Server 2012 intermittently fails to respond to pings from single host, even with firewall disabled, but responds to non-ICMP requests fine
- by James Westbury
This one is kind of weird. I've got the following machines involved:
DC01 - 10.1.2.42, Server 2012, domain controller & DNS server, physical machine
nagiosv - 10.1.2.35, CentOS 6.4, Nagios, virtual machine
CB01 - 10.1.3.81, Ubuntu 12.04 LTS, couchbase server, virtual machine
So, I noticed something was wrong while configuring this new Nagios VM. I started seeing DC01's state flapping. I logged into nagiosv when I saw this happening, and attempted to ping DC01, both by FQDN and its IP address. Neither worked. I tried pinging the machine from CB01, which is another VM on the same virtual switch/physical NIC as nagiosv, and that worked fine. Pings still failing from nagiosv at this time.
DC01 is also an internal DNS server, so I ran dig google.com from nagiosv, and was able to run a query against DC01 just fine:
;; Query time: 1 msec
;; SERVER: 10.1.2.42#53(10.1.2.42)
;; WHEN: Fri Nov 1 07:53:51 2013
;; MSG SIZE rcvd: 204
Pings still failing from nagiosv, though. I can ping from DC01 to nagiosv, and that works, and I can still ping from other VMs on the same physical NIC into DC01, and that works. I should mention at this point that I've disabled the firewall on DC01 for testing purposes, and it doesn't make a damned bit of difference. (Even with the firewall enabled, I have a blanket exception for ICMP from the local subnet, so it shouldn't make a difference, but I figured I should test it anyway.)
I loaded up Wireshark on DC01 and pinged it from nagiosv again. What I see is a bunch of echo requests coming in and not a single reply going back out. Filtered results here, showing all ICMP traffic during a 15-second period.
A few more bits of info: There are no IP conflicts on the network. MAC addresses on the incoming pings match the MAC on the VM. There are no duplicate MACs on the network, as far as I can see.
I have absolutely no idea why DC01 is failing to respond, here. Any ideas?
