cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
783
Views
5
Helpful
9
Replies

Ping question?

redrobish
Level 1
Level 1

Hi experts,

I was just wondering, whenever i do a ping, I usually get a timeout on the first ping then the next ping will be fine.

is this normal?

Im using Cisco 3560,3750,6500, and ASA5505.

tia

3 Accepted Solutions

Accepted Solutions

Hi Robert

The reason you often lose the first packet on a ping is because of arp. Without a mac-address the packet cannot be delivered to the destination machine. If the mac-address of the destination or the mac-address of the default-gateway is not present in the arp cache on the source machine it must first arp out for the the mac-address.

That is why you often lose the first packet. It doesn't happen so much with end clients usually because they only need the mac-address of their default-gateway and they are usually communicating on the network most of the time so the mac-address is always in the cache.

But for example if you go into one of your switches and ping the vlan interface of another one of your switches on the same subnet it is quite likely that you will see the first packet dropped. If you then ping again straight away all pings should get a response.

HTH

Jon

View solution in original post

Hi

You really don't want to disable arp on any of your devices unless you want to statically map all the mac-addresses on each of your devices which is a huge job :)

if you entered a static entry in the arp table on the device you are pinging from for the destination device then you would avoid losing the first packet but to be honest i wouldn't bother.

Appreciate the rating, many thanks

Jon

View solution in original post

Disabling arp (if you could) would make a difference - you would get no responses and the network would not work!

There is not a lot you can do about the loss of the first ping, as has been said, it is perfectly normal and is due to the delay involved in arping the target.

View solution in original post

9 Replies 9

bmoorewiz
Level 4
Level 4

yes it is normal...especially if your network is wireless somewhere along the way.

thanks bmoorewiz.

Then why do my other LAN devices don't experienced it? Do you have any document that prove that it's normal? or these are only for some Cisco models like ours? i.e Cisco 3750?

Note:our network is not wireless.

hope you could help me more.

tia

Hi Robert

The reason you often lose the first packet on a ping is because of arp. Without a mac-address the packet cannot be delivered to the destination machine. If the mac-address of the destination or the mac-address of the default-gateway is not present in the arp cache on the source machine it must first arp out for the the mac-address.

That is why you often lose the first packet. It doesn't happen so much with end clients usually because they only need the mac-address of their default-gateway and they are usually communicating on the network most of the time so the mac-address is always in the cache.

But for example if you go into one of your switches and ping the vlan interface of another one of your switches on the same subnet it is quite likely that you will see the first packet dropped. If you then ping again straight away all pings should get a response.

HTH

Jon

Thanks for the big reply!

last thing, if I disable the ARP on my switches, would it make a difference? Can I still get time-out on the 1st ping?

tnx

Hi

You really don't want to disable arp on any of your devices unless you want to statically map all the mac-addresses on each of your devices which is a huge job :)

if you entered a static entry in the arp table on the device you are pinging from for the destination device then you would avoid losing the first packet but to be honest i wouldn't bother.

Appreciate the rating, many thanks

Jon

Disabling arp (if you could) would make a difference - you would get no responses and the network would not work!

There is not a lot you can do about the loss of the first ping, as has been said, it is perfectly normal and is due to the delay involved in arping the target.

Hi Jon,

How about when I ping & got these results?

Reply from x.x.x.x: bytes=32 time=1ms TTL=255

Reply from x.x.x.x: bytes=32 time=3ms TTL=255

Reply from x.x.x.x: bytes=32 time=1ms TTL=255

Reply from x.x.x.x: bytes=32 time=2ms TTL=255

Reply from x.x.x.x: bytes=32 time=4ms TTL=255

It's local LAN and normally it's only 1ms but this time, there were inconsistency.

Is it still with the ARP related? or already a network problem?

tnx

Done like that, arp will only happen once - and probably had already hapenned before you started that ping.

The variations there may be workload of the devices pinging/being pinged, and what exactly is hapenning on the network between the devices involved.

delbert.hudson
Level 1
Level 1

one might try setting both arp timeouts and cdp

default holdtimer to about 180 which isdefault for cdp. this seems to have worked in the cases where i've detected what appear to be inflated icmp rtts.

example ...

set both cdp holdtimer and arp timeout

to 180 seconds. mileage may vary.

clean out your arp cache..

then ping hosts of interest and measure

round-trip times of 1st few packets bundles.

example:

!

! gateway port to/from

! user <--> server subnets

!

interface gi0/1

arp timeout 180

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco