there is a slight delat in ping reply

I have a DELL 2650 installed with FC5. After setting up the network I
executed some ping test to test the connections. Within the LAN the
ping replies are as expected. However, when I ping servers outside the
LAN I've noticed a slight delay in the reply of what I think is the DNS
lookup. After that the replies are as expected. Example:

linux% ping cnet.com
PING cnet.com (216.239.113.101) 56(84) bytes of data.
(*** here is where the delay is; about 2 seconds or so ***)

64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
icmp_seq=1 ttl=247 time=102 ms
64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
icmp_seq=2 ttl=247 time=85.7 ms
64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
icmp_seq=3 ttl=247 time=93.3 ms
64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
icmp_seq=4 ttl=247 time=241 ms
64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
icmp_seq=5 ttl=247 time=92.6 ms

All the above replies are as expected. I can't put my figure on the
problem. I've checked my /etc/resolv.conf. It looks OK. Contains only
the COMCAST DNS IP addresses and that's it. I have another Linux
server of RH9 flavor and I don't see this problem.

d wrote:
> I have a DELL 2650 installed with FC5. After setting up the network I
> executed some ping test to test the connections. Within the LAN the
> ping replies are as expected. However, when I ping servers outside the
> LAN I've noticed a slight delay in the reply of what I think is the DNS
> lookup. After that the replies are as expected. Example:
>
> linux% ping cnet.com
> PING cnet.com (216.239.113.101) 56(84) bytes of data.
> (*** here is where the delay is; about 2 seconds or so ***)
>
> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> icmp_seq=1 ttl=247 time=102 ms
> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> icmp_seq=2 ttl=247 time=85.7 ms
> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> icmp_seq=3 ttl=247 time=93.3 ms
> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> icmp_seq=4 ttl=247 time=241 ms
> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> icmp_seq=5 ttl=247 time=92.6 ms
>
> All the above replies are as expected. I can't put my figure on the
> problem. I've checked my /etc/resolv.conf. It looks OK. Contains only
> the COMCAST DNS IP addresses and that's it. I have another Linux
> server of RH9 flavor and I don't see this problem.


So do a "host cnet.com" and then ping by IP address to see if the delay
still exists.

Also, does cancelling the ping and then immediately restarting it still
give you the delay?

Ken Roberts wrote:
> d wrote:

>> However, when I ping servers outside the
>> LAN I've noticed a slight delay in the reply of what I think is the DNS
>> lookup. After that the replies are as expected. Example:
>>
>> linux% ping cnet.com
>> PING cnet.com (216.239.113.101) 56(84) bytes of data.
>> (*** here is where the delay is; about 2 seconds or so ***)
>>
>> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
>> icmp_seq=1 ttl=247 time=102 ms
> So do a "host cnet.com" and then ping by IP address to see if the delay
> still exists.
>
> Also, does cancelling the ping and then immediately restarting it still
> give you the delay?

See if the delay goes away when you use ping -n

Allen McIntosh wrote:
> Ken Roberts wrote:
> > d wrote:
>
> >> However, when I ping servers outside the
> >> LAN I've noticed a slight delay in the reply of what I think is the DNS
> >> lookup. After that the replies are as expected. Example:
> >>
> >> linux% ping cnet.com
> >> PING cnet.com (216.239.113.101) 56(84) bytes of data.
> >> (*** here is where the delay is; about 2 seconds or so ***)
> >>
> >> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> >> icmp_seq=1 ttl=247 time=102 ms
> > So do a "host cnet.com" and then ping by IP address to see if the delay
> > still exists.
> >
> > Also, does cancelling the ping and then immediately restarting it still
> > give you the delay?
>
> See if the delay goes away when you use ping -n

