10-01-2007 04:31 PM - edited 03-05-2019 06:48 PM
Hi experts,
I was just wondering, whenever i do a ping, I usually get a timeout on the first ping then the next ping will be fine.
is this normal?
Im using Cisco 3560,3750,6500, and ASA5505.
tia
Solved! Go to Solution.
10-01-2007 10:48 PM
Hi Robert
The reason you often lose the first packet on a ping is because of arp. Without a mac-address the packet cannot be delivered to the destination machine. If the mac-address of the destination or the mac-address of the default-gateway is not present in the arp cache on the source machine it must first arp out for the the mac-address.
That is why you often lose the first packet. It doesn't happen so much with end clients usually because they only need the mac-address of their default-gateway and they are usually communicating on the network most of the time so the mac-address is always in the cache.
But for example if you go into one of your switches and ping the vlan interface of another one of your switches on the same subnet it is quite likely that you will see the first packet dropped. If you then ping again straight away all pings should get a response.
HTH
Jon
10-01-2007 11:25 PM
Hi
You really don't want to disable arp on any of your devices unless you want to statically map all the mac-addresses on each of your devices which is a huge job :)
if you entered a static entry in the arp table on the device you are pinging from for the destination device then you would avoid losing the first packet but to be honest i wouldn't bother.
Appreciate the rating, many thanks
Jon
10-01-2007 11:33 PM
Disabling arp (if you could) would make a difference - you would get no responses and the network would not work!
There is not a lot you can do about the loss of the first ping, as has been said, it is perfectly normal and is due to the delay involved in arping the target.
10-01-2007 05:33 PM
yes it is normal...especially if your network is wireless somewhere along the way.
10-01-2007 05:40 PM
thanks bmoorewiz.
Then why do my other LAN devices don't experienced it? Do you have any document that prove that it's normal? or these are only for some Cisco models like ours? i.e Cisco 3750?
Note:our network is not wireless.
hope you could help me more.
tia
10-01-2007 10:48 PM
Hi Robert
The reason you often lose the first packet on a ping is because of arp. Without a mac-address the packet cannot be delivered to the destination machine. If the mac-address of the destination or the mac-address of the default-gateway is not present in the arp cache on the source machine it must first arp out for the the mac-address.
That is why you often lose the first packet. It doesn't happen so much with end clients usually because they only need the mac-address of their default-gateway and they are usually communicating on the network most of the time so the mac-address is always in the cache.
But for example if you go into one of your switches and ping the vlan interface of another one of your switches on the same subnet it is quite likely that you will see the first packet dropped. If you then ping again straight away all pings should get a response.
HTH
Jon
10-01-2007 11:17 PM
Thanks for the big reply!
last thing, if I disable the ARP on my switches, would it make a difference? Can I still get time-out on the 1st ping?
tnx
10-01-2007 11:25 PM
Hi
You really don't want to disable arp on any of your devices unless you want to statically map all the mac-addresses on each of your devices which is a huge job :)
if you entered a static entry in the arp table on the device you are pinging from for the destination device then you would avoid losing the first packet but to be honest i wouldn't bother.
Appreciate the rating, many thanks
Jon
10-01-2007 11:33 PM
Disabling arp (if you could) would make a difference - you would get no responses and the network would not work!
There is not a lot you can do about the loss of the first ping, as has been said, it is perfectly normal and is due to the delay involved in arping the target.
11-14-2007 08:06 PM
Hi Jon,
How about when I ping & got these results?
Reply from x.x.x.x: bytes=32 time=1ms TTL=255
Reply from x.x.x.x: bytes=32 time=3ms TTL=255
Reply from x.x.x.x: bytes=32 time=1ms TTL=255
Reply from x.x.x.x: bytes=32 time=2ms TTL=255
Reply from x.x.x.x: bytes=32 time=4ms TTL=255
It's local LAN and normally it's only 1ms but this time, there were inconsistency.
Is it still with the ARP related? or already a network problem?
tnx
11-15-2007 05:22 AM
Done like that, arp will only happen once - and probably had already hapenned before you started that ping.
The variations there may be workload of the devices pinging/being pinged, and what exactly is hapenning on the network between the devices involved.
10-02-2007 01:46 PM
one might try setting both arp timeouts and cdp
default holdtimer to about 180 which isdefault for cdp. this seems to have worked in the cases where i've detected what appear to be inflated icmp rtts.
example ...
set both cdp holdtimer and arp timeout
to 180 seconds. mileage may vary.
clean out your arp cache..
then ping hosts of interest and measure
round-trip times of 1st few packets bundles.
example:
!
! gateway port to/from
! user <--> server subnets
!
interface gi0/1
arp timeout 180
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: