Intermitent Ping

[Jay LaBonte]

I have a HP9000 running 11i.

The problem is that I can ping all system on our network with no problem. Then out of the blue, there will be 3 or 4 IP's I can not ping, I have to reboot the system and then I can ping everything again with no problems, then after a while 3 for 4 different IP's are no longer pingable.

At first I suspected the switch or our router, but at some of the IP's that I can not ping are on the same hub and the HP9000. I have even disconnected the hum from the switch so that the HP9000 can only see the IP on the hub, and with each reboot I get different results at to which systems I can ping.

I have compare the routing table and all other configurations to an identical HP9000 on the same hub and it has no problems with ping.

Any suggestions would be grately appreciated!

[Marco Santerre]

Most of the intermitent ping problems I have had in the past have always been because of duplicate IP addresses.. so are you sure no one else has the IP addresses you configured?

[Chris Wilshaw]

It is possible that the systems have dropped the gateway.

HP-UX has something called "Dead Gateway Detection", which can look for, and drop "unused" gates.

Check using ndd

ndd -get /dev/ip ip_ire_gw_probe

If this returns 1, you have the detection enabled.

ndd -get /dev/ip ip_ire_status | grep GATEWAY

If this returns "DEAD", the detection has kicked in and disabled it.

You can disable this facility using

ndd -set /dev/ip ip_ire_gw_probe 0

To make this a permanent change, you need to update /etc/rc.config.d/nddconf

[doug mielke]

If there's a duplicate IP on your local segment, look in syslog for an
'arp table overwritten' message when you ping the box. Also try a traceroute to the problem box while you can ping to make sure messages are taking the path you think they should.

Other than dup. IPs, look at negotiation. See if you can find what the problem systems are set to, if you can, maybe turn auto neg. off, and run half duplex for a time to see if the problem goes away.

[Clemens van Everdingen]

Hi,

I Agree with Chris.
This definte looks like dead gateway protectection issue.

So I would check this in the first place.

Kind regards,
Clemens

[Ron Kinner]

If I understand correctly the problem happens on local subnet (same hub) IPs too so a gateway should not be involved but it wouldn't hurt to turn off dead gateway detection anyway just in case someone has a bad mask and thinks they have to go through the gateway to reach a local IP. (Please check the masks on your system and on the ones it talks to.)

While they are responding to pings you should note the MAC of each host and run a linkloop (see the man linkloop(1M) ) to them to see if it works. If the test works then when the ping doesn't work you can check layer two connectivity with the linkloop test. If that passes then it is a layer 3 problem and you can look for duplicate IP addresses, bad masks and bad routing.
arp -a
should show you the MAC and IP if you look right after a good ping. Save the results and compare to the results after a bad ping. If something looks different then you can remove the bad entry with
arp -d hostname
You can also insure connectivity to local stuff by adding static arp entries with arp -s. Remember that the pingees must also have the correct MAC or IP route in order to respond so when one cannot be pinged see if its arp and routing tables have the correct info for the pinger. I can imagine a router getting a bad route to the pinger and doing a proxy arp (where it gives its MAC as the one to use instead of the real one) and causing a similar problem.

I would also check that you have the latest ARPA and driver patches for your HP and NIC. Sometimes a driver or software bug can do strange things to your connectivity.

When you do a ping I assume you are using the IP address and not the hostname. I don't remember on HPUX but I know on some Linux systems it tries to get a hostname for an IP address when you ping to an IP so even DNS can get into the picture. Does
nslookup hostname
work or is the DNS one of the ones which can't ping?
Are the pingees which do not work in /etc/hosts?

Ron

[Jay LaBonte]

I know there are no duplicate IP's on the network, This was one of the first things I checked for.

Im sure it not the gateway either, as I am disconnected from the gateway and simply have a group of 12 computers on a sigle 16 port hub. 10 of the computers of PC running XP, and 2 are HP9000's, called Thor (10.253.161.165) and Zeus (10.253.161.164). Zeus was recentlly ignited from a tape from Thor. (I have confirmed IP's and MAC for each are correct.) Only Zeus is experiencing the odd behavior.

I tried ndd -get /dev/ip ip_ire_gw_probe and get the following responce:

"name is none-existent for this module
for a list of valid names, use name '?'"

I printed the results of arp -a while ping was working and after it stopped working and nothing looks outof the ordinary.

However, I did try the following:

arp -d 10.253.161.164

After executing this command ping works again for a short period of time.

[Ron Kinner]

Did you check arp -a on the computers that could not be pinged? Sounds to me like they may be getting a bad MAC for the IP in their arp table and when you erase one from yours then yours has to re-arp for their info and in the process probably updates the incorrect info.

Ron

[Bill Hassell]

The error for: ndd -get /dev/ip ip_ire_gw_probe probably means you are not patched very well. Even if ndd starts reporting the state of the ip_ire_gw_probe value, you must install the latest version od ndd to get it to 'stick'. You edit the nddconf file in /etc/rc.config.d to have something like this:

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_ire_gw_probe
NDD_VALUE[0]=0

but the bug in ndd makes the -c option ineffective. Make sure that ndd -c works by changing the nddconf file, run ndd -get to see the current value, then ndd -c followed by ndd -get. The broken version will not change the setting and therefore the setting will not survive a reboot. This can be very frustrating to troubleshoot.

[PVR]

Check the file nettl.Log000 for any type of network errors

#netfmt -Nvf /var/adm/nettl.LOG000

It seems to be some gateway / router problem. This HP BOX is OK , i think