Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was wondering if someone would be able to help me with a head scratcher. We have a device that has communicated with our server but is not sending back any data.

I am able to ping the IP address which pings successfully but when I do a netstat on the machine the IP address is not listed.

Why would this be? How can an IP address be pingable but not connected? Are there any other tools I could use to help me diagnose this issue?

Update:

Sorry for using the comments below. I didn't realize I could edit my own post!!

EightBitTony, I think I see what your getting at when you say: "netstat -a shows connected machines, not just the ip address of every machine anywhere".

This outstation device's only job is to come online and send data to our servers. The Ip Address of the device is: 10.113.201.155 and the port number it should connect to is: 6102.

When I do a netstat I was expecting it to be connected to this port number (6102) but it is not. 6102 is the port the server software listens on.

This outstation has not sent back any data now for the last 2 days which is the problem we are experiencing yet it is pingable suggesting it is online. Unfortunately this device is not located in an office anywhere where I could simply reset it.

We are going to have to send a maintenance team out but I wanted to better understand what is going on and why this is happening.

I have another question. If the outstation comes online but does not bind to the port 6102 will it not be shown in netstat? I think I know the answer here (no).

Update 2:

Thank you EightBitTony. You have explained that perfectly to me and I understand what you mean. After reading your answer I believe that the application has in some way failed on that machine and is in some kind of crashed state.

I tried to "up" your answer but do not have enough rep points!!

share|improve this question
    
For what it's worth, it's not uncommon for a Windows machine to hang during during shutdown in a state where it'll respond to a ping but nothing useful is running. Interestingly, this state is most often triggered by allowing updates to perform the reboot. –  John Gardeniers Aug 22 '11 at 21:34

2 Answers 2

You can ping any IP address anywhere that network routing and firewalls allow, but that doesn't mean it's connected to your computer and so won't show up in netstat.

Netstat shows which TCP ports have got active connections (i.e. machines connected, not just machines which might or which used to connect). Ping uses ICMP (sometimes UDP) and doesn't rely on TCP ports.

In your case, it sounds like the application is not connecting but the operating system is still up and running, so you can ping the machine (because that's the OS responding), but the application can't connect to your server either because it's not running, or because it's got other issues.

If you can't connect back to it remotely and log in to check the app you'll need to send someone to it.

You also asked,

I have another question. If the outstation comes online but does not bind to the port 6102 will it not be shown in netstat? I think I know the answer here.

We don't know what OS or application this 'outstation' is running, but it's applications which connect to ports, and yet it's operating systems (or rather, components of those operating systems) which bring up and manage the network. So if you application connects, yes you'll see it. But if the outstation boots and brings up the network it won't do anything until the running application tries to do anything, if it crashes, then you'll see nothing at your end. Network and application are separate.

Last example, assuming your computer can connect to the internet, you can ping www.google.com but it doesn't mean www.google.com has ever tried to connect to your computer.

share|improve this answer
    
Firstly, thank you for your prompt replies EightBitTony and RainyRat. Okay so this is a device that is communicating over the GPRS network (using a Wavecom modem). To give you a bit of background info we collect data from this remote site. There is an outstation that sits behind the wavecom modem and sends data back to our servers. You are right, I can ping this address from any machine on our network but the device only connects to 1 of 2 servers here (which are Windows 2008 R2 servers) and I have remote desktop'd onto both of these servers which is where I issued the netstat command. –  Adrian Aug 22 '11 at 13:17
    
I was under the impression that if the IP address is connected on the network that it should be listed via netstat. As far as I am aware the comms channel that data should be comming on should be TCP/IP. The command I was running for netstat was: "netstat -n >D:\Temp\ip.txt" but I will try the -p icmp flag to see what I get. I have never heard of the "ARP" command before so I will also run this command on the server to see what I get also. –  Adrian Aug 22 '11 at 13:17
    
The Ip Address of the device is: 10.113.201.155. The port number it should connect to is: 6102 –  Adrian Aug 22 '11 at 13:18
    
netstat -a shows connected machines, not just the ip address of every machine anywhere. If the remote device drops the connection, then after a short period it'll drop off netstat -a. What's the actual problem you're trying to resolve. (Put it in your question above, not as a comment please). –  EightBitTony Aug 22 '11 at 13:41

What options are you using for netstat? If you want to catch ICMP traffic, you'll need to add -p icmp to your command line. You may not see the device's address in your netstat output (EightBitTony's answer tells you why), but if communication has occurred successfully between the two hosts then its IP address should be in the server's ARP cache; a swift arp -a will tell you that, assuming both hosts are in the same subnet.

You may also get more useful information by using Wireshark or something of the kind to catch the application traffic arriving at your server from the device instead.

share|improve this answer
    
Won't the arp cache only work if it's on the same subnet? –  EightBitTony Aug 22 '11 at 11:31
    
Yes, good point - have edited response appropriately. –  RainyRat Aug 22 '11 at 11:38
    
On Windows, "nbtstat -A ip.addr" will return the hostname and MAC address even across subnets. –  jftuga Aug 22 '11 at 12:39
    
Only if it's a NetBIOS-speaking host. But yes. –  RainyRat Aug 22 '11 at 13:16
    
The command I was running for netstat was: "netstat -n >D:\Temp\ip.txt" but I will try the -p icmp flag to see what I get. I have never heard of the "ARP" command before so I will also run this command on the server to see what I get also. –  Adrian Aug 22 '11 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.