topic Re: Major Ping Problems in Operating System - HP-UX

Major Ping Problems

Richard Schiavi — Fri, 30 Aug 2002 11:56:40 GMT

We have a HP 9000 server running Unix 11.00 when we ping this server we are receiving 255 packets received for every packet sent. We are using a 255.255.0.0 subnet mask. Any ideas as to why this is happening. We are unable to get NFS automount to work because of this.

Re: Major Ping Problems

harry d brown jr — Fri, 30 Aug 2002 12:17:00 GMT

What IP address are you ping'ing???

Do you possibly have duplicate IP's out there?

live free or die
harry

Re: Major Ping Problems

Richard Schiavi — Fri, 30 Aug 2002 12:22:32 GMT

From another server we are pinging 10.56.30.73
I don't think there are duplicate IP'S out there, But I am not sure. We are using MC-Service Guard and do have a cluster installed. We have 2 identical servers HA1 and HA2. If we ping HA1 from HA2 it is normal
If we ping from HA1 to HA2 notice the problem.

Re: Major Ping Problems

harry d brown jr — Fri, 30 Aug 2002 12:28:43 GMT

ah, the ole "cluster of a problem". I'm not too familiar with mcsg, but until someone else pipes in try the following:

How about a traceroute ?

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/traceroute-991603/

live free or die
harry

Re: Major Ping Problems

Joaquin Gil de Vergara — Fri, 30 Aug 2002 12:29:10 GMT

please send me the output of command

netstat -in

in thw two servers

thanks

Re: Major Ping Problems

Bill Thorsteinson — Fri, 30 Aug 2002 12:29:50 GMT

It looks like you are pinging
a subnet. If you ping an
address ending in 255 and you
have computers setup up with
a class C mask 255.255.255.0
they will respond to the ping.

This can be used for Denial of
Service attacks. Some system
allow you to disable responding to pings on the
broadcast address.

Re: Major Ping Problems

Richard Schiavi — Fri, 30 Aug 2002 13:00:05 GMT

I have attached the file with the information

Re: Major Ping Problems

Joaquin Gil de Vergara — Fri, 30 Aug 2002 13:51:05 GMT

it looks well

please run

ifconfig lan0
ifconfig lan1
ifconfig lan1:1

in both systems

thanks

Re: Major Ping Problems

Richard Schiavi — Fri, 30 Aug 2002 13:59:13 GMT

I have attached the ifconfig file. It looks correct.

Re: Major Ping Problems

Joaquin Gil de Vergara — Fri, 30 Aug 2002 14:22:53 GMT

Yes, it's correct

perhaps there is any error in local arp cache

please run

arp -a

after the ping

Thanks

Re: Major Ping Problems

Anthony deRito — Fri, 30 Aug 2002 14:49:02 GMT

Are both server pointing tho the same default gateways? Is is possible you have a routing loop involved with multiple gateways?

Re: Major Ping Problems

Ron Kinner — Sat, 31 Aug 2002 11:13:49 GMT

What does your LAN look like? Do you have multiple hubs or switches running spanning tree? Could be a loop in the LAN.

Is there a router anywhere? If the router pings each box do you get the same response. IF the router is unplugged from the LAN does the response change?

Ron

Re: Major Ping Problems

harry d brown jr — Sat, 31 Aug 2002 15:24:49 GMT

Richard,

Can you install and run the trace route?

live free or die
harry

Re: Major Ping Problems

Ron Kinner — Sun, 01 Sep 2002 03:49:56 GMT

Howabout running netstat -n again, on both boxes before and directly after a ping. Do you see the expected number of incoming packets (one for each ping) on the target box? Does it really send out 255 times as many reply packets as it gets ping packets? Does the sender really only send out one packet or does it send out 255 for each ping? Is it really receiving 255 packets for each ping it sends out?

Ron

Re: Major Ping Problems

rick jones — Tue, 03 Sep 2002 17:54:12 GMT

255 replies certianly sounds like some sort of routing loop - the default TTL in HP-UX 11 is 255 (the max).

as an experiment (perhaps unneeded with traceroute results already finding a busted router) you could alter the TTL - first on the side doing the ping, then on the side responding to the ping.

ndd -h | grep ttl - probably the ones involving "ip" rather than UDP or TCP...

You might also just check the arp caches on either side to make sure that for some strange reason a broadcast/multicast MAC address was not cached as the IP to MAC mapping.