Results:
- ping IP (fast reply no delays)
- ping -n IP (fast reply no delays)
- ping hostname (2-3 second delay)
- ping -n hostname (2-3 second delay)
- host hostname (seems normal)
- dig hostname (seems nornal)

d wrote:
> Allen McIntosh wrote:
> > Ken Roberts wrote:
> > > d wrote:
> >
> > >> However, when I ping servers outside the
> > >> LAN I've noticed a slight delay in the reply of what I think is the DNS
> > >> lookup. After that the replies are as expected. Example:
> > >>
> > >> linux% ping cnet.com
> > >> PING cnet.com (216.239.113.101) 56(84) bytes of data.
> > >> (*** here is where the delay is; about 2 seconds or so ***)
> > >>
> > >> 64 bytes from c17-sha-redirect-lb.cnet.com (216.239.113.101):
> > >> icmp_seq=1 ttl=247 time=102 ms
> > > So do a "host cnet.com" and then ping by IP address to see if the delay
> > > still exists.
> > >
> > > Also, does cancelling the ping and then immediately restarting it still
> > > give you the delay?
> >
> > See if the delay goes away when you use ping -n
>
> Results:
> - ping IP (fast reply no delays)
> - ping -n IP (fast reply no delays)
> - ping hostname (2-3 second delay)
> - ping -n hostname (2-3 second delay)
> - host hostname (seems normal)
> - dig hostname (seems nornal)

Its more like a 4-5 second delay after I hit the RETURN key and before
the replies starting coming to the screen. This is strange. on't know
what to make of it.

d <(E-Mail Removed)> wrote:
> I have a DELL 2650 installed with FC5. After setting up the network I
> executed some ping test to test the connections. Within the LAN the
> ping replies are as expected. However, when I ping servers outside the
> LAN I've noticed a slight delay in the reply of what I think is the DNS
> lookup. After that the replies are as expected. Example:

> linux% ping cnet.com
> PING cnet.com (216.239.113.101) 56(84) bytes of data.
> (*** here is where the delay is; about 2 seconds or so ***)

If the delay is after the header is displayed, I'd think that implies
the DNS lookup was already done - after all, where else could it get
the IP it displayed.

Unless, perhaps the ping program, for whatever reason is doing a "PTR"
lookup on the source IP of the first ping reply, but I'm not sure why
it would do that.

I would suggest taking a system call trace of the ping command. The
system calls associated with a DNS query are pretty easy to see -
generally they involve SOCK_DGRAM and port 53, and/or operations on
FD's where calls with such settings have been made.

rick jones
--
oxymoron n, commuter in a gas-guzzling luxury SUV with an American flag
these opinions are mine, all mine; HP might not want them anyway...
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

Rick Jones wrote:
> d <(E-Mail Removed)> wrote:
> > I have a DELL 2650 installed with FC5. After setting up the network I
> > executed some ping test to test the connections. Within the LAN the
> > ping replies are as expected. However, when I ping servers outside the
> > LAN I've noticed a slight delay in the reply of what I think is the DNS
> > lookup. After that the replies are as expected. Example:
>
> > linux% ping cnet.com
> > PING cnet.com (216.239.113.101) 56(84) bytes of data.
> > (*** here is where the delay is; about 2 seconds or so ***)
>
> If the delay is after the header is displayed, I'd think that implies
> the DNS lookup was already done - after all, where else could it get
> the IP it displayed.
>
> Unless, perhaps the ping program, for whatever reason is doing a "PTR"
> lookup on the source IP of the first ping reply, but I'm not sure why
> it would do that.
>
> I would suggest taking a system call trace of the ping command. The
> system calls associated with a DNS query are pretty easy to see -
> generally they involve SOCK_DGRAM and port 53, and/or operations on
> FD's where calls with such settings have been made.
>
> rick jones
> --
> oxymoron n, commuter in a gas-guzzling luxury SUV with an American flag
> these opinions are mine, all mine; HP might not want them anyway...
> feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

It was a COMCAST DNS IP address change that got me. I looked at the
DNS settings on the 3 other PCs on the LAN, one which is DHCP
configured, to see if each was set the same. The DHCP configured PC
had 68.87.64.xxx and the manually set PCs had 68.81.64.xxx. Though the
secondary DNS IP was correct I guess the delay I saw was due to the
lookup timing out first from the incorrect IP address. Thanks to
everyone for the suggestions and time spent on my problem.