Link to home
Start Free TrialLog in
Avatar of g127404
g127404

asked on

ping returns multiple results - Pointer Question

Experts - Please answer here
https://www.experts-exchange.com/questions/21876492/Network-Seizes-up-for-short-periods-of-time.html

I have no devices (that I know of) on 192.168.0.255.  Doing a packet sniff on the network I found traffic pointing to this ip address.  A ping resulted in multiple ip addresses all of which happen to be Dell printers.  Have you seen a ping return ip addresses other than what you originally specified?

C:\>ping 192.168.0.255

Pinging 192.168.0.255 with 32 bytes of data:

Reply from 192.168.0.201: bytes=32 time=2ms TTL=64
Reply from 192.168.0.203: bytes=32 time=1ms TTL=64
Reply from 192.168.0.203: bytes=32 time=1ms TTL=64
Reply from 192.168.0.202: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.0.255:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms
Avatar of Jay_Jay70
Jay_Jay70
Flag of Australia image

Hi g127404,

.255 is the broadcast address it will return a reply from every IP in that range
Avatar of g127404
g127404

ASKER

I did the ping over a period of 1/2 an hour every once in a while and it only returned a range of about 7 ip addresses all of which are printers.  We have about 30 other computers and a few more printers on the network that it never returned.

Shouldn't it return more than a range of 7?

So nothing can be assigned to .255?
g127404,

very odd, i dont get an response in my network........   you cant assign a       .255 address

i wonder what is unique about those 7 IP's
Avatar of Keith Alabaster
This could be the network in the printers, it could be all sorts of things and to be frank I wouldn't bother about it; this is just part of the standard tcpip networking methodology.

When you first try to send some data from 192.168.0.1 for example to 192.168.0.10, 192.168.0.1 needs to ascertain the MAC address of .10.

It 'broadcasts' a call on the network saying, in effect, hello everyone out there who is on the 192.168.0.0/24 address range, are you 192.168.0.10?. It does this by calling the 192.168.0.255 address. So, every machine that matches the criteria, (is on the 192.168.0.0/24 subnet) hears the call and ONE of them (192.168.0.10) should say, 'hey, thats me'. 192.168.0.10 sees that the call has come from 192.168.0.1 and so .10 replies to .1 saying 'if you want to talk to me, here is my MAC address.

Now .1 can talk directly to .10 using the MAC address.

On your PC, id you do a arp -a you will see a list of IP addresses and MAC addresses. These are the results of the above where other machines have replied to your PC like the example above.

So, in answer to your question, yes, I have seen it but not often.

Regards
Keith


Avatar of g127404

ASKER

>> "and to be frank I wouldn't bother about it"
Ok, Frank I won't worry about it. =-)

It wasn't something I've encountered before and couldn't find anything on Google.  I must not know how to search for my question.  Can anyone provide a link to this behavior?  I'm not worried but I would like to know why it happens.

I'm still not clear on:

I can't ping it from every machine.  Just some of the windows servers we have will return a result.  All other workstations time out.
1 of the servers - a Windows 2000 machine that acts as a fileserver replies with what I'm used to seeing... the original ip I asked for.
C:\>ping 192.168.0.255

Pinging 192.168.0.255 with 32 bytes of data:

Reply from 192.168.0.255: bytes=32 time=31ms TTL=255
Reply from 192.168.0.255: bytes=32 time<10ms TTL=255
Reply from 192.168.0.255: bytes=32 time<10ms TTL=255
Reply from 192.168.0.255: bytes=32 time=203ms TTL=255

Ping statistics for 192.168.0.255:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum =  203ms, Average =  58ms

The other servers reply with the oddity that I explained before.  The servers are both domain controllers - SBS and Windows 2003.
C:\>ping 192.168.0.255

Pinging 192.168.0.255 with 32 bytes of data:

Reply from 192.168.0.206: bytes=32 time<1ms TTL=255
Reply from 192.168.0.203: bytes=32 time<1ms TTL=255
Reply from 192.168.0.206: bytes=32 time<1ms TTL=255
Reply from 192.168.0.206: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.0.255:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

could this have anything to do with dns?
No. DNS resolves ip addresses to Fully qulaified Domain Names (FQDN's)
ASKER CERTIFIED SOLUTION
Avatar of Keith Alabaster
Keith Alabaster
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of g127404

ASKER

We are experiencing packet loss as well.  I guess I should have included that in this question, I made it another question all-together.  Don't you hate it when you don't get all the information. =-)
here is the problem with the dropped packets.  It should give you a better idea of what's going on.
https://www.experts-exchange.com/questions/21876492/Network-Seizes-up-for-short-periods-of-time.html

The SBS box has 2 nic's but one is disabled.  The SonicWall is doing the routing.
The SBS is not acting as the gateway... only the DNS.
Sonicwall ip address is: 192.168.0.254
SBS ip address is 192.168.0.253

My ipconfig:
Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.0.36
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.254
Avatar of g127404

ASKER

I have been using Ethereal for a while and that's how I found the ip weirdness in the first place.  I'm a novice to intermediate when it comes to analyzing what Ethereal is telling me.
Er, yeah. Sort of does change the whole perspective of the question doesn't it.

One of these questions needs to be closed off as you have effectively got the same question twice. As you are limited to 500 points for a question.

I will close this question off by setting its points to zero and using this as a pointer to your other question.

Regards

Keith
Avatar of g127404

ASKER

I saw these as two separate questions but do what you must.  In my mind packet loss was different from a .255 returning multiple ip addresses.  Thank you for the help you've provided so far.
No problem at all and you're welcome. I think we can both see though that the errors are going to be interrelated. I have refunded your points for this call and have already posted on the link.

Regards
Keith
Avatar of g127404

ASKER

Not sure what answer to accept since there are no points... but to close it I'll accept one.
Leave it as it is then people will know to follow the link to add to your other question. It will get closed automatically by the Community Volunteers later.