PING WARNING - DUPLICATES FOUND!

[Andreas Ericsson]

Matt Burleigh wrote:
> What does this mean? "PING WARNING - DUPLICATES FOUND!"
> 

Essentially that the ping program receives two or more PONG's for a 
PING. This can happen if any (or in some cases several) of the following 
requirements are met;
There are two nodes with the same IP-address on the network.
The IP stack of the target host is broken.
The IP stack of the pinging host is broken.
The ping program is broken, and fails to add a proper identifier and 
sequence numbers to its packets (this can happen if it uses /dev/random 
as source for its entropy, reads it in non-blocking mode and the system 
is fresh out of chaos).
A switch or router has been set to forward all traffic to the interface 
you've put your nagios-server at, and it's not clever enough (i.e. 
broken) to not re-send traffic that's already destined for that very 
interface or if you have several NIC's on the monitoring server and 
you've separated the IP space logically but not physically (i.e. both 
cards connect to the same switch but on different subnets so the traffic 
bound for one interface reaches both through the packet propagation 
interface on the switch, while ping listens on both for responses).

I'm sure there's something I've forgotten, but AFAIR it was really 
obscure (as opposed to the everyday issues above ;-) ).

-- 
Sourcerer / Andreas Ericsson
OP5 AB
+46 (0)733 709032
andreas.ericsson at op5.se


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null