Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For example, has at least these ip:

Does ping just pick one of them randomly?

share|improve this question

migrated from Sep 17 '11 at 9:06

This question came from our site for professional and enthusiast programmers.

The answer is it depends on how your DNS resolver is setup and also how the DNS server for the domain in question is set up.

The DNS resolver on your ping source host will consult the OS and network configuration to lookup the host you want to ping. If this is a new host, one for which you haven't previously done a lookup, the DNS query sequence will go from start to finish.

The number of A records and contents of those records as well as what order they are are returned depends on the name servers for the target ping destination domain. This process is a whole other discussion.

Your DNS client will pick one of those IPs returned in the A records and your ping will start sending IMCP echo-request messages to that destination IP.

Your local OS may cache one or more of the responses for some period of time, typically but not always the TTL specified in the A record. There is also another caching opportunity at your DNS resolver, again, which typically but not always will follow the TTL.

One final wrinkle is the so-called sort ordering done by some DNS clients. See:

share|improve this answer
Does gethostbyname do sort ordering automatically?How to check whether ordering is enabled in linux? – kernel Sep 17 '11 at 11:39

It just picks one of them. It's not quite random -- for example, if one of them is on the same local network, it will typically pick that one.

share|improve this answer
the same local network with what? – x86 Sep 17 '11 at 3:08
The same local network with the machine you ran 'ping' on. – David Schwartz Sep 17 '11 at 9:07
Can you provide some source code proof of this? I've never seen this behavior before. – polynomial Sep 17 '11 at 11:32
Is it done by DNS server or the client? Is the result of gethostbyname already sorted?How to check whether it's actually the case in linux? – kernel Sep 17 '11 at 11:35
Independent of what the DNS server does, the client sorts the results. Typically, ping will use getaddrinfo, not gethostbyname. RFC3484 specifies the sort order, which on UNIXy operating systems is often controlled by a file named /etc/gai.conf. – David Schwartz Sep 17 '11 at 11:46


    The source host generates an ICMP protocol data unit.
    The ICMP PDU is encapsulated in an IP datagram, with the source and destination IP addresses in the IP header. At this point the datagram is most properly referred to as an ICMP ECHO datagram, but we will call it an IP datagram from here on since that's what it looks like to the networks it is sent over.
    The source host notes the local time on it's clock as it transmits the IP datagram towards the destination. Each host that receives the IP datagram checks the destination address to see if it matches their own address or is the all hosts address (all 1's in the host field of the IP address).
    If the destination IP address in the IP datagram does not match the local host's address, the IP datagram is forwarded to the network where the IP address resides.
    The destination host receives the IP datagram, finds a match between itself and the destination address in the IP datagram.
    The destination host notes the ICMP ECHO information in the IP datagram, performs any necessary work then destroys the original IP/ICMP ECHO datagram.
    The destination host creates an ICMP ECHO REPLY, encapsulates it in an IP datagram placing it's own IP address in the source IP address field, and the original sender's IP address in the destination field of the IP datagram.
    The new IP datagram is routed back to the originator of the PING. The host receives it, notes the time on the clock and finally prints PING output information, including the elapsed time.

The process above is repeated until all requested ICMP ECHO packets have been sent and their responses have been received or the default 2-second timeout expired. The default 2-second timout is local to the host initiating the PING and is NOT the Time-To-Live value in the datagram.


share|improve this answer
-1 for not answering any part of the question actually asked. – JdeBP Sep 17 '11 at 14:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.