Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a bit of a basic networking question here regarding ping.

When pinging a particular host on a completely different subnet, I get a response like this:

PING ( 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=115 time=1.88 ms
64 bytes from icmp_req=2 ttl=115 time=1.66 ms
64 bytes from icmp_req=3 ttl=115 time=1.96 ms
64 bytes from icmp_req=4 ttl=115 time=1.95 ms

--- ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 48191ms
rtt min/avg/max/mdev = 1.669/1.868/1.969/0.127 ms

This initially looks normal, but then you see that the total time is 48 seconds to get these 4 responses. When the ping is running, there is a noticable gap of around 10 seconds before each line is printed. However, the rtt is pretty much what I'd expect.

This is causing a bit of an issue, as I'm trying to monitor this host with nagios, and the host check is currently getting a 'Network unreachable' error. The network is reachable, the rtt is sane, but I can't help wonder if this slow total time might have something to do with it.

The host is 14 hops away, and the traceroute looks like this (I've anonymised the intermediate steps, they are all different IPs!):

traceroute to myhost (, 30 hops max, 60 byte packets
 1  10.A.B.C (10.A.B.C)  0.680 ms  0.729 ms  0.833 ms
 2  10.A.B.C (10.A.B.C)  0.636 ms  0.678 ms  0.759 ms
 3  10.A.B.C (10.A.B.C)  0.803 ms  0.867 ms  0.923 ms
 4  10.A.B.C (10.A.B.C)  0.702 ms  0.738 ms  0.782 ms
 5  10.A.B.C (10.A.B.C)  1.027 ms  1.251 ms  1.342 ms
 6  10.A.B.C (10.A.B.C)  2.688 ms  1.436 ms  1.484 ms
 7  10.A.B.C (10.A.B.C)  2.960 ms  3.475 ms  3.527 ms
 8  10.A.B.C (10.A.B.C)  1.284 ms  1.310 ms  1.393 ms
 9  10.A.B.C (10.A.B.C)  1.990 ms  1.865 ms  1.964 ms
10  10.A.B.C (10.A.B.C)  1.750 ms  1.841 ms  1.748 ms
11  10.A.B.C (10.A.B.C)  1.849 ms  1.614 ms  1.628 ms
12  10.A.B.C (10.A.B.C)  1.997 ms  2.150 ms  2.119 ms
13  10.A.B.C (10.A.B.C)  2.442 ms  2.454 ms  2.560 ms
14 (  1.978 ms * *

What would cause this?

share|improve this question
up vote 4 down vote accepted

This is a bit of a wild guess....

You are pinging by DNS name.
Does the DNS loookup of take that long to resolve ?
What happens if you ping by ip-address ?

share|improve this answer
Good shout, I should have checked that before. Pinging by IP works just as expected. I own the forward DNS server, but I don't own the reverse DNS server. I know my DNS server's fine, so I guess something's up with the reverse DNS? – growse Sep 24 '12 at 10:10
Looks like it yes. Most PING implementations check both and do it WITHOUT using the DNS resolver cache. They do this again for each ping. This is to make sure they can detect DNS based load-balancing. – Tonny Sep 24 '12 at 10:44

In addition to the DNS lookuping issue, it may also caused by the interval between ping packets:

-i interval
          Wait  interval  seconds  between  sending each packet.  The default is to wait for one second between each packet normally, or not to wait in
          flood mode. Only super-user may set interval to values less 0.2 seconds.

If you ping google's server by ip:

# ping -c 3
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=50 time=2.51 ms
64 bytes from icmp_seq=2 ttl=50 time=2.52 ms
64 bytes from icmp_seq=3 ttl=50 time=2.72 ms

--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2006ms
rtt min/avg/max/mdev = 2.511/2.589/2.729/0.114 ms

Total time is still much more larger than the sum of rtts.

But if you use ping in flood mode:

# ping -c 3 -f
PING ( 56(84) bytes of data.

--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 8ms
rtt min/avg/max/mdev = 2.474/2.744/3.140/0.286 ms, ipg/ewma 4.230/2.657 ms

or setting interval to 0:

# ping -c 3 -i 0
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=50 time=2.83 ms
64 bytes from icmp_seq=2 ttl=50 time=2.87 ms
64 bytes from icmp_seq=3 ttl=50 time=2.96 ms

--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 9ms
rtt min/avg/max/mdev = 2.834/2.891/2.966/0.083 ms, ipg/ewma 4.510/2.855 ms

Total time is nearly the sum of rtts.

share|improve this answer

Try to edit /etc/nsswitch.conf. mDNS caused me the same problem.

If you have:

hosts:  files mdns4_minimal [NOTFOUND=return] dns mdns4

try to replace with:

hosts:  files dns
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.