PING Reply is a Different Size
Topic Last Modified: 2006-05-17
The Microsoft® Exchange Server Analyzer Tool queries the Win32_PingStatus Microsoft Windows® Management Instrumentation (WMI) class using specific BufferSize setting values and compares them against the returned BufferSize values to determine whether they are the same.
If the returned BufferSize value differs from the value that was sent, the Exchange Server Analyzer displays a warning.
This warning indicates that the packet was truncated somewhere in transit. This may indicate a general network failure or the presence of a black hole router in the environment.
On a TCP/IP wide area network (WAN), communication over some routes may fail if intermediate network segments have packet sizes smaller than the communicating hosts and if routers do not send appropriate ICMP responses to this condition. Alternatively, the firewall on the path may drop such responses. A router that causes this condition is sometimes known as a black hole router.
The presence of a black hole router can cause a variety of errors that do not occur if a program connects to a computer on a local subnet. The behavior may seem intermittent, but when you examine the circumstances more closely you may find that the behavior can be reproduced, for example, by having a client read a large file that is sent from a remote host.
For more information, follow the guidance in Microsoft Knowledge Base article 314825, "How to Troubleshoot Black Hole Router Issues" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=314825).
For more information about detecting and treating possible black hole routers, see the following resources:
Microsoft Knowledge Base article 159211, "Diagnoses and treatment of black hole routers" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=159211).
"Path Maximum Transmission Unit (PMTU) Black Hole Routers" (http://go.microsoft.com/fwlink/?LinkId=66963).