RE: Crazy Ping Results

[Ray Curtis <ray ccux com>]

>>>>> "pp" == Pete Peterson <petersonp genrad com> writes:

    pp> Thanks for the suggestions, but I'm still bewildered by what I'm seeing:

    pp> Well the "host" incantation I showed at the start of the experiment shows
    pp> the name resolution working OK.  Being the maintainer of our DNS machines,
    pp> I don't believe there's anything strange happening there.  I don't see
    pp> anything strange about the routing:

    pp> [root torvalds rc3.d]# traceroute 132.223.4.1
    pp> traceroute to 132.223.4.1 (132.223.4.1), 30 hops max, 38 byte packets
    pp>  1  cisco32.genrad.com (132.223.32.254)  1.378 ms  0.551 ms  0.634 ms
    pp>  2  ns1.genrad.com (132.223.4.1)  1.159 ms  0.899 ms  0.771 ms

    pp> [root torvalds rc3.d]# traceroute ns1.genrad.com.
    pp> traceroute to ns1.genrad.com (132.223.4.1), 30 hops max, 38 byte packets
    pp>  1  cisco32.genrad.com (132.223.32.254)  0.551 ms  0.541 ms  0.506 ms
    pp>  2  ns1.genrad.com (132.223.4.1)  0.878 ms  0.910 ms  0.770 ms

These times might be acceptable on your network for traceroute.

    pp> [root torvalds rc3.d]# route
    pp> Kernel IP routing table
    pp> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    pp> 132.223.32.0    *               255.255.224.0   U     0      0        0 eth0
    pp> 127.0.0.0       *               255.0.0.0       U     0      0        0 lo
    pp> default         cisco32.genrad. 0.0.0.0         UG    0      0        0 eth0


    pp> The weird thing is that it matters whether I ping by name or by IP.


This nornally is just the differnce in lookup time of DNS, however
after the first time it is used it should be in DNS cache.


    pp> "ping -R" isn't particularly enlightening either.  It is SLOW and
    pp> complains about lost packets, but the routing agrees with the result
    pp> from another 7.2 machine on the same subnet.  The other one runs the
    pp> traceroute much faster and doesn't lose packets.

    pp> [root torvalds rc3.d]# ping -R ns1.genrad.com.
    pp> PING ns1.genrad.com (132.223.4.1) from 132.223.32.43 : 56(124) bytes of data.
    pp> Warning: time of day goes back, taking countermeasures.
    pp> 64 bytes from ns1.genrad.com (132.223.4.1): icmp_seq=0 ttl=254 time=1.440 msec
    pp> RR:     torvalds.genrad.com (132.223.32.43)
    pp>         cisco4.genrad.com (132.223.4.17)
    pp>         ns1.genrad.com (132.223.4.1)
    pp>         ns1.genrad.com (132.223.4.1)
    pp>         cisco32.genrad.com (132.223.32.254)
    pp>         torvalds.genrad.com (132.223.32.43)


>From this it looks like you are using an older version of ping, that
is why the message, Warning: time of day goes back, taking countermeasures.

I can't remember if that package had other problems that just that
stupid message which can be deleted by using ping -U  ns1.genrad.com.
It couldn't hurt but how about upgrading iputils to
iputils-20001110-6 to get the newer version of ping.

This could just turn out to be a bad ping package and not a networking
problem at all.


-- 
Ray Curtis                                     
mailto:ray ccux com                             http://www.ccux.com