Duplicate ping responses can appear as shown herebe seen for CERN or junk. They can be caused by:
- More than one host has the same IP address, so all these hosts will respond to the ICMP echo request.
- The IP address pinged may be a broadcast address.
- The host has multiple TCP stacks bound to an Ethernet adaptor (see http://www.doxpara.com/read.php/tcp_chorusing.html).
- A router believes it has two routes by which it can reach the end host and (presumably mistakenly) forwards the ICMP echo requests by both routes, thus the end host sees two echo requests and responds twice.
- There maybe two or more (non-routed) paths to the end host and each request is forwarded by more than one path.
- A misbehaving NAT box.
...
- Pinging the routers along the route to see if any of them respond with duplicates. Example. Examples: Duplicate pings from SLAC torealimage.realnet.co.sz , www.lonab.bf.
- Capture the ping packets and look to see if all the packets are returned from the same Ethernet address.
- Do multiple hosts at a site/network domain/subnet return duplicate packets?
...