Why is ping6 using IPv4 socket?

Question

I enabled IPv6 in a CentOS 7 server and everything is working as expected, except for ping6: it is showing 3-5 delays between requests (but the RTT is fine):

$ ping6 www.google.com
<...5 sec...>
PING www.google.com(2607:f8b0:4002:c09::69) 56 data bytes
<...5 sec...>
64 bytes from 2607:f8b0:4002:c09::69: icmp_seq=1 ttl=55 time=21.1 ms
<...5 sec...>
64 bytes from 2607:f8b0:4002:c09::69: icmp_seq=2 ttl=55 time=21.2 ms
<...5 sec...>
64 bytes from 2607:f8b0:4002:c09::69: icmp_seq=3 ttl=55 time=21.1 ms
<...5 sec...>
64 bytes from 2607:f8b0:4002:c09::69: icmp_seq=4 ttl=55 time=21.1 ms
<...5 sec...>
64 bytes from 2607:f8b0:4002:c09::69: icmp_seq=5 ttl=55 time=21.2 ms
<...5 sec...>
^C64 bytes from 2607:f8b0:4002:c09::69: icmp_seq=6 ttl=55 time=21.1 ms

--- www.google.com ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 25216ms
rtt min/avg/max/mdev = 21.119/21.183/21.251/0.043 ms

I then ran it through strace (strace ping6 www.google.com) and I can see it first gets a timeout trying to ping the IPv4 address then moves on to open a IPv6 socket and succeeds:

socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
gettimeofday({1415215545, 657352}, NULL) = 0
poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
sendto(4, "\2721\1\0\0\1\0\0\0\0\0\0\3www\6google\3com\0\0\34\0\1", 32, MSG_NOSIGNAL, NULL, 0) = 32
poll([{fd=4, events=POLLIN}], 1, 5000)  = 0 (Timeout)
socket(PF_INET6, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 5
connect(5, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8844", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
gettimeofday({1415215550, 663174}, NULL) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\2721\1\0\0\1\0\0\0\0\0\0\3www\6google\3com\0\0\34\0\1", 32, MSG_NOSIGNAL, NULL, 0) = 32
poll([{fd=5, events=POLLIN}], 1, 3000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [60])                = 0
recvfrom(5, "\2721\201\200\0\1\0\1\0\0\0\0\3www\6google\3com\0\0\34\0\1"..., 1024, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8844", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 60

Shouldn't ping6 look up AAAA records and open IPv6 address exclusively? Why is this happening?

Answer 1

Your strace output shows that ping6 is trying to make DNS requests to find the IP address of www.google.com.

The first DNS request is being directed to 209.244.0.3, which is resolver1.level3.net. This DNS request timed out after five seconds, at which time it falls back to the second DNS server, 2001:4860:4860::8844. This server returned a DNS response almost immediately.

How this got into your system's configuration, I don't know, though it may have been placed there by your service provider when they provisioned the machine for you. If you aren't on their network, the DNS server might not provide service to you.

Your system's DNS servers will be listed in /etc/resolv.conf. You can edit and correct them there, after verifying with your service provider that the DNS servers you are using are correct and functional.