Internet Core Protocols: The Definitive Guide

First Packet from ping Always Fails

Sometimes, when trying to use ping to test connectivity with other devices, the first packet sent will fail to be acknowledged. This could happen for a number of reasons:

ARP cache is empty

If the ARP cache on the sending system does not have an entry for the destination system (assuming that the destination system is local), then the time it takes to locate the hardware address of the destination device may exceed the timeout threshold defined in the ping client. In addition, if the size of the ICMP Echo Request Message is larger than the local system’s MTU, then another (somewhat rare) condition can also be met, whereby ping has flushed the first fragment from its call-back queue, and as such only the second (and subsequent) fragments from the first datagram are getting sent. In that case, the recipient will ignore the IP packet, since it is not complete. These issues are discussed in more detail in Section 3.4.2 in Chapter 3.

Routing cache is empty

There are millions of networks in use on the Internet today, and most of the routers are simply incapable of keeping track of all the others. In fact, most routers store only a few routing paths in their caches at any given time. In that model, if a packet is getting sent to a network that has not been processed lately, it may take some time for the router to determine the correct network path for the packet to take. This may result in the ping client reaching a timeout threshold before the ICMP Echo ...