.33 can never be a broadcast address, it doesn't fall correctly in any
subnet range.
On the other hand, if there is a switch anyplace along the line there, and
perhaps a port monitor (span port) is set up someplace, that would explain
the duplicate packets?
A router itself will not retransmit any packets. You would have to have
some command at some (or multiple?) points along the way causing duplicates
to be created.
Scott
-----Original Message-----
From: Ron Fuller [mailto:ccie5851@earthlink.net]
Sent: Sunday, December 02, 2001 7:31 AM
To: Zaheer Aziz; Jim Warner
Cc: cisco-nsp@puck.nether.net
Subject: Re: packet duplication
Is that IP address the braodcast address of a subnet, and the ICMP replies
you are seeing are from the various devices on the subnet?
*Shrug*
At 12:00 AM 12/2/01 -0800, Zaheer Aziz wrote:
>At 05:21 PM 12/1/2001 -0800, Jim Warner wrote:
>>When I ping to a particular router my reply packets are
>>getting duplicated. It looks like:
>>
>>bash-2.03$ ping 137.164.12.33
>>PING 137.164.12.33 (137.164.12.33): 56 data bytes
>>64 bytes from 137.164.12.33: icmp_seq=0 ttl=250 time=24.924 ms
>>64 bytes from 137.164.12.33: icmp_seq=0 ttl=250 time=25.013 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=0 ttl=248 time=25.247 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=0 ttl=248 time=25.698 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=1 ttl=250 time=24.084 ms
>>64 bytes from 137.164.12.33: icmp_seq=1 ttl=250 time=24.594 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=1 ttl=248 time=24.825 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=1 ttl=248 time=25.030 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=2 ttl=250 time=24.330 ms
>>64 bytes from 137.164.12.33: icmp_seq=2 ttl=250 time=24.544 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=2 ttl=248 time=24.750 ms (DUP!)
>>64 bytes from 137.164.12.33: icmp_seq=2 ttl=248 time=25.173 ms (DUP!)
>>
>>Not shown here, but this effect happens when I pass through this
>>router. Anything beyond it is replicated.
>>
>>I have seen routing loops cause things that are similar, but
>>not the same as this. But here the duplication is always the
>>same. I think that my packets to the router are being replicated,
>>and then each of the replies is getting replicated -- which is
>>why I see four responses to everything I send.
>>
>>I am curious to hear what sorts of pathologies might result in
>>this kind of packet copying. There is ATM in the path. Could
>>it be the culprit? I am pretty sure that the equipment doing the
>>packet copying is made by Cisco. The same way that I can't imagine
>>that a bad packet would cause a fan to fail, I can't imagine how a
>>packet could be copied a fixed number of times.
>>
>>I know this would be easier if there was a map of the topology.
>>Is anyone willing to speculate without one?
>
>BIG SPECULATION:
>Four devices using the same MAC address.
>Please provide topology and little more investigation before we can really
>nail this down
>Zaheer
>
>
>>Thanks. -jim warner, UC santa cruz
>
>________________________________________________________________
> Zaheer Aziz || ||
> Internetworking Engineer :||: :||:
> CCIE# 4127 |||| ||||
> Cisco Systems |||||| ||||||
> SanJose, CA ....::||||||||::....::||||||||::....
> C i s c o S y s t e m s
>________________________________________________________________
> Phone: 408-527-0719
> FAX: 408-527-7867
> Email: zaziz@cisco.com
Ron Fuller, CCIE #5851, CCNP-ATM, CCNP-Voice, CSS Level 1, CCDP, MCNE
ccie5851@earthlink.net
This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:12:56 EDT