ping broadcast doesn't yield reply from all alive hosts on my subnet??

rs_vijay · 07-06-2007, 08:14 AM

hi all,
i was trying to ping the broadcast address of my subnet n this is the output:

Code:

   [root@vijay ~]# ping -b 172.31.83.255
WARNING: pinging broadcast address
PING 172.31.83.255 (172.31.83.255) 56(84) bytes of data.
64 bytes from 172.31.80.2: icmp_seq=1 ttl=255 time=0.442 ms
64 bytes from 172.31.80.1: icmp_seq=1 ttl=255 time=0.483 ms (DUP!)
64 bytes from 172.31.80.4: icmp_seq=1 ttl=64 time=0.989 ms (DUP!)
64 bytes from 172.31.80.5: icmp_seq=1 ttl=255 time=98.5 ms (DUP!)
64 bytes from 172.31.80.4: icmp_seq=2 ttl=64 time=0.215 ms
64 bytes from 172.31.80.2: icmp_seq=2 ttl=255 time=4.82 ms (DUP!)
64 bytes from 172.31.80.1: icmp_seq=2 ttl=255 time=4.87 ms (DUP!)
64 bytes from 172.31.80.5: icmp_seq=2 ttl=255 time=28.4 ms (DUP!)
64 bytes from 172.31.80.4: icmp_seq=3 ttl=64 time=0.217 ms
64 bytes from 172.31.80.2: icmp_seq=3 ttl=255 time=4.34 ms (DUP!)
64 bytes from 172.31.80.1: icmp_seq=3 ttl=255 time=4.39 ms (DUP!)
64 bytes from 172.31.80.5: icmp_seq=3 ttl=255 time=13.0 ms (DUP!)

--- 172.31.83.255 ping statistics ---
3 packets transmitted, 3 received, +9 duplicates, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.215/13.404/98.573/26.810 ms
[root@vijay ~]#

unfortunately,it didn't happen as expected i had to get reply from all hosts those were up right..
this differs from nmap's ping sweep output on my subnet..
here's my ifconfig and routing table:

Code:

  [root@vijay ~]# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:16:76:4B:9B:0C
          inet addr:172.31.80.194  Bcast:172.31.83.255  Mask:255.255.252.0
          inet6 addr: fe80::216:76ff:fe4b:9b0c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:29055 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9596 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2988379 (2.8 MiB)  TX bytes:770561 (752.5 KiB)

[root@vijay ~]# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
172.31.80.0     0.0.0.0         255.255.252.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
0.0.0.0         172.31.80.1     0.0.0.0         UG        0 0          0 eth0
[root@vijay ~]#

plzz help me... i am a networking newbie presently studying broadcasting..
thnx in advance..

nx5000 · 07-06-2007, 08:41 AM

RFC 1122:

3.2.2.6 Echo Request/Reply: RFC-792

Every host MUST implement an ICMP Echo server function that
receives Echo Requests and sends corresponding Echo Replies.
A host SHOULD also implement an application-layer interface
for sending an Echo Request and receiving an Echo Reply, for
diagnostic purposes.

An ICMP Echo Request destined to an IP broadcast or IP
multicast address MAY be silently discarded.

From linux source:

Quote:

Originally Posted by net/ipv4/icmp.c

if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
/*
* RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
* silently ignored (we let user decide with a sysctl).
* RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
* discarded if to broadcast/multicast.
*/
if ((icmph->type == ICMP_ECHO ||
icmph->type == ICMP_TIMESTAMP) &&
sysctl_icmp_echo_ignore_broadcasts) {
goto error;
}

If it's an icmp_echo to a broadcast and sysctl_ignore=1 then ignore. You could change the sysctl configuration on all hosts so that the last condition allows their kernel to answer:

Code:

sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0

Other interesting documents:
http://www.faqs.org/rfcs/rfc1812.html
http://en.wikipedia.org/wiki/Broadca...%28networks%29
http://en.wikipedia.org/wiki/Broadcast_address
http://en.wikipedia.org/wiki/Broadcast_storm

rs_vijay · 07-06-2007, 08:50 AM

thnx sir.. this has cleared my doubt..
i have toggled that "sysctl_icmp_echo_ignore_broadcasts" and now the same ping broadcast yeilded reply from another host i.e myself now its clear to me sir..

thanx a lot sir..

nx5000 · 07-06-2007, 08:58 AM

Good!
Actually what happens is this (if I'm not mistaken, I can not check on my LAN)
The ping goes from host A to the host B but this host B doesn't reply.
Meanwhile, when A wanted to send a packet to B, it needs its ARP address.
So simply sending the broadcast ping and displaying the arp cache would have been sufficient:
1)empty the arp cache
you get the cache like this: /usr/sbin/arp -a
you remove the lines one by one: sudo arp -d <host1> ...
2)ping -b 192.168.1.255
3)display the arp cache, the ones which are not 'incomplete' are alive (or there is a proxy arp inbetween, not very common these days)
/usr/sbin/arp -an (n for numerical only, better)