Mailing List Archive: NANOG: users

duplicate packet

Index | Next | Previous | View Threaded

chloekcy2000 at yahoo

Sep 10, 2008, 3:45 AM

Post #1 of 11 (1322 views)
Permalink

duplicate packet

Hi all

When I ping the ip, I get the duplicate

I check the ip is just one. Why it happens?

Thank you

64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.296 ms
64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.328 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.291 ms
64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.316 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.279 ms
64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.309 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.271 ms
64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.299 ms (DUP!)

---------------------------------

Yahoo! Canada Toolbar : Search from anywhere on the web and bookmark your favourite sites. Download it now!

fweimer at bfk

Sep 10, 2008, 4:43 AM

Post #2 of 11 (1216 views)
Permalink

Re: duplicate packet [In reply to]

* chloe K.:

> When I ping the ip, I get the duplicate
>
> I check the ip is just one. Why it happens?

Are the source and target on the same subnet? Have you checked the
source MAC address of the response?

--
Florian Weimer <fweimer [at] bfk>
BFK edv-consulting GmbH http://www.bfk.de/
Kriegsstraße 100 tel: +49-721-96201-1
D-76133 Karlsruhe fax: +49-721-96201-99

darden at armc

Sep 10, 2008, 5:01 AM

Post #3 of 11 (1213 views)
Permalink

RE: duplicate packet [In reply to]

Check your ARP tables, local and on intervening switches/routers. Make sure there are no duplicate entries for that IP. If you note the response time, the second packet is always higher which might be indicative. I would also check for a botched MITM a la C&A.

Even if there is no obvious ARP table manglement, you might try flushing the local and intervening caches.

Try the ping from another host, another subnet, another segment, get more info.

--p

-----Original Message-----
From: chloe K [mailto:chloekcy2000 [at] yahoo]
Sent: Wednesday, September 10, 2008 6:46 AM
To: nanog [at] nanog
Subject: duplicate packet

Hi all

When I ping the ip, I get the duplicate

I check the ip is just one. Why it happens?

Thank you

64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.296 ms
64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.328 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.291 ms
64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.316 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.279 ms
64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.309 ms (DUP!)
64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.271 ms
64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.299 ms (DUP!)

---------------------------------

Yahoo! Canada Toolbar : Search from anywhere on the web and bookmark your favourite sites. Download it now!

eric at atlantech

Sep 10, 2008, 5:06 AM

Post #4 of 11 (1212 views)
Permalink

RE: duplicate packet [In reply to]

> -----Original Message-----
> From: chloe K [mailto:chloekcy2000 [at] yahoo]
> Sent: Wednesday, September 10, 2008 6:46 AM
> To: nanog [at] nanog
> Subject: duplicate packet
>
> Hi all
>
> When I ping the ip, I get the duplicate
>
> I check the ip is just one. Why it happens?
>
> Thank you
>
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
> 64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.296 ms
> 64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.328 ms (DUP!)
> 64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.291 ms
> 64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.316 ms (DUP!)
> 64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.279 ms
> 64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.309 ms (DUP!)
> 64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.271 ms
> 64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.299 ms (DUP!)

Check to see whether or not the port connected to that host is mirrored or in a SPAN VLAN. Misconfiguration on an analyzer server can cause duplicate traffic to be generated.

-evt

jlewis at lewis

Sep 10, 2008, 5:11 AM

Post #5 of 11 (1209 views)
Permalink

Re: duplicate packet [In reply to]

On Wed, 10 Sep 2008, chloe K wrote:

> When I ping the ip, I get the duplicate
>
> I check the ip is just one. Why it happens?
>
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)

Not enough information has been given.

Just hope it's not being caused by a Level3/Sprint circuit...ours is still
doing this (when I change back to HDLC) and they just don't freaking care.
Sometimes I wish I worked for a big telco so I could leave things broken
and say "hey, I'm the telco, I don't have to care."

Maybe we should refuse to pay for the affected DS3 and see if that gets
more attention.

