Examkin

Question

Difficulty: MediumUtilizing Command-Line Network Troubleshooting Utilities

A network engineer is troubleshooting an issue where client computers can establish a basic TCP handshake with a remote application server across an IPsec VPN tunnel, but bulk data transfers fail or time out. The engineer suspects that packets exceeding the tunnel's Maximum Transmission Unit (MTU) are being dropped because path MTU discovery is failing.

Which of the following command-line utility commands should the engineer run on a Windows workstation to test reachability while setting the Don't Fragment flag to identify the maximum unfragmented payload size?

  1. ping -f -l 1472 172.16.10.50Answer
  2. B
    nslookup -type=any 172.16.10.50
  3. C
    dig -t AAAA 172.16.10.50
  4. D
    netstat -an -p tcp

Answer

Running 'ping -f -l 1472 172.16.10.50' sends an ICMP echo request with the Don't Fragment bit enabled (-f) and a specific payload size (-l 1472), allowing the engineer to determine the maximum MTU that can pass without fragmentation.
The option specifying 'ping -f -l 1472 172.16.10.50' is correct because on Windows systems, '-f' instructs the operating system to set the Don't Fragment (DF) bit in the IP header, and '-l' defines the buffer size. This allows administrators to test path MTU limits and detect where packet fragmentation failures occur.

Step-by-Step Solution

1
Identify the diagnostic objective.
The goal is to determine if network packets exceeding a certain byte size are being dropped due to fragmentation restrictions along the path.
VPN encapsulation adds overhead, reducing the usable MTU size below the standard 1500 bytes.
2
Select the utility and appropriate flags for path MTU testing on Windows.
The 'ping' utility supports the '-f' switch to set the Don't Fragment (DF) flag in the IPv4 header and the '-l' switch to set the ICMP payload size in bytes.
If a router along the path needs to fragment the packet but the DF bit is set, it drops the packet and returns an ICMP 'Fragmentation Needed and DF Set' message (or silently drops it if ICMP is blocked).
3
Calculate payload size relative to MTU.
An ICMP payload of 1472 bytes plus 20 bytes of IP header and 8 bytes of ICMP header equals a total packet size of 1500 bytes.
Incrementally decreasing the payload value using '-l' pinpoints the exact MTU threshold supported across the VPN tunnel.

Key Concept

Path MTU Discovery using ICMP ping options (-f for Don't Fragment, -l for payload length)
Estimated Time:1m 15s
Rate this question

Topics

Utilizing Command-Line Network Troubleshooting Utilities

More questions from this topic