First ping Drop

[netbeginner]

Hi All,

Very general question....Observed multiple times and recently too (related to ping drop). Thought to ask in community, if there is any technical reason behind the same,

Three Scenarios :

1) Source and Dest hosts are in same VLAN.

While pinging dest from source, usually (but not all the times) getting 1st ping drop and then rest subsequent ping responses are normal. 

2) Source and Dest in different VLANs , But in same VRF. No Firewall comes in between this communication.

While pinging one host from other or vice versa, getting 1st ping response drop and next / subsequent all successful.

3) Source and Dest in different VLANs, Different VRFs. Firewall comes in between this communication.

Same result..... While pinging one host from other or vice versa, getting 1st ping response drop and next/subsequent all successful.

What is the reason for 1st ping response drop. Is this normal.

[balaji.bandi]

as per your description, 1st ping drop normal to resolve. that is for fisrt time

what happens when you do seconds time same ping with repeat, do you see same ping drop ? ( that should not be the case)

[Georg Pauwen]

Hello,

the first ping is 'lost' because the device has to ARP for the destination IP first. Turn on 'debug arp' send the ping, and you should see something like the entry below:

IP ARP: creating incomplete entry for IP address: 192.168.1.10 interface GigabitEthernet0/0

The link below explains it pretty good:

https://blog.ipspace.net/2007/04/why-is-first-ping-lost.html#:~:text=When%20pinging%20a%20directly%2Dattached,host%20that%20has%20been%20inactive).&text=Type%20escape%20sequence%20to%20abort.

[netbeginner]

Thanks ! Guys for quick reply. 

@ Balaji, As mentione in my initial post usually see the 1st ping response drop only. When we repeat the same ping....most of the time it works fine. 

@ George, Yeah....the same exactly my thought was that probably for 1st ping packet it looks for ARP (try to response FQDN or for simple IP ping, check for the MAC address table) and got dropped as information not received. But till it received IInd ping by that time ARP entry is discovered and received the response smooth. Is this the case ..?

[Georg Pauwen]

Exactly. By the time the second PING is sent, the ARP entry is there, and the ping succeeds.