ping response problem

[rvj]

I have a laptop with two linux partitions, each with a linux distribution (Gnome for one and KDE for the other). Both distributions use NetworkManager and iwd, and both result in the same resolv.conf file:

# Generated by NetworkManager
search attlocal.net
nameserver 192.168.1.254
nameserver 2600:1700:dd90:5640::1

I have problems with internet connections on one distribution (connections take varying and generally long times), but not the other. This problem shows up most clearly using ping, specifically in obtaining the ip address from the DNS server. Once the ip address is obtained, the subsequent ping proceeds smoothly and quickly on both systems.

Using dig on the misbehaving distribution shows no problems, with near instantaneous response. Sample dig output:

dig www.gentoo.org

; <<>> DiG 9.16.50 <<>> www.gentoo.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18180
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.gentoo.org. IN A

;; ANSWER SECTION:
www.gentoo.org. 3600 IN CNAME www-cdn.gentoo.org.
www-cdn.gentoo.org. 3600 IN CNAME dualstack.n.sni.global.fastly.net.
dualstack.n.sni.global.fastly.net. 3 IN A 146.75.93.91

;; Query time: 279 msec
;; SERVER: 192.168.1.254#53(192.168.1.254)
;; WHEN: Sun Sep 29 11:52:08 PDT 2024
;; MSG SIZE rcvd: 128

I have used Wireshark to attempt to study the ping problem.

On the well-behaved distribution the DNS request proceeds smoothly:

13 0.141526656 192.168.1.85 192.168.1.254 DNS 74 Standard query 0xe533 A www.gentoo.org
14 0.141564589 192.168.1.85 192.168.1.254 DNS 74 Standard query 0xc83a AAAA www.gentoo.org
15 0.615544785 192.168.1.254 192.168.1.85 DNS 159 Standard query response 0xe533 A www.gentoo.org CNAME www-cdn.gentoo.org CNAME dualstack.n.sni.global.fastly.net A 151.101.201.91
16 1.537560148 192.168.1.254 192.168.1.85 DNS 171 Standard query response 0xc83a AAAA www.gentoo.org CNAME www-cdn.gentoo.org CNAME dualstack.n.sni.global.fastly.net AAAA 2a04:4e42:2f::347

followed by rapid ping query and response.

Here is the corresponding ping report:

ping -c 4 www.gentoo.org
PING www.gentoo.org (2a04:4e42:2f::347) 56 data bytes
64 bytes from 2a04:4e42:2f::347: icmp_seq=1 ttl=56 time=6.97 ms
64 bytes from 2a04:4e42:2f::347: icmp_seq=2 ttl=56 time=7.32 ms
64 bytes from 2a04:4e42:2f::347: icmp_seq=3 ttl=56 time=7.50 ms
64 bytes from 2a04:4e42:2f::347: icmp_seq=4 ttl=56 time=6.54 ms

--- www.gentoo.org ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 6.535/7.080/7.498/0.367 ms

Here is one random .pcapng record from the misbehaving distribution:

