Path: utzoo!attcan!uunet!cs.utexas.edu!tut.cis.ohio-state.edu!ucbvax!agate!violet.berkeley.edu!cliff
From: cliff@violet.berkeley.edu (Cliff Frost)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: ICMP Multiple Echo Replies
Keywords: ICMP echo reply
Message-ID: <25908@agate.BERKELEY.EDU>
Date: 30 Jun 89 00:14:25 GMT
References: <1131@umn-d-ub.D.UMN.EDU>
Sender: usenet@agate.BERKELEY.EDU
Organization: University of California, Berkeley
Lines: 41

Duplicate ICMP Echo Replies are an interesting phenomenon.  I've
seen a lot of them and in my experience they have never been caused
by errors at the recipient, although that is always a possibility.

They seem usually to be caused by inappropriate link-level retransmission
of the packets, and they sometimes point to a link that's failing or
heading in that direction.  For example, with some link-level protocols
a device may see a NAK when the packet actually made it out the other
end of the link, and it then does a retransmission of the packet. 

I have often seen this associated with the particular data patterns in
the packet itself (groan!).

In the past I've seen these within the UC Berkeley network, and on our
local NSF Regional (BARRNet), and in both these cases they've meant
trouble.  That is, when I start seeing duplicates around here I'm sure
that something in our net needs fixing fast.

I don't think they always mean trouble.  I see them occasionally 
going across the NSFNet backbone and yet we have no problems
with the backbone.

You can anonymously ftp a version of ping that detects and reports
duplicates, as well as allows you to specify a data fill pattern from
jade.berkeley.edu.  The files of interest are pub/ping.c and pub/ping.8.

	Cliff Frost	<cliff@cmsa.berkeley.edu>
	Data Communications and Network Services
	UC Berkeley

RE:
In article <1131@umn-d-ub.D.UMN.EDU> tperala@umn-d-ub.D.UMN.EDU (Tim Perala) writes:
>I have been getting strange behaviour when pinging a particular
>host on the Internet.  I have not seen this behaviour with any
>other host.  
>...
>Notice that I receive multiple replies on some of the requests.
>I have no reason to believe that my ping program is in error.
>What are some possible explanations for this behaviour, aside 
>from the obvious, that the recipient of the request is actually 
>generating multiple replies from a single ICMP echo request?