[ictdude]

You can limit how often a remote is allowed to connect in a certain timespan. For example:

-A INPUT -p tcp -m tcp --dport 22 -m limit --limit 6/min -j ACCEPT

This will limit connections per IP to 6 per minute to SSH (port 22). If this limit is exceeded, the connection is silently dropped (or rejected if that's your default iptables action).

That's why I asked if you were using this, because you could also do this for ICMP (ping) packets, in which case a ping may appear to never reach your server if it has exceeded this limit. This can make things look as if they're not working properly, while in fact they are ("it's not a bug, it's a feature" )

Thnx for the info. But i do not have that option set. Cool option..
Good to use as extra protection...

[Myatu]

You can limit how often a remote is allowed to connect in a certain timespan. For example:

-A INPUT -p tcp -m tcp --dport 22 -m limit --limit 6/min -j ACCEPT

This will limit connections per IP to 6 per minute to SSH (port 22). If this limit is exceeded, the connection is silently dropped (or rejected if that's your default iptables action).

That's why I asked if you were using this, because you could also do this for ICMP (ping) packets, in which case a ping may appear to never reach your server if it has exceeded this limit. This can make things look as if they're not working properly, while in fact they are ("it's not a bug, it's a feature" )

[ictdude]

Are you using a firewall, such as Shorewall or plain-vanilla iptables? Check if you have rate limiting enabled then (in Shorewall, you should NOT have this in the policy but in the rules).

As for diagnosing, you can use tcpdump -i [INTERFACE] icmp where [INTERFACE] is the actual vethx.x device on the host node (or ethX within the VM); use ifconfig to see them.

Then a ping should come up as "echo request" (from the origin) and a corresponding "echo reply" (from the receiver). From this you can figure out the origin of the problem (is it not sending or receiving?); sometimes an error message will be given (ie., "host unreachable") which is often a network configuration/routing error, or when there's only a request but no response it'll likely be a rate-limitation (a DROP statement after X amount of requests per X seconds/minutes/hours/etc).

Hi Myatu i use iptables. rate limiting ? Do iptables have this option ? Do not know about that ? How to check that status or change if needed ? Dont think i have a configuration/routing error Because nothing did change. And now suddenly all look fine again. But problem can come back..
Then need to check diagnose it... If so i will check this with your suggestion:

use tcpdump -i [INTERFACE] icmp where [INTERFACE] is the actual vethx.x device on the host node (or ethX within the VM); use ifconfig to see them.

Thnx for the fast reply

[Myatu]

Are you using a firewall, such as Shorewall or plain-vanilla iptables? Check if you have rate limiting enabled then (in Shorewall, you should NOT have this in the policy but in the rules).

As for diagnosing, you can use tcpdump -i [INTERFACE] icmp where [INTERFACE] is the actual vethx.x device on the host node (or ethX within the VM); use ifconfig to see them.

Then a ping should come up as "echo request" (from the origin) and a corresponding "echo reply" (from the receiver). From this you can figure out the origin of the problem (is it not sending or receiving?); sometimes an error message will be given (ie., "host unreachable") which is often a network configuration/routing error, or when there's only a request but no response it'll likely be a rate-limitation (a DROP statement after X amount of requests per X seconds/minutes/hours/etc).

[ictdude]

My Proxmox with some hosts looks to have some network problems.
Its not the cpu or disk or ram. Have this lately. Maybe NIC related.

Or network routing. When i ping the Proxmox host and the vm's
OpenVz and KVM. Ping response give reply sometimes time outs.

What is the best way to trouble shoot this ? First reboot and do diagnostics
on hardware ? Is there a command to find out hardware status ?

Who has a answer ?