How does ping work when a host name has multiple ip addresses?

Question

For example, google.com has at least these ip:

74.125.225.49
74.125.225.51
74.125.225.81

Does ping just pick one of them randomly?

dmourati · Answer 1 · 2011-09-17T09:30:18.427

The answer is it depends on how your DNS resolver is setup and also how the DNS server for the domain in question is set up.

The DNS resolver on your ping source host will consult the OS and network configuration to lookup the host you want to ping. If this is a new host, one for which you haven't previously done a lookup, the DNS query sequence will go from start to finish.

The number of A records and contents of those records as well as what order they are are returned depends on the name servers for the target ping destination domain. This process is a whole other discussion.

Your DNS client will pick one of those IPs returned in the A records and your ping will start sending IMCP echo-request messages to that destination IP.

Your local OS may cache one or more of the responses for some period of time, typically but not always the TTL specified in the A record. There is also another caching opportunity at your DNS resolver, again, which typically but not always will follow the TTL.

One final wrinkle is the so-called sort ordering done by some DNS clients. See:

http://www.tylek.org/?p=33

Does `gethostbyname` do sort ordering automatically?How to check whether ordering is enabled in linux? — kernel, Sep 17 '11 at 11:39
Yes it follows a sort order see comments here: https://serverfault.com/a/312464/27813 — rogerdpack, Nov 21 '19 at 19:58

score 3 · Answer 2 · answered Sep 17 '11 at 01:32

3

It just picks one of them. It's not quite random -- for example, if one of them is on the same local network, it will typically pick that one.

answered Sep 17 '11 at 01:32

David Schwartz

31,449
2
55
84

the same local network with what? – Sep 17 '11 at 03:08
The same local network with the machine you ran 'ping' on. – David Schwartz Sep 17 '11 at 09:07
Can you provide some source code proof of this? I've never seen this behavior before. – polynomial Sep 17 '11 at 11:32
Is it done by DNS server or the client? Is the result of `gethostbyname` already sorted?How to check whether it's actually the case in linux? – kernel Sep 17 '11 at 11:35
Independent of what the DNS server does, the client sorts the results. Typically, `ping` will use `getaddrinfo`, not `gethostbyname`. [RFC3484](http://www.ietf.org/rfc/rfc3484.txt) specifies the sort order, which on UNIXy operating systems is often controlled by a file named `/etc/gai.conf`. – David Schwartz Sep 17 '11 at 11:46
1

So `getaddrinfo` takes care of sorting internally,right? – kernel Sep 17 '11 at 13:13
Right, per RFC3484. – David Schwartz Sep 18 '11 at 01:01

score 0 · Answer 3 · answered Sep 17 '11 at 01:36

THE PING PROCESS

    The source host generates an ICMP protocol data unit.
    The ICMP PDU is encapsulated in an IP datagram, with the source and destination IP addresses in the IP header. At this point the datagram is most properly referred to as an ICMP ECHO datagram, but we will call it an IP datagram from here on since that's what it looks like to the networks it is sent over.
    The source host notes the local time on it's clock as it transmits the IP datagram towards the destination. Each host that receives the IP datagram checks the destination address to see if it matches their own address or is the all hosts address (all 1's in the host field of the IP address).
    If the destination IP address in the IP datagram does not match the local host's address, the IP datagram is forwarded to the network where the IP address resides.
    The destination host receives the IP datagram, finds a match between itself and the destination address in the IP datagram.
    The destination host notes the ICMP ECHO information in the IP datagram, performs any necessary work then destroys the original IP/ICMP ECHO datagram.
    The destination host creates an ICMP ECHO REPLY, encapsulates it in an IP datagram placing it's own IP address in the source IP address field, and the original sender's IP address in the destination field of the IP datagram.
    The new IP datagram is routed back to the originator of the PING. The host receives it, notes the time on the clock and finally prints PING output information, including the elapsed time.

The process above is repeated until all requested ICMP ECHO packets have been sent and their responses have been received or the default 2-second timeout expired. The default 2-second timout is local to the host initiating the PING and is NOT the Time-To-Live value in the datagram.

More: http://www.inetdaemon.com/tools/ping/how_ping_works.shtml

-1 for not answering any part of the question actually asked. — JdeBP, Sep 17 '11 at 14:39

How does ping work when a host name has multiple ip addresses?

3 Answers3