[Gllug] Pinging a machine that is down

[JLMS]

On Mon, Jan 11, 2010 at 5:31 PM, Alain Williams <addw at phcomp.co.uk> wrote:

> On Mon, Jan 11, 2010 at 05:12:20PM +0000, David Damerell wrote:
> > On Monday, 11 Jan 2010, Alain Williams wrote:
> > >I am using the standard ping command, output not piped through anything.
> > >It is not harmful, I don't think, I am just curious as to why it
> happens.
> >
> > Slow name service? When ping takes a few seconds and then spits out a
> > bunch all at once, it can be that, albeit I haven't seen it doing it
> > repeatedly. See what "ping -n" does.
> >
> > Failing that, run tcpdump on the pinged machine?
>
> Getting off my bum and looking harder.
>
>        strace ping machine-that-is-down
>
> shows it doing a sendmsg() followed by a recvmsg() that returns EAGAIN:
>        sendmsg(3, {msg_name(16)={sa_family=AF_INET, sin_port=htons(0),
> sin_addr=inet_addr("192.168.145.19")},
> msg_iov(1)=[{"\10\0#)O.\0\5\30]KK\0\0\0\0X(\v\0\0\0\0\0\20\21\22\23\24\25\26\27"...,
> 64}], msg_controllen=0, msg_flags=0}, 0) = 64
>        recvmsg(3, 0x7fff9ca019b0, 0)           = -1 EAGAIN (Resource
> temporarily unavailable)
>        gettimeofday({1263230233, 732119}, NULL) = 0
>
> This happens 3 times, then after the 3rd sendmsg() the recvmsg() returns
> EHOSTUNREACH
>
>        recvmsg(3, 0x7fff9ca019b0, 0)           = -1 EHOSTUNREACH (No route
> to host)
>        recvmsg(3, {msg_name(16)={sa_family=AF_INET, sin_port=htons(0),
> sin_addr=inet_addr("192.168.145.19")}, msg_iov(1)=[{"\10\0#)O.\0\5", 8}],
> msg_controllen=80, {cmsg_len=32, cmsg_level=SOL_SOCKET, cmsg_type=0x1d /*
> SCM_??? */, ...}, msg_flags=MSG_TRUNC|MSG_ERRQUEUE},
> MSG_ERRQUEUE|MSG_DONTWAIT) = 8
>        write(1, "From mint.phcomp.co.uk (192.168."..., 80From
> mint.phcomp.co.uk (192.168.145.12) icmp_seq=5 Destination Host Unreachable
>
> tcpdump shows:
>        17:27:10.111651 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:11.111570 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:12.112491 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:13.112415 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:14.112341 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:15.112263 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:16.112189 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:17.112111 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:19.111959 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:20.111883 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:21.111808 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:23.111656 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:24.111578 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:25.111504 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>        17:27:27.111351 arp who-has machine-that-is-down tell
> mint.phcomp.co.uk
>
> Note the timing, 3 then a gap repeated.
>
>
It would be worth trying the ping -n without stracing.

Also have a look at the network interfaces' configuration, you want both to
be full duplex (I have seen erroneous behaviour when one machine is full
duplex and the other is half duplex, don't ask me what this means, I am no
guru :-) )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.lug.org.uk/pipermail/gllug/attachments/20100111/495307c1/attachment.html>
-------------- next part --------------
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug