Contents

Optimizing IP performance· 1

IP performance optimization tasks at a glance· 1

Setting the interface MTU for IPv4 packets· 1

Enabling IPv4 local fragment reassembly· 2

Enabling Layer 3 packet statistics collection· 2

Enabling sending ICMP error messages· 2

About sending ICMP error messages· 2

Enabling sending ICMP redirect messages· 3

Enabling sending ICMP time exceeded messages· 3

Enable sending ICMP destination unreachable messages· 4

Configuring rate limit for ICMP error messages· 4

Disabling forwarding ICMP fragments· 5

Specifying the source address for ICMP packets· 5

Disabling sending a specific type of ICMP messages· 6

Disabling receiving a specific type of ICMP messages· 6

Enabling SYN Cookie· 7

Setting the TCP buffer size· 7

Setting TCP timers· 7

Enabling the Timestamps option encapsulation in outgoing TCP packets· 8

Display and maintenance commands for IP performance optimization· 8

 

Optimizing IP performance

IP performance optimization tasks at a glance

All IP performance optimization tasks are optional.

1.     Configuring features for IP packets

¡     Setting the interface MTU for IPv4 packets

¡     Enabling IPv4 local fragment reassembly

¡     Enabling Layer 3 packet statistics collection

2.     Configuring features for ICMP messages

¡     Enabling sending ICMP error messages

¡     Configuring rate limit for ICMP error messages

¡     Disabling forwarding ICMP fragments

¡     Specifying the source address for ICMP packets

¡     Disabling sending a specific type of ICMP messages

¡     Disabling receiving a specific type of ICMP messages

3.     Configuring features for TCP packets

¡     Enabling SYN Cookie

¡     Setting the TCP buffer size

¡     Setting TCP timers

¡     Enabling the Timestamps option encapsulation in outgoing TCP packets

Setting the interface MTU for IPv4 packets

About this task

The interface MTU for IPv4 packets defines the largest size of an IPv4 packet that an interface can transmit without fragmentation. When a packet exceeds the MTU of the sending interface, the device processes the packet in one of the following ways:

·     If the packet disallows fragmentation, the device discards it.

·     If the packet allows fragmentation, the device fragments it and forwards the fragments.

Fragmentation and reassembling consume system resources, so set the MTU based on the network environment to avoid fragmentation.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Set the interface MTU for IPv4 packets.

ip mtu mtu-size

By default, the interface MTU is not set.

Enabling IPv4 local fragment reassembly

About this task

Use this feature on a device to improve fragment reassembly efficiency. This feature enables the LPU to reassemble the IPv4 fragments of a packet if all the fragments arrive at it. If this feature is disabled, all IPv4 fragments are delivered to the active MPU for reassembly. The feature applies only to fragments destined for the same LPU.

Procedure

1.     Enter system view.

system-view

2.     Enable IPv4 local fragment reassembly.

ip reassemble local enable

By default, IPv4 local fragment reassembly is disabled.

Enabling Layer 3 packet statistics collection

About this task

With this feature enabled on an interface, the device counts incoming and outgoing IP packets on the interface. To display the collected statistics, execute the display ip interface command.

Restrictions and guidelines

When the interface is processing a large number of packets, Layer 3 packet statistics collection will cause high CPU usage and degrade the forwarding performance. If the statistics are not necessary, to ensure the device performance, disable this feature.

If you specify the broadcast, multicast, or unicast keyword when executing the command, the configuration applies to the specified type of packets.

If you do not specify the broadcast, multicast, or unicast keyword when executing the command, the configuration applies to all types of packets.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable Layer 3 packet statistics collection.

statistics l3-packet enable { inbound | outbound } [ broadcast | multicast | unicast ] *

By default, Layer 3 packet statistics collection is disabled.

Enabling sending ICMP error messages

About sending ICMP error messages

ICMP messages are used by network layer and transport layer protocols to communicate updates and errors with other devices, facilitating network management.

Sending excessive ICMP messages increases network traffic. The device performance degrades if it receives a lot of malicious ICMP messages that cause it to respond with ICMP error messages. To prevent such problems, the sending of ICMP error messages is disabled by default. You can enable sending ICMP error messages of different types as needed.

ICMP error messages include redirect messages, time exceeded messages, and destination unreachable messages.

Enabling sending ICMP redirect messages

About this task

A host that has only one default route sends all packets to the default gateway. The default gateway sends an ICMP redirect message to inform the host of a correct next hop by following these rules:

·     The receiving and sending interfaces are the same.

·     The selected route is not created or modified by any ICMP redirect messages.

·     The selected route is not destined for 0.0.0.0.

·     There is no source route option in the received packet.

ICMP redirect messages simplify host management and enable hosts to gradually optimize their routing table.

Procedure

1.     Enter system view.

system-view

2.     Enable sending ICMP redirect messages.

ip redirects enable

By default, the sending of ICMP redirect messages is disabled.

Enabling sending ICMP time exceeded messages

About this task

A device sends ICMP time exceeded messages by following these rules:

·     The device sends the source an ICMP TTL exceeded in transit message when the following conditions are met:

¡     The received packet is not destined for the device.

¡     The TTL field of the packet is 1.

·     When the device receives the first fragment of an IP datagram destined for it, it starts a timer. If the timer expires before all the fragments of the datagram are received, the device sends an ICMP fragment reassembly time exceeded message to the source.

Restrictions and guidelines

If the ICMP time exceeded message sending is disabled, the device does not send ICMP TTL exceeded in transit messages. However, it can still send ICMP fragment reassembly time exceeded messages.

Procedure

1.     Enter system view.

system-view

2.     Enable sending ICMP time exceeded messages.

ip ttl-expires enable

By default, the sending of ICMP time exceeded messages is disabled.

Enable sending ICMP destination unreachable messages

About this task

A device sends ICMP destination unreachable messages by following these rules:

·     The device sends the source an ICMP network unreachable message when the following conditions are met:

¡     The packet does not match any route.

¡     No default route exists in the routing table.

·     The device sends the source an ICMP protocol unreachable message when the following conditions are met:

¡     The packet is destined for the device.

¡     The transport layer protocol of the packet is not supported by the device.

·     The device sends the source an ICMP port unreachable message when the following conditions are met:

¡     The UDP packet is destined for the device.

¡     The packet's port number does not match the corresponding process.

·     The device sends the source an ICMP source route failed message when the following conditions are met:

¡     The source uses Strict Source Routing to send packets.

¡     The intermediate device finds that the next hop specified by the source is not directly connected.

·     The device sends the source an ICMP fragmentation needed and DF set message when the following conditions are met:

¡     The MTU of the sending interface is smaller than the packet.

¡     The packet has DF set.

Restrictions and guidelines

If a DHCP-enabled device receives an ICMP echo reply without sending any ICMP echo requests, the device does not send any ICMP protocol unreachable messages to the source. To enable DHCP, use the dhcp enable command. For more information about this command, see Layer 3—IP Services Command Reference.

Procedure

1.     Enter system view.

system-view

2.     Enable sending ICMP destination unreachable messages.

ip unreachables enable

By default, the sending of ICMP destination unreachable messages is disabled.

Configuring rate limit for ICMP error messages

About this task

To avoid sending excessive ICMP error messages within a short period that might cause network congestion, you can limit the rate at which ICMP error messages are sent. A token bucket algorithm is used with one token representing one ICMP error message.

A token is placed in the bucket at intervals until the maximum number of tokens that the bucket can hold is reached.

A token is removed from the bucket when an ICMP error message is sent. When the bucket is empty, ICMP error messages are not sent until a new token is placed in the bucket.

Procedure

1.     Enter system view.

system-view

2.     Set the interval for tokens to arrive in the bucket for ICMP error messages and set the bucket size.

ip icmp error-interval interval [ bucketsize ]

By default, a token is placed in the bucket at an interval of 100 milliseconds, and the bucket allows a maximum of 10 tokens.

To disable the ICMP rate limit, set the interval to 0 milliseconds.

Disabling forwarding ICMP fragments

Restrictions and guidelines

Disabling forwarding ICMP fragments can protect your device from ICMP fragment attacks.

Procedure

1.     Enter system view.

system-view

2.     Disable forwarding ICMP fragments.

ip icmp fragment discarding

By default, forwarding ICMP fragments is enabled.

Specifying the source address for ICMP packets

About this task

Specifying the source IP address for outgoing ping echo requests and ICMP error messages helps users to locate the sending device easily. As a best practice, specify the IP address of the loopback interface as the source IP address.

Restrictions and guidelines

If you specify an IP address in the ping command, ping echo requests use the specified address as the source IP address rather than the IP address specified by the ip icmp source command.

Procedure

1.     Enter system view.

system-view

2.     Specify the source address for outgoing ICMP packets.

ip icmp source [ vpn-instance vpn-instance-name ] ip-address

By default, no source address is specified for outgoing ICMP packets. The default source IP addresses for different types of ICMP packets vary as follows:

¡     For an ICMP error message, the source IP address is the IP address of the receiving interface of the packet that triggers the ICMP error message. ICMP error messages include Time Exceeded, Port Unreachable, and Parameter Problem messages.

¡     For an ICMP echo request, the source IP address is the IP address of the sending interface.

¡     For an ICMP echo reply, the source IP address is the destination IP address of the ICMP echo request specific to this reply.

Disabling sending a specific type of ICMP messages

About this task

By default, the device sends all types of ICMP messages except the Destination Unreachable, Time Exceeded, and Redirect types. Attackers might obtain information from specific types of ICMP messages, causing security issues.

For security purposes, you can perform this task disable sending ICMP messages of specific types.

