first ping packet

Marko Leopold · ‎05-11-2010

Hello!

I guess I'm not the first one to ask this, but I need a short and easy to understand explanation why the first packet inside a ping is lost. If i ping from a switch the first ping is always lost, if the target is not in ARP-table. Every following ping packet is going through because the target is in ARP-table. But what happens to the first packet? Can someone provide me an easy explanation for this behavior?

Kind regards,

Marko

Giuseppe Larosa · ‎05-11-2010

Hello Marko,

the first packet is held in a buffer and it is used to trigger the ARP request.

it is CEF punted to main cpu for ARP resolution

The ARP process takes its time and the packet cannot be stored in the buffer for long time

But what counts more is that you have a timer in your ping and that time is 2 seconds

if ARP takes 2 seconds to resolve the packet it is imply too late.

if you use an extended ping and you specify a 10 seconds timeout you should be able to see 5 answers to an host not present in routing table

Hope to help

Giuseppe

Marko Leopold · ‎05-11-2010

Hello Guiseppe!

That's what I thought about the timeout too, but i already tried it with the extended ping. If you debug arp and icmp you will see the ARP-request going out and then the ARP-reply coming in, but still the first ping is missing. So I guess this packet is being copied and send to CPU and the original packet is being dropped because of the missing ARP-entry. Does this happen to every packet with no ARP-entry? Is this behavoir a Cisco-thing or does all vendors do this?

Kind regards,

Marko

Ganesh Hariharan · ‎05-11-2010

Hello!

I guess I'm not the first one to ask this, but I need a short and easy to understand explanation why the first packet inside a ping is lost. If i ping from a switch the first ping is always lost, if the target is not in ARP-table. Every following ping packet is going through because the target is in ARP-table. But what happens to the first packet? Can someone provide me an easy explanation for this behavior?

Kind regards,

Marko

Hi Marko,

Actually, it's not the reply that was lost, the request was never sent out. Whenever a router has to send a packet to the next-hop (or directly attached destination) that has no entry in the ARP table, the ARP request is sent out, but the original packet is unconditionally dropped.

Hope to help !!

Ganesh.H

Remember to rate the helpful post

Marko Leopold · ‎05-11-2010

Hello Ganesh!

Thank you for your answer. Actually the topic came up, because in our LAN the first ping between 2 servers in same VLAN is always missing. Here i think it is the timeout problem, but I wanted to be sure about it to give the correct answer. I will try the ping between the two servers with a higher timeout.

Regards,

Marko

Ganesh Hariharan · ‎05-13-2010

Hello Ganesh!

Thank you for your answer. Actually the topic came up, because in our LAN the first ping between 2 servers in same VLAN is always missing. Here i think it is the timeout problem, but I wanted to be sure about it to give the correct answer. I will try the ping between the two servers with a higher timeout.

Regards,

Marko

Hi Marko,

You can try with higher time out and share the results with us, but as far as my experience and discussion if no entry in the ARP table for the first time, the ARP request is sent out, but the original packet is unconditionally dropped,once arp recived second packets shows with th reply in ping.

Hope to Help !!

Ganesh.H