...
For a discussion of the reasons for duplicate pings see http://unix.stackexchange.com/questions/13254/what-could-dup-mean-when-using-ping. For PingER data several of the possibilities such as multicast, wireless network, promiscuous mode are unlikely to be the cause.
Duplicate ping responses can be seen for example from SLAC to CERN or www.realbroadband.co.sz. They can be caused by:
...
An example of the prevalence of duplicate ping packets comes from PingER measurements on March 31st 2012 from SLAC to 703 hosts in over 160 countries. Of these hosts 15 responded with duplicate pings. For 13 of the 15 hosts it occured occurred on both 100 and 1000 Byte pings. Out of 10 pings sent:
...
The sites of the hosts range from national labs (CERN, IHEP SU), developed countries (Israel), developing countries (Burkina Faso, Malawi, Mauritius, Sierra Leone, Swaziland, Zambia), and educational sites (SDSC). Only the www.cercern.ch address was consistent in the number and frequency of duplicate pings.
...
Analysis of data in Jan 2015
We have data capable of detecting duplicate pings from PingER, going back to 2005 which I have mined to look for DUP's. The input data is one line per set of pings made from SLAC to a remote host. The line indicates whether there were DUP’s. Each line is for a remote host monitored from SLAC with up to 10 successful (with a cut off at 30 tries) 100 Byte pings each 30 mins.
...
Year | DUPs | Hosts DUPing | Hosts monitored | Samples | % | CERN | Diff | % CERN |
2005 | 93 | 27 | 481 | 11408092 | 0.0008% | 0 | 93 | 0.00% |
2006 | 9228 | 40 | 514 | 13715929 | 0.0673% | 5751 | 3477 | 62.32% |
2007 | 35673 | 42 | 541 | 16315320 | 0.2186% | 34721 | 952 | 97.33% |
2008 | 39262 | 57 | 592 | 19680482 | 0.1995% | 34249 | 5013 | 87.23% |
2009 | 42356 | 52 | 663 | 17889767 | 0.2368% | 27469 | 14887 | 64.85% |
2010 | 74638 | 51 | 623 | 19862304 | 0.3758% | 19693 | 54945 | 26.38% |
2011 | 30769 | 79 | 659 | 22889278 | 0.1344% | 22518 | 8251 | 73.18% |
2012 | 85217 | 50 | 797 | 23786399 | 0.3583% | 34402 | 50815 | 40.37% |
2013 | 74128 | 76 | 774 | 25475771 | 0.2910% | 34916 | 39212 | 47.10% |
2014 | 16990 | 41 | 836 | 29933696 | 0.0568% | 14026 | 2964 | 82.55% |
2015 | 164 | 4 | 514773 | 0.0319% | 104 | 60 | 63.41% |
Jan 1-Feb 14 2015
This data is for all monitors monitoring their set of remote sites every 30 minutes for the dates above. There are roughly 70 active monitors of which ~ 50% saw at least one remote host giving duplicate pings responses. There were 22 remote hosts responding with duplicate ping responses. There were roughly 720 remote hosts being probed with pings in over 170 countries. The remote hosts seen providing duplicate pings ordered in frequency of being seen is given in the table below. It is seen that apart from CERN (duplicates seen only from SLAC) the remote hosts with duplicate responses are outside N. America, Europe and Australia with the top 3 three being in Africa. For E. Asia the host in Taiwan (.tw) is seen once by pingermtn.pern.edu.pk. the host in China (.cn) is seen once by SLAC.
| Times remote host seen w 1 or more dups | Remote host |
| 1099 | www.univ-koudougou.bf |
| 315 | www.univ-ouaga.bf |
| 263 | www.gov.bw |
| 235 | shinjiru.com.my |
| 70 | pinger-ncp.ncp.edu.pk |
| 68 | www.kcn.unima.mw |
| 44 | www.multinet.af |
| 37 | www.cern.ch |
| 24 | www.kist.ac.rw |
| 12 | www.granma.cu |
| 6 | pinger.lcwu.edu.pk |
| 2 | ms01.linea.gov.br |
| 2 | www.ml.refer.org |
| 2 | www.stmaryuniversitycollege.edu.et |
| 1 | namunu.learn.ac.lk |
| 1 | cad.zju.edu.cn |
| 1 | www.unilag.edu.ng |
| 1 | dns.sinica.edu.tw |
| 1 | www.global.net.pg |
| 1 | www.nren.net.np |
| 1 | www.ubd.edu.bn |
| 2186 | Sum |
Distribution of Remote (monitored) hosts by country
...