[Gllug] Pinging a machine that is down

[Alain Williams]

On Mon, Jan 11, 2010 at 05:12:20PM +0000, David Damerell wrote:
> On Monday, 11 Jan 2010, Alain Williams wrote:
> >I am using the standard ping command, output not piped through anything.
> >It is not harmful, I don't think, I am just curious as to why it happens.
> 
> Slow name service? When ping takes a few seconds and then spits out a
> bunch all at once, it can be that, albeit I haven't seen it doing it
> repeatedly. See what "ping -n" does.
> 
> Failing that, run tcpdump on the pinged machine?

Getting off my bum and looking harder.

	strace ping machine-that-is-down

shows it doing a sendmsg() followed by a recvmsg() that returns EAGAIN:
	sendmsg(3, {msg_name(16)={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.145.19")}, msg_iov(1)=[{"\10\0#)O.\0\5\30]KK\0\0\0\0X(\v\0\0\0\0\0\20\21\22\23\24\25\26\27"..., 64}], msg_controllen=0, msg_flags=0}, 0) = 64
	recvmsg(3, 0x7fff9ca019b0, 0)           = -1 EAGAIN (Resource temporarily unavailable)
	gettimeofday({1263230233, 732119}, NULL) = 0

This happens 3 times, then after the 3rd sendmsg() the recvmsg() returns EHOSTUNREACH

	recvmsg(3, 0x7fff9ca019b0, 0)           = -1 EHOSTUNREACH (No route to host)
	recvmsg(3, {msg_name(16)={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.145.19")}, msg_iov(1)=[{"\10\0#)O.\0\5", 8}], msg_controllen=80, {cmsg_len=32, cmsg_level=SOL_SOCKET, cmsg_type=0x1d /* SCM_??? */, ...}, msg_flags=MSG_TRUNC|MSG_ERRQUEUE}, MSG_ERRQUEUE|MSG_DONTWAIT) = 8
	write(1, "From mint.phcomp.co.uk (192.168."..., 80From mint.phcomp.co.uk (192.168.145.12) icmp_seq=5 Destination Host Unreachable

tcpdump shows:
	17:27:10.111651 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:11.111570 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:12.112491 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:13.112415 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:14.112341 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:15.112263 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:16.112189 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:17.112111 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:19.111959 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:20.111883 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:21.111808 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:23.111656 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:24.111578 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:25.111504 arp who-has machine-that-is-down tell mint.phcomp.co.uk
	17:27:27.111351 arp who-has machine-that-is-down tell mint.phcomp.co.uk

Note the timing, 3 then a gap repeated.

-- 
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256  http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
Past chairman of UKUUG: http://www.ukuug.org/
#include <std_disclaimer.h>
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug