05-11-2010 06:44 AM - edited 03-06-2019 11:02 AM
Hello!
I guess I'm not the first one to ask this, but I need a short and easy to understand explanation why the first packet inside a ping is lost. If i ping from a switch the first ping is always lost, if the target is not in ARP-table. Every following ping packet is going through because the target is in ARP-table. But what happens to the first packet? Can someone provide me an easy explanation for this behavior?
Kind regards,
Marko
05-11-2010 07:52 AM
Hello Marko,
the first packet is held in a buffer and it is used to trigger the ARP request.
it is CEF punted to main cpu for ARP resolution
The ARP process takes its time and the packet cannot be stored in the buffer for long time
But what counts more is that you have a timer in your ping and that time is 2 seconds
if ARP takes 2 seconds to resolve the packet it is imply too late.
if you use an extended ping and you specify a 10 seconds timeout you should be able to see 5 answers to an host not present in routing table
Hope to help
Giuseppe
05-11-2010 11:15 PM
Hello Guiseppe!
That's what I thought about the timeout too, but i already tried it with the extended ping. If you debug arp and icmp you will see the ARP-request going out and then the ARP-reply coming in, but still the first ping is missing. So I guess this packet is being copied and send to CPU and the original packet is being dropped because of the missing ARP-entry. Does this happen to every packet with no ARP-entry? Is this behavoir a Cisco-thing or does all vendors do this?
Kind regards,
Marko
05-11-2010 10:42 PM
Hello!
I guess I'm not the first one to ask this, but I need a short and easy to understand explanation why the first packet inside a ping is lost. If i ping from a switch the first ping is always lost, if the target is not in ARP-table. Every following ping packet is going through because the target is in ARP-table. But what happens to the first packet? Can someone provide me an easy explanation for this behavior?
Kind regards,
Marko
Hi Marko,
Actually, it's not the reply that was lost, the request was never sent out. Whenever a router has to send a packet to the next-hop (or directly attached destination) that has no entry in the ARP table, the ARP request is sent out, but the original packet is unconditionally dropped.
Hope to help !!
Ganesh.H
Remember to rate the helpful post
05-11-2010 11:28 PM
Hello Ganesh!
Thank you for your answer. Actually the topic came up, because in our LAN the first ping between 2 servers in same VLAN is always missing. Here i think it is the timeout problem, but I wanted to be sure about it to give the correct answer. I will try the ping between the two servers with a higher timeout.
Regards,
Marko
05-13-2010 12:08 AM
Hello Ganesh!
Thank you for your answer. Actually the topic came up, because in our LAN the first ping between 2 servers in same VLAN is always missing. Here i think it is the timeout problem, but I wanted to be sure about it to give the correct answer. I will try the ping between the two servers with a higher timeout.
Regards,
Marko
Hi Marko,
You can try with higher time out and share the results with us, but as far as my experience and discussion if no entry in the ARP table for the first time, the ARP request is sent out, but the original packet is unconditionally dropped,once arp recived second packets shows with th reply in ping.
Hope to Help !!
Ganesh.H
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide