ping error (DUP!)

Ntop is running on redhat. But It gives DUP! error while pinging to any places
I dont know why DUP! error is occured.

# ping google.com
PING google.com (74.125.39.147) 56(84) bytes of data.
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=1 ttl=44 time=54.1 ms
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=1 ttl=44 time=54.1 ms (DUP!)
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=2 ttl=44 time=54.0 ms
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=2 ttl=44 time=54.0 ms (DUP!)
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=3 ttl=44 time=54.4 ms
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=3 ttl=44 time=54.4 ms (DUP!)
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=4 ttl=44 time=54.4 ms
64 bytes from fx-in-f147.1e100.net (74.125.39.147): icmp_seq=4 ttl=44 time=54.4 ms (DUP!)
# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.30.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
0.0.0.0         192.168.30.2    0.0.0.0         UG        0 0          0 eth0
# 
# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:50:56:A9:00:3C  
          inet addr:192.168.30.253  Bcast:192.168.30.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fea9:3c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3463154 errors:1672 dropped:3268 overruns:0 frame:0
          TX packets:2490 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1203261617 (1.1 GiB)  TX bytes:223457 (218.2 KiB)
          Interrupt:59 Base address:0x2000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1234 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1234 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1919036 (1.8 MiB)  TX bytes:1919036 (1.8 MiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Are there devices on your network that have the same IP address? Were there any with this address before?

Does this occur when pinging a local network address or only across a router? If you turn off the network probe does it happen?

the common problems with DUP! packets are related to network mask misconfiguration
you may have NETWORK=192.168.30.0 inside your /etc/sysconfig/network-scripts/ifcfg-eth0 but you didn't design your network standard ( your gateway is 192.168.30.2 instead of .1 or .254 ), change gateway ip and try again.

I have configured eth0 as dhcp but there is no changed.
(DUP!) warning is still continuing.

Internal or external network doesn't matter.
192.168.30.1 is vlan gw.
192.168.30.2 is firewall ip address.

# cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
HWADDR=00:50:56:a9:00:2f
#
# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:50:56:A9:00:2F  
          inet addr:192.168.30.11  Bcast:192.168.30.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fea9:2f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:81922 errors:0 dropped:0 overruns:0 frame:0
          TX packets:600 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10026441 (9.5 MiB)  TX bytes:56194 (54.8 KiB)
          Interrupt:59 Base address:0x2000 
# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.30.0    *               255.255.255.0   U         0 0          0 eth0
169.254.0.0     *               255.255.0.0     U         0 0          0 eth0
default         192.168.30.1    0.0.0.0         UG        0 0          0 eth0
# 
# ping 192.168.20.10
PING 192.168.20.10 (192.168.20.10) 56(84) bytes of data.
64 bytes from 192.168.20.10: icmp_seq=1 ttl=254 time=4.03 ms
64 bytes from 192.168.20.10: icmp_seq=1 ttl=254 time=4.03 ms (DUP!)
64 bytes from 192.168.20.10: icmp_seq=2 ttl=254 time=0.734 ms
64 bytes from 192.168.20.10: icmp_seq=2 ttl=254 time=0.735 ms (DUP!)

its so weird, are you sure you have 1 gateway on your 192.168.30.1 ?
unplug any system on your network that acts like router/firewall like 192.168.30.2

Duplicate ping error with network bonding driver in Linux

Starting with version 3.0.2, the bonding driver has logic to suppress duplicate packets, which should largely eliminate this problem. The following description is kept for reference.

     It is not uncommon to observe a short burst of duplicated traffic when the bonding device is first used, or after it has been idle for some period of time.  This is most easily observed by issuing a �ping� to some other host on the network, and noticing that the output from ping flags duplicates \(typically one per slave\).

For example, on a bond in active-backup mode with two slaves all connected to one switch, the output may appear as follows:

# ping -n 10.10.0.2
PING 10.10.0.2 (10.10.0.2) from 10.10.0.30: 56(84) bytes of data.
64 bytes from 10.10.0.2: icmp_seq=1 ttl=64 time=13.7 ms
64 bytes from 10.10.0.2: icmp_seq=1 ttl=64 time=13.8 ms (DUP!)
64 bytes from 10.10.0.2: icmp_seq=1 ttl=64 time=13.8 ms (DUP!)
64 bytes from 10.10.0.2: icmp_seq=1 ttl=64 time=13.8 ms (DUP!)
64 bytes from 10.10.0.2: icmp_seq=1 ttl=64 time=13.8 ms (DUP!)
64 bytes from 10.10.0.2: icmp_seq=2 ttl=64 time=0.216 ms
64 bytes from 10.10.0.2: icmp_seq=3 ttl=64 time=0.267 ms
64 bytes from 10.10.0.2: icmp_seq=4 ttl=64 time=0.222 ms

# cat /proc/net/bonding/bond0

Ethernet Channel Bonding Driver: v2.6.5 Bonding Mode: fault-tolerance (active-backup)

Primary Slave: None
Currently Active Slave: eth0
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr: 00:1b:74:56:4e:98

Slave Interface: eth1
MII Status: up
Link Failure Count: 0
Permanent HW addr: 00:1b:74:56:4e:9a

# uname -a
Linux myserver01 2.6.5-7.282-bigsmp #1 SMP UTC 2006 i686 i686 i386 GNU/Linux

This is not due to an error in the bonding driver, rather, it is a side effect of how many switches update their MAC forwarding tables. Initially, the switch does not associate the MAC address in the packet with a particular switch port, and so it may send the traffic to all ports until its MAC forwarding table is updated. Since the interfaces attached to the bond may occupy multiple ports on a single switch, when the switch (temporarily) floods the traffic to all ports, the bond device receives multiple copies of the same packet (one per slave device).

The duplicated packet behavior is switch dependent, some switches exhibit this, and some do not. On switches that display this behavior, it can be induced by clearing the MAC forwarding table (on most Cisco switches, the privileged command �clear mac address-table dynamic� will accomplish this).

---------- Post updated at 07:43 PM ---------- Previous update was at 05:04 PM ----------