8

What does it mean when a ping reports a reasonable time (~10ms) but actually takes quite a long wall clock time (~15 seconds)? (Additionally, passing the -U option for "full user-to-user latency" has no effect.)

This happens when pinging a certain external host from my work computer - and I'm poking around because I also get timeouts on HTTP requests to the same host. Something similar happens with traceroute, on only the last couple hops, which reach the subnet of the destination.

(Also, for what it's worth, the external host is cdn.sstatic.net, which I know generally works!)

4
  • 1
    Are you using any additional options with ping that could be affecting it? – Nixphoe Jul 7 '11 at 16:34
  • @Nixphoe: Nope, starting from a blank slate, and only tried adding other things to see if it got me more information. And like I said, I have a preexisting symptom. – Cascabel Jul 7 '11 at 16:49
  • I'm not an expert, but routing traffic is a little difference than using the ICMP protocol. I've seen what you're describing (though not as long), and from my understanding the wait is more due to waiting for the router to process and report on the icmp request, n ot lag on your network. The actual Time listing in the ping should be your correct time it takes to get to that device. – Nixphoe Jul 7 '11 at 17:03
  • Now I have that exact same problem, but the reported latency is about 80ms from where I am. However when I try to visit an HTTP web page on the external host, I get a "502 Bad Gateway / nginx 1.1.x" error, which appears immediately with no noticeably latency. I suspect Centurylink has installed a transparent web proxy for traffic shaping purposes. The problem is intermittent. – JL344 Jul 9 '12 at 5:16
7

What happens if you use the -n flag to inhibit the lookup of "symbolic names for host addresses"? The sort of behavior you're describing often suggests delays due to slow reverse DNS lookups.

For the example you've given (cdn.sstatic.net), I see that there is no valid reverse entry that corresponds to the forward entry (I'm seeing 69.174.57.102). This is exactly the sort of situation that can lead to weird behavior if you're using tools that attempts reverse lookups.

2
  • Why would ping perform a reverse lookup for a host name? – joeqwerty Jul 7 '11 at 20:58
  • Aha! Right on the mark. Of course, I haven't addressed my original problem, but now I know that that's separate. – Cascabel Jul 7 '11 at 21:06
7

Yes this is probably DNS.

2 ways to determine. strace -r ping ... Shows this:

 0.000014 fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
 0.000015 poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
 0.000020 sendto(4, "\305\351\1\0\0\1\0\0\0\0\0\0\10intel-01\20scinterane"..., 47, MSG_NOSIGNAL, NULL, 0) = 47
 0.000022 poll([{fd=4, events=POLLIN}], 1, 5000) = 0 (Timeout)
 4.999871 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 5

The 4.999 second delay in the DNS lookup.

Or you can just ping a hostname and ping the IP address directly. Whenever pinging the host name is consistently and substantially slower than pinging the IP address. It is due to delays in the DNS lookup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.