[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
• Status: Solved
• Priority: Medium
• Security: Public
• Views: 372

# ping returns multiple results - Pointer Question

http://www.experts-exchange.com/Networking/Microsoft_Network/Q_21876492.html

I have no devices (that I know of) on 192.168.0.255.  Doing a packet sniff on the network I found traffic pointing to this ip address.  A ping resulted in multiple ip addresses all of which happen to be Dell printers.  Have you seen a ping return ip addresses other than what you originally specified?

C:\>ping 192.168.0.255

Pinging 192.168.0.255 with 32 bytes of data:

Reply from 192.168.0.201: bytes=32 time=2ms TTL=64
Reply from 192.168.0.203: bytes=32 time=1ms TTL=64
Reply from 192.168.0.203: bytes=32 time=1ms TTL=64
Reply from 192.168.0.202: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.0.255:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms
0
g127404
• 7
• 6
• 2
1 Solution

Commented:
Hi g127404,

0

Author Commented:
I did the ping over a period of 1/2 an hour every once in a while and it only returned a range of about 7 ip addresses all of which are printers.  We have about 30 other computers and a few more printers on the network that it never returned.

Shouldn't it return more than a range of 7?

So nothing can be assigned to .255?
0

Commented:
g127404,

very odd, i dont get an response in my network........   you cant assign a       .255 address

i wonder what is unique about those 7 IP's
0

Commented:
This could be the network in the printers, it could be all sorts of things and to be frank I wouldn't bother about it; this is just part of the standard tcpip networking methodology.

When you first try to send some data from 192.168.0.1 for example to 192.168.0.10, 192.168.0.1 needs to ascertain the MAC address of .10.

It 'broadcasts' a call on the network saying, in effect, hello everyone out there who is on the 192.168.0.0/24 address range, are you 192.168.0.10?. It does this by calling the 192.168.0.255 address. So, every machine that matches the criteria, (is on the 192.168.0.0/24 subnet) hears the call and ONE of them (192.168.0.10) should say, 'hey, thats me'. 192.168.0.10 sees that the call has come from 192.168.0.1 and so .10 replies to .1 saying 'if you want to talk to me, here is my MAC address.

Now .1 can talk directly to .10 using the MAC address.

On your PC, id you do a arp -a you will see a list of IP addresses and MAC addresses. These are the results of the above where other machines have replied to your PC like the example above.

So, in answer to your question, yes, I have seen it but not often.

Regards
Keith

0

Author Commented:
>> "and to be frank I wouldn't bother about it"
Ok, Frank I won't worry about it. =-)

It wasn't something I've encountered before and couldn't find anything on Google.  I must not know how to search for my question.  Can anyone provide a link to this behavior?  I'm not worried but I would like to know why it happens.

I'm still not clear on:

I can't ping it from every machine.  Just some of the windows servers we have will return a result.  All other workstations time out.
1 of the servers - a Windows 2000 machine that acts as a fileserver replies with what I'm used to seeing... the original ip I asked for.
C:\>ping 192.168.0.255

Pinging 192.168.0.255 with 32 bytes of data:

Reply from 192.168.0.255: bytes=32 time=31ms TTL=255
Reply from 192.168.0.255: bytes=32 time<10ms TTL=255
Reply from 192.168.0.255: bytes=32 time<10ms TTL=255
Reply from 192.168.0.255: bytes=32 time=203ms TTL=255

Ping statistics for 192.168.0.255:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum =  203ms, Average =  58ms

The other servers reply with the oddity that I explained before.  The servers are both domain controllers - SBS and Windows 2003.
C:\>ping 192.168.0.255

Pinging 192.168.0.255 with 32 bytes of data:

Reply from 192.168.0.206: bytes=32 time<1ms TTL=255
Reply from 192.168.0.203: bytes=32 time<1ms TTL=255
Reply from 192.168.0.206: bytes=32 time<1ms TTL=255
Reply from 192.168.0.206: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.0.255:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

could this have anything to do with dns?
0

Commented:
0

Commented:
No. DNS resolves ip addresses to Fully qulaified Domain Names (FQDN's)
0

Commented:
What IS possible is that the SBS box (I assume it is standard with two nic's) is learning some of its information from the wrong NIC. As data passes through gateways (your SBS server for instance), the packet header is stripped off and rewritten with the MAC address of the next hop/gateway/router. If the SBS box or another gateway on your network is having a problem, I suppose this could be having an effect but this would likely cause you to suffer from lost packets.

An option for you would be to download and install a free analyser such as ethereal (www.ethereal.com) on a PC. perform a few pings like you have above. You can check the MAC addresses of the various machines to see what exactly is going on.

Regards
Keith
0

Author Commented:
We are experiencing packet loss as well.  I guess I should have included that in this question, I made it another question all-together.  Don't you hate it when you don't get all the information. =-)
here is the problem with the dropped packets.  It should give you a better idea of what's going on.
http://www.experts-exchange.com/Networking/Microsoft_Network/Q_21876492.html

The SBS box has 2 nic's but one is disabled.  The SonicWall is doing the routing.
The SBS is not acting as the gateway... only the DNS.

My ipconfig:

Connection-specific DNS Suffix  . :
IP Address. . . . . . . . . . . . : 192.168.0.36
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.254
0

Author Commented:
I have been using Ethereal for a while and that's how I found the ip weirdness in the first place.  I'm a novice to intermediate when it comes to analyzing what Ethereal is telling me.
0

Commented:
Er, yeah. Sort of does change the whole perspective of the question doesn't it.

One of these questions needs to be closed off as you have effectively got the same question twice. As you are limited to 500 points for a question.

I will close this question off by setting its points to zero and using this as a pointer to your other question.

Regards

Keith
0

Author Commented:
I saw these as two separate questions but do what you must.  In my mind packet loss was different from a .255 returning multiple ip addresses.  Thank you for the help you've provided so far.
0

Commented:
No problem at all and you're welcome. I think we can both see though that the errors are going to be interrelated. I have refunded your points for this call and have already posted on the link.

Regards
Keith
0

Author Commented:
Not sure what answer to accept since there are no points... but to close it I'll accept one.
0

Commented:
Leave it as it is then people will know to follow the link to add to your other question. It will get closed automatically by the Community Volunteers later.
0

## Featured Post

• 7
• 6
• 2
Tackle projects and never again get stuck behind a technical roadblock.