Tuesday, August 7, 2012

Why Does The First Ping Not Respond/Reply?: The "First" Request Timed Out

Well, pings are a funny thing.  At least, the first one is anyway.  Are you that guy that when you ping a device that IF it doesnt respond after the first try, you hit Ctl-C and stop the ping?  Well, I used to be that guy.  It just so happens that I probably didnt do myself any favors when I did that.  Look at this below.  Has this happened to you?
C:\Users\skillen>ping 192.168.1.25

Pinging CiscoSwitch with 32 bytes of data:
Request timed out.
Reply from 192.168.1.25: bytes=32 time=1ms TTL=253
Reply from 192.168.1.25: bytes=32 time=1ms TTL=253
Reply from 192.168.1.25: bytes=32 time=1ms TTL=253

Ping statistics for 192.168.1.25:
    Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms


Well, the first "Request timed out" is an ARP issue.  Meaning, that the ARP entry is not in your ARP table on your PC, and probably not on the switch either.  So, with that said, here it goes.  A ping packet is destined to 192.168.1.25.  Your PC is on the same subnet.  Your NIC sends out a broadcast saying "Who is 192.168.1.25?"  And, 192.168.1.25 responds back and says something like "I am.  Here is my MAC address."  Then the ping packet is sent to 192.168.1.25 and 192.168.1.25 replies back.  But, during that time it takes to get that MAC address and actually send the packet out, THATS when you get that "Request timed out."  The ping did 'time out' and that is why you get that first result, even though the packet never really got going.  You see, in order to send a packet from the source to destination, you HAVE to have the MAC address of the next hop, either the PC in this case, or a switch or router (in other cases).  This even can happen on a switch when you do the same thing, IF the MAC address is not currently in the ARP table.  See below the example on a Brocade switch.  The first time you ping, it wont ping.  You actually have to hit Ctl-C to make it stop, then you have to run the ping again.  A little odd, but you can not count on the first ping try if it does not ping.  Just FYI.

BrocadeSwitch#ping 192.168.1.25
Sending 1, 16-byte ICMP Echo to 192.168.1.25, timeout 5000 msec, TTL 64
Type Control-c to abort
^C
Ping aborted!

BrocadeSwitch#ping 192.168.1.25
Sending 1, 16-byte ICMP Echo to 192.168.1.25, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 192.168.1.25    : bytes=16 time=1ms TTL=255
Success rate is 100 percent (1/1), round-trip min/avg/max=1/1/1 ms.

BrocadeSwitch#