Restrictions and guidelines

Disabling sending ICMP messages of a specific type might affect network operation. Please use this feature with caution.

To enable sending Destination Unreachable, Time Exceeded, or Redirect messages, you can execute either the ip icmp send enable command or the ip unreachables enable, ip ttl-expires enable, or ip redirects enable command, respectively.

Procedure

1.     Enter system view.

system-view

2.     Disable the device from sending a specific type of ICMP messages.

undo ip icmp { name icmp-name | type icmp-type code icmp-code } send enable

By default, the device sends all types of ICMP messages except the Destination Unreachable, Time Exceeded, and Redirect types.

Disabling receiving a specific type of ICMP messages

About this task

By default, the device receives all types of ICMP messages. Such a setting might affect device performance if a large number of ICMP responses are received within a short time. To solve this issue, you can perform this task to disable the device from receiving a specific type of ICMP messages.

Restrictions and guidelines

Disabling receiving ICMP messages of a specific type might affect network operation. Please use this feature with caution.

Procedure

1.     Enter system view.

system-view

2.     Disable the device from receiving a specific type of ICMP messages.

undo ip icmp { name icmp-name | type icmp-type code icmp-code } receive enable

By default, the device receives all types of ICMP messages.

Enabling SYN Cookie

About this task

A TCP connection is established through a three-way handshake. An attacker can exploit this mechanism to mount SYN Flood attacks. The attacker sends a large number of SYN packets, but does not respond to the SYN ACK packets from the server. As a result, the server establishes a large number of TCP semi-connections and can no longer handle normal services.

SYN Cookie can protect the server from SYN Flood attacks. When the server receives a SYN packet, it responds with a SYN ACK packet without establishing a TCP semi-connection. The server establishes a TCP connection and enters ESTABLISHED state only when it receives an ACK packet from the client.

Procedure

1.     Enter system view.

system-view

2.     Enable SYN Cookie.

tcp syn-cookie enable

By default, SYN Cookie is disabled.

Setting the TCP buffer size

1.     Enter system view.

system-view

2.     Set the size of TCP receive/send buffer.

tcp window window-size

The default buffer size is 63 KB.

Setting TCP timers

About this task

You can set the following TCP timers:

·     SYN wait timer—TCP starts the SYN wait timer after sending a SYN packet. Within the SYN wait timer if no response is received or the upper limit on TCP connection tries is reached, TCP fails to establish the connection.

·     FIN wait timer—TCP starts the FIN wait timer when TCP changes the connection state to FIN_WAIT_2. If no FIN packet is received within the timer interval, TCP terminates the connection. If a FIN packet is received, TCP changes the connection state to TIME_WAIT. If a non-FIN packet is received, TCP restarts the timer, and tears down the connection when the timer expires.

Procedure

1.     Enter system view.

system-view

2.     Set the TCP SYN wait timer.

tcp timer syn-timeout time-value

By default, the TCP SYN wait timer is 75 seconds.

3.     Set the TCP FIN wait timer.

tcp timer fin-timeout time-value

By default, the TCP FIN wait timer is 675 seconds.

Enabling the Timestamps option encapsulation in outgoing TCP packets

About this task

Devices at each end of the TCP connection can calculate the RTT value by using the TCP Timestamps option carried in TCP packets. For security purpose in some networks, you can disable this feature at one end of the TCP connection to prevent intermediate devices from obtaining the Timestamps option information.

This feature takes effect only on new connections that are established after you configure this feature. Existing TCP connections are not affected.

Procedure

1.     Enter system view.

system-view

2.     Enable the device to encapsulate the TCP Timestamps option in outgoing TCP packets.

tcp timestamps enable

By default, the TCP timestamps option is encapsulated in outgoing TCP packets.

Display and maintenance commands for IP performance optimization

Execute display commands in any view and reset commands in user view.

 

Task	Command
Display brief information about RawIP connections.	display rawip [ slot slot-number ]
Display detailed information about RawIP connections.	display rawip verbose [ slot slot-number [ pcb pcb-index ] ]
Display brief information about TCP connections.	display tcp [ slot slot-number ]
Display detailed information about TCP connections.	display tcp verbose [ slot slot-number [ pcb pcb-index ] ]
Display brief information about UDP connections.	display udp [ slot slot-number ]
Display detailed information about UDP connections.	display udp verbose [ slot slot-number [ pcb pcb-index ] ]
Display IP packet statistics.	display ip statistics [ slot slot-number ]
Display TCP traffic statistics.	display tcp statistics [ slot slot-number ]
Display UDP traffic statistics.	display udp statistics [ slot slot-number ]
Display ICMP statistics.	display icmp statistics [ slot slot-number ]
Clear IP packet statistics.	reset ip statistics [ slot slot-number ]
Clear TCP traffic statistics.	reset tcp statistics
Clear UDP traffic statistics.	reset udp statistics

‌