----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

sabt at sabt

Sep 10, 2008, 5:11 AM

Post #6 of 11 (1215 views)
Permalink

Re: duplicate packet [In reply to]

* chloe K wrote:
> When I ping the ip, I get the duplicate
>
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
^^^^^^^^^^^^
What's your netmask? Is 192.168.0.95 your net's broadcast address?

sebastian

--
SABT-RIPE PGPKEY-D008DA9C

tims at donet

Sep 10, 2008, 5:26 AM

Post #7 of 11 (1207 views)
Permalink

RE: duplicate packet [In reply to]

Instead, dispute the bill and then when they won't credit you for not giving you what you ordered, open a complaint with the state public utilities commission. It may get you some movement on the issue.

--
Tim Sanderson, network administrator
tims [at] donet

-----Original Message-----
From: Jon Lewis [mailto:jlewis [at] lewis]
Sent: Wednesday, September 10, 2008 8:11 AM
To: chloe K
Cc: nanog [at] nanog
Subject: Re: duplicate packet

On Wed, 10 Sep 2008, chloe K wrote:

> When I ping the ip, I get the duplicate
>
> I check the ip is just one. Why it happens?
>
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)

Not enough information has been given.

Just hope it's not being caused by a Level3/Sprint circuit...ours is still
doing this (when I change back to HDLC) and they just don't freaking care.
Sometimes I wish I worked for a big telco so I could leave things broken
and say "hey, I'm the telco, I don't have to care."

Maybe we should refuse to pay for the affected DS3 and see if that gets
more attention.

----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

LarrySheldon at cox

Sep 10, 2008, 6:10 AM

Post #8 of 11 (1211 views)
Permalink

Re: duplicate packet [In reply to]

Sebastian Abt wrote:
> * chloe K wrote:
>> When I ping the ip, I get the duplicate
>>
>> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
>> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
> ^^^^^^^^^^^^
> What's your netmask? Is 192.168.0.95 your net's broadcast address?

Ohhh! Nice catch!

jensenja at gmail

Sep 22, 2008, 7:54 PM

Post #9 of 11 (1157 views)
Permalink

Re: duplicate packet [In reply to]

She'd have to actually specify -b to ping a broadcast address, and if
she did, she would only get replies back from the hosts on that
subnet, not duplicate replies from the same IP.

On Wed, Sep 10, 2008 at 5:11 AM, Sebastian Abt <sabt [at] sabt> wrote:
> * chloe K wrote:
>> When I ping the ip, I get the duplicate
>>
>> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
>> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
> ^^^^^^^^^^^^
> What's your netmask? Is 192.168.0.95 your net's broadcast address?
>
> sebastian
>
> --
> SABT-RIPE PGPKEY-D008DA9C
>
>

jensenja at gmail

Sep 22, 2008, 7:55 PM

Post #10 of 11 (1149 views)
Permalink

Re: duplicate packet [In reply to]

At least I think that's how it works. :)

On Mon, Sep 22, 2008 at 7:54 PM, John Jensen <jensenja [at] gmail> wrote:
> She'd have to actually specify -b to ping a broadcast address, and if
> she did, she would only get replies back from the hosts on that
> subnet, not duplicate replies from the same IP.
>
> On Wed, Sep 10, 2008 at 5:11 AM, Sebastian Abt <sabt [at] sabt> wrote:
>> * chloe K wrote:
>>> When I ping the ip, I get the duplicate
>>>
>>> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms
>>> 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!)
>> ^^^^^^^^^^^^
>> What's your netmask? Is 192.168.0.95 your net's broadcast address?
>>
>> sebastian
>>
>> --
>> SABT-RIPE PGPKEY-D008DA9C
>>
>>
>

Valdis.Kletnieks at vt

Sep 22, 2008, 8:30 PM

Post #11 of 11 (1160 views)
Permalink

Re: duplicate packet [In reply to]

On Mon, 22 Sep 2008 19:54:17 PDT, John Jensen said:
> She'd have to actually specify -b to ping a broadcast address,

Only true if you're pinging the broadcast address of a network that you
have an interface on, or the system has other knowledge of the netmask/etc.

If you're pinging a remote address, your system (in general) has no way of
knowing if that .0.95 is a broadcast address for a /27, or a normal address
in the middle of a /26 (or one of the other possibilities).

(I've lost the original posting, and can't recall if the OP said if she was
pinging from on-subnet or off-subnet).

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads