Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What does it mean when a ping reports a reasonable time (~10ms) but actually takes quite a long wall clock time (~15 seconds)? (Additionally, passing the -U option for "full user-to-user latency" has no effect.)

This happens when pinging a certain external host from my work computer - and I'm poking around because I also get timeouts on HTTP requests to the same host. Something similar happens with traceroute, on only the last couple hops, which reach the subnet of the destination.

(Also, for what it's worth, the external host is cdn.sstatic.net, which I know generally works!)

share|improve this question
1  
Are you using any additional options with ping that could be affecting it? –  Nixphoe Jul 7 '11 at 16:34
    
@Nixphoe: Nope, starting from a blank slate, and only tried adding other things to see if it got me more information. And like I said, I have a preexisting symptom. –  Jefromi Jul 7 '11 at 16:49
    
I'm not an expert, but routing traffic is a little difference than using the ICMP protocol. I've seen what you're describing (though not as long), and from my understanding the wait is more due to waiting for the router to process and report on the icmp request, n ot lag on your network. The actual Time listing in the ping should be your correct time it takes to get to that device. –  Nixphoe Jul 7 '11 at 17:03
    
Now I have that exact same problem, but the reported latency is about 80ms from where I am. However when I try to visit an HTTP web page on the external host, I get a "502 Bad Gateway / nginx 1.1.x" error, which appears immediately with no noticeably latency. I suspect Centurylink has installed a transparent web proxy for traffic shaping purposes. The problem is intermittent. –  JL344 Jul 9 '12 at 5:16

2 Answers 2

up vote 4 down vote accepted

What happens if you use the -n flag to inhibit the lookup of "symbolic names for host addresses"? The sort of behavior you're describing often suggests delays due to slow reverse DNS lookups.

For the example you've given (cdn.sstatic.net), I see that there is no valid reverse entry that corresponds to the forward entry (I'm seeing 69.174.57.102). This is exactly the sort of situation that can lead to weird behavior if you're using tools that attempts reverse lookups.

share|improve this answer
    
Why would ping perform a reverse lookup for a host name? –  joeqwerty Jul 7 '11 at 20:58
    
Aha! Right on the mark. Of course, I haven't addressed my original problem, but now I know that that's separate. –  Jefromi Jul 7 '11 at 21:06

Yes this is probably DNS.

2 ways to determine. strace -r ping ... is good.

 0.000014 fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
 0.000015 poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
 0.000020 sendto(4, "\305\351\1\0\0\1\0\0\0\0\0\0\10intel-01\20scinterane"..., 47, MSG_NOSIGNAL, NULL, 0) = 47
 0.000022 poll([{fd=4, events=POLLIN}], 1, 5000) = 0 (Timeout)
 4.999871 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 5

See the 4.999 second delay in the DNS lookup.

Or you can just ping a host name and ping the ip address if pinging the hostname is consistently and substantially slower than pinging the IP address directly the difference between.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.