117-201 · Question #335
Under which of the following circumstances would the command ping output the string (DUP!)?
The correct answer is A. When the ICMP packets are send to a broadcast address and multiple hosts respond. See the full explanation below for the reasoning.
Question
Options
- AWhen the ICMP packets are send to a broadcast address and multiple hosts respond.
- BWhen the host being sent ICMP packets is on a different network.
- CWhen the router responds to the ICMP packet in addition to the host receiving the ICMP packets.
- DWhen the host sending the ICMP packet is the same host as the one receiving the ICMP packets.
How the community answered
(56 responses)- A71% (40)
- B9% (5)
- C16% (9)
- D4% (2)
Community Discussion
7The answer is A, when ICMP packets are sent to a broadcast address and multiple hosts respond. Ping expects exactly one reply per sequence number, so if you ping a broadcast address like 192.168.1.255, every host on that subnet that responds counts as an extra reply for the same sequence, and ping flags those extras with (DUP!) to let you know it got more responses than it bargained for. The other options do not produce duplicates because a different-network host, a router in the middle, or loopback to yourself all still result in a single reply per packet. Once I got that straight, I started thinking of (DUP!) as ping saying "hey, I only asked once but got more than one answer," and that made it stick for me.
That framing really clicked for me too, and the only thing I would add is that you will only see this on Linux or macOS because Windows ping drops duplicate replies silently without ever showing (DUP!), which is worth knowing before you try to replicate it in a lab.
Option C tripped me up at first because our senior network guy mentioned routers can generate ICMP replies in certain redirect scenarios, but that does not produce DUP! in ping output. DUP! shows up when you ping a broadcast address and several hosts all fire back replies for the same sequence number, so A is the one.
Yusuf nailed the broadcast angle, and worth adding that on Linux ping you will also see DUP! if there is a network loop duplicating packets before they return, which can fool you into thinking broadcast is the cause when the real culprit is a switching issue.
A is the one, and here is why it clicks once you see it. When you ping a broadcast address, every host that receives that ICMP echo request can send its own reply back to you, so your ping process gets multiple responses tied to the same sequence number, and it flags each extra one with (DUP!) to tell you something unusual is happening. C is the trap answer because it sounds plausible, routers doing something extra, but a router in the middle of the path does not respond to an echo request on behalf of the destination host in a way that generates a duplicate reply to your sender. D describes loopback behavior and that will not produce DUP! under normal circumstances either. Nail down the broadcast scenario and this question is a freebie.
When you ping yourself, the packet loops back internally and the kernel can receive it more than once before the socket closes out, which is exactly what triggers that DUP! flag. I burned points on this one my first attempt by overthinking broadcast behavior, but the loopback scenario is what reproduces it every time in a test environment.
Wesley, the DUP! flag shows up because multiple hosts on the network each send a reply when you ping a broadcast address, so the sender receives more than one echo reply for a single request. The loopback interface does not produce that behavior since there are no other hosts involved.