Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a bit of a basic networking question here regarding ping.

When pinging a particular host on a completely different subnet, I get a response like this:

PING myhost.example.com (1.2.3.4) 56(84) bytes of data.
64 bytes from 1.2.3.4: icmp_req=1 ttl=115 time=1.88 ms
64 bytes from 1.2.3.4: icmp_req=2 ttl=115 time=1.66 ms
64 bytes from 1.2.3.4: icmp_req=3 ttl=115 time=1.96 ms
64 bytes from 1.2.3.4: icmp_req=4 ttl=115 time=1.95 ms

--- myhost.example.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 48191ms
rtt min/avg/max/mdev = 1.669/1.868/1.969/0.127 ms

This initially looks normal, but then you see that the total time is 48 seconds to get these 4 responses. When the ping is running, there is a noticable gap of around 10 seconds before each line is printed. However, the rtt is pretty much what I'd expect.

This is causing a bit of an issue, as I'm trying to monitor this host with nagios, and the host check is currently getting a 'Network unreachable' error. The network is reachable, the rtt is sane, but I can't help wonder if this slow total time might have something to do with it.

The host is 14 hops away, and the traceroute looks like this (I've anonymised the intermediate steps, they are all different IPs!):

traceroute to myhost (1.2.3.4), 30 hops max, 60 byte packets
 1  10.A.B.C (10.A.B.C)  0.680 ms  0.729 ms  0.833 ms
 2  10.A.B.C (10.A.B.C)  0.636 ms  0.678 ms  0.759 ms
 3  10.A.B.C (10.A.B.C)  0.803 ms  0.867 ms  0.923 ms
 4  10.A.B.C (10.A.B.C)  0.702 ms  0.738 ms  0.782 ms
 5  10.A.B.C (10.A.B.C)  1.027 ms  1.251 ms  1.342 ms
 6  10.A.B.C (10.A.B.C)  2.688 ms  1.436 ms  1.484 ms
 7  10.A.B.C (10.A.B.C)  2.960 ms  3.475 ms  3.527 ms
 8  10.A.B.C (10.A.B.C)  1.284 ms  1.310 ms  1.393 ms
 9  10.A.B.C (10.A.B.C)  1.990 ms  1.865 ms  1.964 ms
10  10.A.B.C (10.A.B.C)  1.750 ms  1.841 ms  1.748 ms
11  10.A.B.C (10.A.B.C)  1.849 ms  1.614 ms  1.628 ms
12  10.A.B.C (10.A.B.C)  1.997 ms  2.150 ms  2.119 ms
13  10.A.B.C (10.A.B.C)  2.442 ms  2.454 ms  2.560 ms
14  1.2.3.4 (1.2.3.4)  1.978 ms * *

What would cause this?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

This is a bit of a wild guess....

You are pinging by DNS name.
Does the DNS loookup of myhost.example.com take that long to resolve ?
What happens if you ping by ip-address ?

share|improve this answer
    
Good shout, I should have checked that before. Pinging by IP works just as expected. I own the forward DNS server, but I don't own the reverse DNS server. I know my DNS server's fine, so I guess something's up with the reverse DNS? –  growse Sep 24 '12 at 10:10
1  
Looks like it yes. Most PING implementations check both and do it WITHOUT using the DNS resolver cache. They do this again for each ping. This is to make sure they can detect DNS based load-balancing. –  Tonny Sep 24 '12 at 10:44

Try to edit /etc/nsswitch.conf. mDNS caused me the same problem.

If you have:

hosts:  files mdns4_minimal [NOTFOUND=return] dns mdns4

try to replace with:

hosts:  files dns
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.