Hi there,

I am currently trying to figure out how ping differs in Windows vs. Linux. I am trying to use ping to check the availability of a system. On a Windows computer, if I ping a computer (target system also Windows) going to sleep, it will receive replies before sleeping, time out during sleep, and receive replies after the system resumes.

On my Linux (Debian) system, even after the target system resumes, ping (I use -W 3 -O flags) will intermittently receive replies (perhaps 1 replied packet in 10) while the rest will say "not received answer yet". If I run an arp-scan on the target computer, or flush the ARP cache (run ip -s -s neigh flush all), then pings will be received as before.

How come flushing the ARP cache in Linux needs to happen before pings function as expected? Is there a difference in the implementation of ping?

Thanks.

Hello and welcome to LQ.

In short, yes. Ping the program is different in every OS usually and in each version and each compilation. They are not the same program. They may have features that are similar and use similar paths to get to the work needed.


I'd look at arp -a before and after. Why it would change I can't say.

Did the WinPC get a *different* IP address -after- resume? (yes, arp -a) tcpdump maybe

Good 'puzzle'! We'll 'get there'. Yes, Welcome

There are systems which will reply on ping even when the system itself is already died (frozen, crashed, whatever). So ping is not really reliable if you want to check the availability of a system. I would rather try something better (for example a service).
Also the result of ping test depends on the other side too, not only the implementation of ping and the OS. How will you interpret if something/sometimes was sent back at all?

I could not figure out the reason behind this behavior, but I was able to fix our programs that depend on ping to use arp-scan at the same time to force refresh of the ARP-cache. @pan64, this must be with hardware-implemented ICMP but I have not seen this with any of our computers.

I am looking into using redis instead and using a pub/sub approach. But further discussion, is certainly out of scope of this question. Thanks all.

what is the C code for ping under Linux? It might help to look moire into detailed of its job.. or action..


check here: ping.c

https://www.cise.ufl.edu/~cop4600/cg...mmands/simple/

Xeratul,

Can't say what the code is for ping the OP has. It is a very old program and every OS has some "build" of it. Windows of course would not be the same code base most likely. Some versions of linux and maybe QNX and such may have similar code base. First would be starting with the version of ping on some system. Also if it is some busybox version too. Busybox versions tend to be stripped. If ping came with a distro it ought to be documented.

The OP seems to be happy forcing arp I assume before ping or just by using arp scan to id mac to ip. There are other ways to fix this. I assume some set of switches are causing his issue maybe??