Slow first ping packet

Unanswered Question
Oct 16th, 2008
User Badges:

I have a client pc that get a slow first ping response each time they ping a server (even if there is no delay between runs) there are other users on the same switch that do not see this delay *example below. The clients are 4 to 6 hops away from the target servers and hop 3/4 are on ether end of a 100mb metro Ethernet connection (office are about 1 mile apart but who knows how much cable that is). I know there is some latency that comes in from time to time due to the metro but I don't understand what could cause some users to see this first packet delay. Any thoughts?


Reply from bytes=32 time=31ms TTL=124 Reply from bytes=32 time=1ms TTL=124 Reply from bytes=32 time<1ms TTL=124 Reply from bytes=32 time<1ms TTL=124

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
frankdegregorio Thu, 10/16/2008 - 11:56
User Badges:

Hi Timpoth, are you using DNS in the ping command? If so, it's possible the DNS lookup is causing the first delay. Also, if you try it immediately after the first run of answers, do they all go fast? If you wait until it gets flushed from cache (PC's), it will have to ARP for it again. This also may be your first delay. You can experiment with that by finding the MAC address of the server and statically cache it. Frank

timpoth Mon, 10/20/2008 - 07:59
User Badges:

Thanks for the reply, the pings were done via IP and there was no delay between runs yet the first ping response was consistently slow. In looking at a wireshark capture when the first packet goes out there is nothing else going on, it just takes a while for the reply to come back.


joechan007 Mon, 10/20/2008 - 09:35
User Badges:

I think it has to do with TCP slow start and it is by design.

andre.ortega Tue, 10/21/2008 - 04:51
User Badges:
  • Bronze, 100 points or more
  • Participante em Destaque,

    Escolha da Audiência, Maio de 2015

It's normal. The first package has to find the entry in the ARP table.

sirdudesly Tue, 10/21/2008 - 06:08
User Badges:

Yep, most likely just ARP lookup.

You can try pinging from the switch that the host is connected to which should give you an idea if there is an issue there.


This Discussion