Cisco 1921 Logging Capability

Posted on 2013-05-22
Last Modified: 2013-07-05
I have some general questions about the logging capability on the Cisco 1921 router.  Here is the deal, I'm having some problems with a PC and a server communicating with each other over a site to site connection that is established between 2 Cisco 1921 routers(we manage both).  The PC's can ping each other just fine(sub 10ms response), but can't run an application over the network efficiently..what should take the app a second or 2 to respond takes over a 1 minute, and what should load in a minute or 2 takes about 15 minutes.  I ran wireshark on the main server and I'm getting a barrage of DUP Ack errors and retransmission Errors which seems to indicate packet loss.  I've asked my cisco engineer to look into it, and he tells me that he can't really log those type of errors on the cisco devices??  Also, that a VPN tunnel either works or it doesn't, there is no possibility of data packet loss if the tunnel is up.  This seems odd, I'll admit I don't know much about what the Cisco routers can do, but it would seem like this would be something that we should be able to look into or at least view the logs or no?   Thanks for your help.
Question by:GoNats
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
LVL 32

Accepted Solution

harbor235 earned 250 total points
ID: 39190414
I would add that DUP ACKS and retransmissions also indicate not only packet loss but a congested network. How much bandwidth is available via the VPN tunnel?

You state that the application should take 2 seconds to respond, is that number based on the client and server being on the same network/location with 100/1000Mbps available?

Network performance can be impacted by several things, bandwidth, latency, window sizes, etc.... So, how much bandwidth is available to the VPN and/or the internet connection at each site? what is the latency between sites? Which operating systems are involved in the client server interaction?

Wireshark captures will provide you the best information on the flows between sites.
Look for MTU, latency, and the system that first complains about the connection.
I would also make sure the system it self is not overworked causing the delay in responding to packets received.

harbor235 ;}

Author Comment

ID: 39191160
Thanks Harbor, I think there is definite packet loss, but I'm not a cisco guy and am unable to troubleshoot, and my cisco engineer says this type of issue is not logged on the Cisco device, which to me seems unlikely.  I'm also being told that VPN tunnels work or don't work, and if it's up then there is no possibility of packets dropping.  I guess what i'm trying to determine is if I need a new cisco engineer....  

To answer your other questions, both sites have a full dedicated T1, and the traffic between the 2 is minimal, this is the workstation (windows CE) communicating with the server (2003).  Outbound traffic between the 2 sites is minimal as well, maybe 2 or 3 or PC's on the network with minimal internet usage.  I don't know how much bandwidth was allotted for the VPN but I have asked.  Response to ping times between the 2 devices are usually sub 10ms, but they do spike upwards of 1000ms at times and occasional time outs

Thanks again for your help.
LVL 37

Expert Comment

ID: 39191284
What type of traffic is it between the client and the server ?

If you packet capture on both sides, do you see the same errors ?

You can expose dropped VPN packets using SNMP, however if you suspect packet loss, the first test I would run is with ping/mtr to soo if any ICMP packets are being dropped, if ICMP is not being dropped, then it would be unlikely* that TCP/UDP was being dropped.

*usually you would configure ICMP to be dropped before application traffic, however is not an explicit rule.
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

LVL 32

Expert Comment

ID: 39191506
Are you measuring latency between router to router and server to client?

During typical application operation you should not only capture packets via wireshark on both ends but I would also capture interface stats via the router as well.

What application is in use between client and server?

I would love to see the VPN config as well as any policing/shaping profiles applied if any on the router. Truly, the issue could be in several places. I asked about the OSs because typically newer OSs support auto scaling which would ensure the best TCP window between client and server.

harbor235 -}

Author Comment

ID: 39191518
Thanks for the reply Arne, the traffic back and forth is for a Point of Sale system(Micros) and unfortunately I'm not able to capture packets from the workstation as I'm unable to remote into it.  I did run WinMTR and it showed no packet loss to the workstation from the server.  However wireshark consistently shows DUP Ack errors along with Re-transmit errors.  

We have physically put the workstation on the same network as the server and that works, so there doesn't appear to be any problem with the load on the hardware on either side.  The issue is only when the traffic goes over the tunnel.

Thanks again for your help.
LVL 37

Expert Comment

ID: 39192360
I wonder if you are experiencing an artefact of the application timing out on packets rather than actual TCP errors

Author Comment

ID: 39192463
@Harbor, the issue seems to be between the server and the client, as of yet, there have been no testing done or logs of traffic between the routers.  The application is Micros Point of Sale applicaton, although the workstation is just for clocking in(no CC transactions)  I will see if I can get the VPN config.

@Arne, how would I know if it is artifact of the application timing out on packets vs TCP errors?  I did run WinMTR, and it came back with 0 packet lost after 300+ attempts..

thanks again for both of your help.
LVL 37

Assisted Solution

ArneLovius earned 250 total points
ID: 39205309
If WinMTR is not showing any dropped packets, then it points the finger at the application timing out

To see if it is the application timing out, you have two options, either speak to the application developers, or setup a test where you can vary the RTT latency between the client and the server.

Setting up a latency test is significantly more complex than a bandwidth test...

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5512-X Active/Standby HA 4 50
Show IP BGP Information 10 75
Questions on USB 4 ports hub 4 61
Change "enable" password on Cisco Router 7 58
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question