star1.bdr-rt3.thdo.ncuk.net 3 3 0ms 0ms 0ms
3 xe-0-2-1.jprg-01.thn.uk.mdnx.net 3 3 0ms 1ms 2ms
4 xe-0-0-1.jar-004.thn.uk.mdnx.net 3 3 0ms 8ms 24ms
5 xe-0-2-0.jar-003.thn.uk.mdnx.net 3 3 0ms 19ms 58ms
6 213.160.103.70 3 3 13ms 13ms 13ms
8 xxx.xxx.xxx.xxx 11 12 7ms 8ms 8ms

Edited by Andrue (Mon 08-Jul-13 15:07:01)

In reply to a post by Andrue:

I can't replicate this using tracert to thinkbroadband.com.

If I trace route to the TBBQM server (80.249.99.164) it shows around 4% packet loss - same as the graph.

Could be some form of rate limiting of that type of traffic.

Here is one graph from one of our routers on our leased circuit in our office.

My Broadband Ping

Is the router ISP provided or one that you've provided yourself? i.e does your Cisco plug in to anything apart from the BT/network installed NTE.

Matt

In reply to a post by uno:

Could be some form of rate limiting of that type of traffic.

Here is one graph from one of our routers on our leased circuit in our office.

My Broadband Ping

Is the router ISP provided or one that you've provided yourself? i.e does your Cisco plug in to anything apart from the BT/network installed NTE.

Matt

It's a shared connection so our router plugs into another box then that connects to another box. Seems like an odd thing to rate limit though.

Do you all share the same single IP address (the last one in the traceroute)?

Matt

In reply to a post by uno:

Do you all share the same single IP address (the last one in the traceroute)?

No but we are all on the same subnet.

Wild guess that 213.160.103.x is the WAN interface on the suppliers router, so they can get in (managed circuit?)

Latency at the hop before is around 1.3ms~ from my test box but the hop after is 9ms~.

It's hard to tell from your trace where the packet loss starts but to the IP above, I didn't see any directly. As I don't know the IP before, it's impossible to know what and where it is occurring but still suspect their router might be rate limiting something, maybe mis-configured DoS protection.

Matt

In reply to a post by uno:

Wild guess that 213.160.103.x is the WAN interface on the suppliers router, so they can get in (managed circuit?)

Yes.

As I don't know the IP before, it's impossible to know what and where it is occurring but still suspect their router might be rate limiting something, maybe mis-configured DoS protection.

Could be I suppose.

Update: Looks like it's cleared up now.

/me shrugs.

Edited by Andrue (Tue 09-Jul-13 08:01:16)