25 12.899462446 192.168.1.85 192.168.1.254 DNS 108 Standard query 0x0ca4 A www.gentoo.org OPT
26 12.899520810 192.168.1.85 192.168.1.254 DNS 108 Standard query 0x5f82 AAAA www.gentoo.org OPT
27 12.899595308 192.168.1.85 192.168.1.254 DNS 108 Standard query 0xfb4d AAAA www.gentoo.org OPT
28 12.899647080 192.168.1.85 192.168.1.254 DNS 108 Standard query 0x049c A www.gentoo.org OPT
29 13.103341723 192.168.1.254 192.168.1.85 DNS 446 Standard query response 0x0ca4 A www.gentoo.org CNAME www-cdn.gentoo.org RRSIG CNAME dualstack.n.sni.global.fastly.net RRSIG A 146.75.93.91 OPT
30 13.103341751 192.168.1.254 192.168.1.85 DNS 446 Standard query response 0x049c A www.gentoo.org CNAME www-cdn.gentoo.org RRSIG CNAME dualstack.n.sni.global.fastly.net RRSIG A 146.75.93.91 OPT
31 13.103499498 192.168.1.254 192.168.1.85 DNS 458 Standard query response 0x5f82 AAAA www.gentoo.org CNAME www-cdn.gentoo.org RRSIG CNAME dualstack.n.sni.global.fastly.net RRSIG AAAA 2a04:4e42:87::347 OPT
32 13.103499520 192.168.1.254 192.168.1.85 DNS 458 Standard query response 0xfb4d AAAA www.gentoo.org CNAME www-cdn.gentoo.org RRSIG CNAME dualstack.n.sni.global.fastly.net RRSIG AAAA 2a04:4e42:87::347 OPT
33 13.103571150 192.168.1.85 192.168.1.254 DNS 104 Standard query 0xa497 DNSKEY gentoo.org OPT
34 13.103625864 192.168.1.85 192.168.1.254 DNS 104 Standard query 0x79ed DS gentoo.org OPT
35 13.103806959 192.168.1.85 192.168.1.254 DNS 104 Standard query 0xc687 DNSKEY gentoo.org OPT
36 13.103852346 192.168.1.85 192.168.1.254 DNS 104 Standard query 0x360b DS gentoo.org OPT
37 13.120184523 192.168.1.254 192.168.1.85 DNS 292 Standard query response 0x79ed DS gentoo.org DS RRSIG OPT
38 13.120292607 192.168.1.254 192.168.1.85 DNS 292 Standard query response 0x360b DS gentoo.org DS RRSIG OPT
39 13.120391219 192.168.1.85 192.168.1.254 DNS 97 Standard query 0x9507 DNSKEY org OPT
40 13.120446171 192.168.1.85 192.168.1.254 DNS 97 Standard query 0xb90b DS org OPT
41 13.120554911 192.168.1.85 192.168.1.254 DNS 97 Standard query 0xdbd2 DNSKEY org OPT
42 13.120599784 192.168.1.85 192.168.1.254 DNS 97 Standard query 0xdbca DS org OPT
43 13.209648769 192.168.1.254 192.168.1.85 DNS 937 Standard query response 0x9507 DNSKEY org DNSKEY DNSKEY DNSKEY RRSIG OPT
44 13.209648795 192.168.1.254 192.168.1.85 DNS 937 Standard query response 0xdbd2 DNSKEY org DNSKEY DNSKEY DNSKEY RRSIG OPT
…
76 14.439073584 192.168.1.254 192.168.1.85 DNS 610 Standard query response 0x75c4 DS fastly.net SOA a.gtld-servers.net RRSIG RRSIG NSEC3 RRSIG NSEC3 OPT
77 14.439073612 192.168.1.254 192.168.1.85 DNS 610 Standard query response 0xf195 DS fastly.net SOA a.gtld-servers.net RRSIG RRSIG NSEC3 RRSIG NSEC3 OPT

finally followed by ping requests. Here is the corresponding ping report:

ping -c 4 www.gentoo.org
PING www.gentoo.org (2a04:4e42:87::347) 56 data bytes
64 bytes from 2a04:4e42:87::347: icmp_seq=1 ttl=57 time=293 ms
64 bytes from 2a04:4e42:87::347: icmp_seq=2 ttl=57 time=15.6 ms
64 bytes from 2a04:4e42:87::347: icmp_seq=3 ttl=57 time=16.5 ms
64 bytes from 2a04:4e42:87::347: icmp_seq=4 ttl=57 time=109 ms

--- www.gentoo.org ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 23836ms
rtt min/avg/max/mdev = 15.577/108.645/293.417/113.243 ms

Here is yet another ping record from the misbehaving distribution:

2 1.279769415 2600:1700:dd90:5640::32 2600:1700:dd90:5640::1 DNS 105 Standard query 0xd612 A www.gentoo.org OPT
3 1.279843033 2600:1700:dd90:5640::32 2600:1700:dd90:5640::1 DNS 105 Standard query 0x9f0f AAAA www.gentoo.org OPT
…
18 2.458801610 2600:1700:dd90:5640::1 2600:1700:dd90:5640::32 DNS 202 Standard query response 0x8b58 AAAA www.gentoo.org CNAME www-cdn.gentoo.org CNAME dualstack.n.sni.global.fastly.net AAAA 2a04:4e42:87::347 OPT

and the corresponding ping report:

ping -c 4 www.gentoo.org
ping: www.gentoo.org: Name or service not known

(My skill at interpreting .pcapng files is very limited.)

Any comments or proposals for further diagnostics?