1

Are there any practical scenarios with two nodes where one (say A) can send packets to be other one (say B) perfectly, but the packets sent from B to A are prone to packet drop?

For the communication channel between the nodes, it can be either direct communication between two nodes or it can be through an access point. So, I am not talking about Internet network.

I don’t have any practical scenarios in my mind but I think this scenario can happens because of

  1. Outgoing buffer sizes for the nodes are different: If the buffer size of B is small, the packets it want to send can be dropped (network congestion).
  2. Transmitting powers for the nodes are different: Each communication channel is characterized by a tolerable SNR (signal-to-noise ratio). If the transmitting power is lower than a threshold, then bits can arrive the destination with error, resulting in checksum fail for the packet. In this case, the packet is discarded by the receiver. Now, if node B is battery-limited and can only transmit with low power, packet drop can happen.
  3. The communication channels are prone to attack: Node A has enough budget to protect the channel, while B hasn’t.

Is what I have said above correct? Can anyone help me edit the above cases? And are there any practical scenario for these cases?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 20:03
3

You are not mentioning the kind of channel that there is between the nodes, but doing some guesses:

If the communication happens across the whole internet, communication between two points doesn't need to go through the same route. Albeit it is often the case, that we assume a fixed route that is used back and forth, routing decisions are taken separately for each packet.

At macroscale,¹ if A is in Argentina and B in Brazil, packets A→B could go through Bolivia, but packets back B→A go through Paraguay.

¹(The same happens at smaller levels such as or even inside the same CPD, but going country-wide shows it more graphical)

This may be a result of their different views of the network topology, or a conscious decision due to the different agreements between the transit companies (such as being cheaper for A to send via Bolivia -perhaps even detecting it as unoptimal-, while B has a different preference).

Obviously, having different routes means going through different hardware, which may have different congestion levels and priorities, leading to packages on a single path getting dropped.

If we are talking about something like a wireless connection, you present a good example in #2, although there are more options than simply power levels, since the antenna models will also be relevant on how much can the node achieve. Even with identical hardware at the nodes, a common case would be that node A is located near to the AP, and has no problem communicating with it (and thus the rest of the network), but node B is relatively far, making his packets being easier to be dropped.

  • Thanks for your response. I edited the question and specified what type of communication I am talking about. What you mentioned at the last paragraph of your response was a good point. Tnx – m0_as Jan 24 '18 at 0:08
  • Do you any completing comment for #3 I mentioned? I am not familiar with security so I just wrote budget but I don't know practically a node can protect its outgoing packets. – m0_as Jan 24 '18 at 0:16
2
  1. Your last scenario certainly makes sense. Even a very busy network can cause CPU/RAM starvation on network devices. A broadcast storm from a misconfigured device could bring a network switch to it's knees. (I've seen this happen when a node was accidentally configured to bridge two VLANs off the same switch and it ended up amplifying layer2 PDUs until the network just crashed entirely)

  2. It could happen in a local 10GbE network, too. Consider a scenario where nodes are configured to use LACP in an MLAG environment. It could be possible that one node is successfully loadbalancing traffic across both links and both switches, but the other side of the connection might be preferring one link over another, and maybe the link that is being preferred is suboptimal for some reason. Defective hardware, bad configuration, cpu/ram starvation in the network somewhere, cpu/ram starvation in the node itself, underperforming hardware (buffer ovverruns, etc)

               /---[sw1, load 5%]----\
              /      |         |      \
    [A:bond0]-       |mlag pair|       -[B:bond0]
              \      |         |      /
               \---[sw2, load 99%]---/
    

    This wouldn't even require asynchronous traffic patterns, since the hosts are using LACP and are unaware that traffic is taking multiple paths. So, in a situation like this, we could have sw1 passing all it's traffic, and sw2 discarding packets due to load. You would still see a pretty significant retransmissions in TCP sessions. Heck, that can be an attack all on it's own.

  3. I have seen situations in the past where servers were configured with what were effectively 1-way NICs. For example, at the physical layer, the pair of wires going from Host-A-tx -> Host-B-rx are whole, but the pair of wires going from Host-A-rx <- Host-B-tx are not, and instead that half of the connection has been faked out to make the NIC think it has full bidirectional link. This was done in an environment where network devices were logging across a 1-way link to a SIEM. So there was no way for an attack to cross that plane because a full bi-directional connection was not physically possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.