This document describes why the IP phone only replies to one ping when it is pinged twice.
Readers of this document should be knowledgeable of the following:
Cisco IP Phone
Cisco Unified Communications Manager (Unified CM)
The information in this document is based on the software and hardware versions:
Cisco CallManager version 3.x
Cisco Unified CM 5.x/6.x/7.x/8.x
Cisco IP Phone version 79xx
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
For more information on document conventions, see the Cisco Technical Tips Conventions.
When trying to ping an Cisco IP Phone 79xx from a router, the phone will only reply to one ping out of two and intermittent ping drop happens.
router > ping ipphoneA Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to ipphoneA, timeout is 2 seconds: !.!.! Success rate is 60 percent (3/5), round-trip min/avg/max = 1/2/4 ms
This is not the case when pinging from a PC.
C:\>ping ipphoneA Pinging ipphoneA with 32 bytes of data: Reply from ipphoneA: bytes=32 time<10ms TTL=63 Reply from ipphoneA: bytes=32 time<10ms TTL=63 Reply from ipphoneA: bytes=32 time<10ms TTL=63 Reply from ipphoneA: bytes=32 time<10ms TTL=63 Ping statistics for ipphoneA: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
This is Working as Designed (WAD). This is because the IP phones have been designed to only reply to an echo every 10ms, in order to withstand Denial of Service (DoS) attacks. DoS protection is provided by limiting resources for ICMP processing and not responding to ICMP broadcast pings. A Cisco IOS gateway sends echos more frequently, so one out of two will timeout.
This is not the case for a PC since the time between two echos is greater than 10ms.
Note: Cisco IP Phones 7902/05/12 have a different code base from the Cisco 7940/60. Consequently, there is a delayed reply to the network ping with the 7902/05/12, but not the 7940/60.
Note: Also, for Cisco Unified CM, this behavior exists and the ICMP will be throttled in order to prevent DoS attacks.
These are some of the known issues:
CSCee46831 (registered customers only) - 7970 drops rtp connection after getting ICMP Unreachable.
CSCef54937 (registered customers only) - 7970: ICMP source quench behavior changes.
CSCsb30771 (registered customers only) - Sending fragmented ICMP packet causes sending phone to crash.
CSCef54947 (registered customers only) - 7970: ICMP hard errors behavior changes.
CSCsc27685 (registered customers only) - IP Reassembly broken/does not work in ip.c.