icmp failure problem?

[Vincent Fox]

I have recently attempted to use monit in it's simplest role, just as a
ping monitoring utility to ensure hosts are alive. So far my setup is
useless for even something this basic due to noise generated about
hosts being down when they are not.

I keep seeing certain hosts as down, while a ping session running in
another terminal window goes along perfectly. Some tcpdump output:

address@hidden ~]# tcpdump -i eth2 -vv icmp
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes
15:07:11.749618 IP (tos 0x0, ttl 255, id 0, offset 0, flags [DF], proto 1,
length: 28) gw-blue > state1219-ap: icmp 8: echo request seq 0
15:07:11.750207 IP (tos 0x0, ttl  64, id 11732, offset 0, flags [none],
proto 1, length: 28) state1219-ap > gw-blue: icmp 8: echo reply seq 0
15:07:11.750578 IP (tos 0x0, ttl 255, id 0, offset 0, flags [DF], proto 1,
length: 28) gw-blue > atlantic1209-ap: icmp 8: echo request seq 0
15:07:11.750632 IP (tos 0x0, ttl 255, id 1, offset 0, flags [DF], proto 1,
length: 28) gw-blue > atlantic1209-ap: icmp 8: echo request seq 256
15:07:11.752357 IP (tos 0x0, ttl  64, id 41561, offset 0, flags [none],
proto 1, length: 28) atlantic1209-ap > gw-blue: icmp 8: echo reply seq 0
15:07:11.753031 IP (tos 0x0, ttl  64, id 41562, offset 0, flags [none],
proto 1, length: 28) atlantic1209-ap > gw-blue: icmp 8: echo reply seq 256

It looks like the sequence numbers are getting jumbled, and I cannot pin
down why. Can anyone suggest additional diagnostic steps I could take?

The monit server is a Fedora Core 4 box. I have tried monit 4.7 using both
raw source code and RPM's I found, with same results.

I notice that a normal ping command from same server shows normal output:
15:08:03.387657 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto 1,
length: 84) gw-blue > atlantic1209-ap: icmp 64: echo request seq 0
15:08:03.389486 IP (tos 0x0, ttl  64, id 41563, offset 0, flags [none],
proto 1, length: 84) atlantic1209-ap > gw-blue: icmp 64: echo reply seq 0