asa 5505 showing weird ping values

I just got an ASA5505 and I'm testing it out. There is no real traffic going through it yet so the cpu is at around 9-12%. I am pinging a server in my dmz from a windows host and this is what it looks like:

Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=104ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time=-104ms TTL=64

I tried pinging my voip trunk provider (from the same windows host) and it looks like this:

Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=55ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53
Reply from 159.x.x.x: bytes=32 time=-49ms TTL=53
Reply from 159.x.x.x: bytes=32 time=55ms TTL=53
Reply from 159.x.x.x: bytes=32 time=159ms TTL=53

It seems to be adding 104ms a lot of the time and i'm not sure why... I also have some weird negative ping values in there. I've never used an ASA before I've never seen this pinging through our PIX.

When I run the pings from a linux server however, everything looks as I would expected through a device with no traffic:

64 bytes from 10.10.10.2: icmp_seq=45 ttl=64 time=0.428 ms
64 bytes from 10.10.10.2: icmp_seq=46 ttl=64 time=0.457 ms
64 bytes from 10.10.10.2: icmp_seq=47 ttl=64 time=0.442 ms
64 bytes from 10.10.10.2: icmp_seq=48 ttl=64 time=0.435 ms
64 bytes from 10.10.10.2: icmp_seq=49 ttl=64 time=0.428 ms
64 bytes from 10.10.10.2: icmp_seq=50 ttl=64 time=0.288 ms
64 bytes from 10.10.10.2: icmp_seq=51 ttl=64 time=0.247 ms
64 bytes from 10.10.10.2: icmp_seq=52 ttl=64 time=0.245 ms
64 bytes from 10.10.10.2: icmp_seq=53 ttl=64 time=0.281 ms
64 bytes from 10.10.10.2: icmp_seq=54 ttl=64 time=0.363 ms
64 bytes from 10.10.10.2: icmp_seq=55 ttl=64 time=0.471 ms
64 bytes from 10.10.10.2: icmp_seq=56 ttl=64 time=0.350 ms

Can anyone explain this? Obviously the windows and linux versions of ping calculate their time values differently. I'm thinking that maybe the windows version calculates it based on a timestamp in the packet itself and the linux ping keeps track of when it sent a packet out based on its own internal clock and when the ping comes back it calculates the difference? But why would I just be seeing this for the first time? Why did I never see this behavior through the pix?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

kalebksp

Your windows box doesn't happen to have an older AMD dual core processor, does it? There was problem with the timing between the two cores a while back: Negative Ping Time - Luke Jackson

jrs91

kalebksp wrote: »

Your windows box doesn't happen to have an older AMD dual core processor, does it? There was problem with the timing between the two cores a while back: Negative Ping Time - Luke Jackson

Wow. Good catch. That's exactly what the windows box has. Thanks.