📌 Understanding Packet Loss | Large Pings vs Fibre Uplink/Downlink Issues
Diagnosing Problems in Fibre Pair Links

Driving SD-WAN Adoption in South Africa
Search for a command to run...
Diagnosing Problems in Fibre Pair Links

Driving SD-WAN Adoption in South Africa
No comments yet. Be the first to comment.
Enhancing Security and Compliance with ManageEngine ADAudit Plus

Why Pings Aren't Enough & NMS is Essential

What is SD-WAN (Software Defined Wide Area Networking)? | The Mechanics of this Groundbreaking New Network Technology

Embracing First Principles & the Scientific Method

Ever Wondered | "Is My Internet Really 99.9% Reliable?" 🤔

Packet loss is a common frustration in networking, whether you're troubleshooting WiFi, wired Ethernet, or fibre optic links. Two key scenarios often confuse engineers:
Why do larger ping packets experience more packet loss than smaller ones?
Why might packet loss occur in only one direction on a fibre link?
In this article, we’ll break down both issues, explaining why they happen and how to diagnose them effectively.
When troubleshooting a network, ICMP ping is a go-to tool. But you may notice that small packets go through fine, while larger ones experience higher loss rates.
If a ping packet exceeds the Maximum Transmission Unit (MTU), it must be fragmented into smaller pieces.
If any fragment is lost, the entire packet is considered lost.
Firewalls or security policies may drop fragmented packets as a security measure.
Network devices (switches, routers, firewalls) have limited buffer space.
Larger packets fill up buffers faster, increasing the chance of dropped packets when congestion occurs.
Larger packets spend more time on the wire, increasing exposure to interference, bad cables, or faulty hardware.
A single bit error causes the entire packet to be discarded.
Some older or overloaded devices struggle with processing large packets.
Firewalls and security appliances may rate-limit large ICMP packets to prevent DoS attacks.
In WiFi networks, larger packets are more vulnerable to signal interference and retransmissions.
Some wireless setups have a low fragmentation threshold, causing higher loss rates for large packets.
You can check this behaviour using ping with different packet sizes:
ping -s 56 8.8.8.8 # Small 64-byte packet (56 + 8-byte ICMP header)
ping -s 1472 8.8.8.8 # Large 1500-byte packet (1472 + 8-byte ICMP header)
If large packets show higher loss, you should investigate MTU mismatches, congestion, or hardware limitations.
Fibre optic connections use separate strands for transmit and receive signals. This means:
One strand handles traffic from A → B (Uplink).
The other strand handles traffic from B → A (Downlink).
If there’s packet loss in only one direction, it usually means a problem with one of the fibre strands.
If the downlink strand is damaged or dirty, traffic from B → A is impacted, while traffic from A → B works fine.
🔎 Diagnosis:
Use ping or iperf to test in both directions.
Swap the TX and RX fibre pairs. If the problem reverses, one fibre is faulty.
Fibre optics rely on precise optical signal levels. If the receive power is too weak on one side:
The receiver struggles to interpret the signal, causing packet loss.
The sender might still transmit fine, making the issue appear one-sided.
🔎 Diagnosis:
Use an optical power meter to measure the signal at both ends.
Check that the SFP or transceiver is correctly seated and clean.
Some network devices handle traffic differently in each direction.
A firewall or router might shape traffic more aggressively in one direction.
If one path has a congested buffer, large packets may get dropped only on one side.
🔎 Diagnosis:
Use traceroute and mtr to check for asymmetric routing.
Inspect firewall and QoS settings.
Use different ping sizes (ping -s 56 vs ping -s 1472).
If large packets are dropping, check MTU settings, buffer limits, or firewall rules.
Run ping tests between both IPs (ping -s 56 both ways).
Swap the TX/RX fibre strands to see if the issue reverses.
Use an optical power meter to check signal levels.
Use iperf to test TCP/UDP throughput.
Check for asymmetric routing or firewall shaping rules.
Inspect for buffer overruns or high CPU usage on routers.
You ever notice how network operators never find a fault unless their entire core network is on fire? It doesn’t matter how much proof you provide—ping logs, traceroutes, packet captures, live sacrifice to the networking gods—they always claim it’s fine on their side.
You report packet loss from your branch site.
Instead of testing from your branch, they test from their core—where, surprise surprise, everything is fine.
They tell you, "Our network is clean. The issue must be on your side."
If a link from your branch to their core is bad, testing from their core does nothing.
It’s like saying your house isn’t on fire because the fire station is fine.
They never test at the problematic point.
They Don’t Want to Admit Fault – Because that would mean work.
They Don’t Want SLA Penalties – If they acknowledge an issue, they owe credits.
They’re Too Lazy to Roll a Truck – Dispatching someone costs money.
✔ Make them test FROM the affected site.
✔ Provide proof – timestamps, bidirectional ping tests, MTR logs.
✔ Escalate and embarrass them – If they refuse to test properly, escalate until someone with a brain gets involved.
Large packet loss is often caused by MTU mismatches, buffer overflows, or hardware limitations.
Unidirectional packet loss on a fibre link usually means a faulty fibre strand, weak optical signal, or asymmetric traffic shaping.
Network operators will gaslight you into thinking it’s not their problem, so force them to test from the affected location.
By understanding these principles, you’ll troubleshoot packet loss issues more effectively, saving yourself hours of frustration—and maybe, just maybe, making your provider do their job. 🚀