Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a simple question that I'm trying to wrap my head around. I know this requires knowledge of my internal network, but at a glance, what do you guys think..

I cannot ping a host in my network (nor can I arping the host), however nmap can detect the host.

Does this mean I have connectivity to the host? Or am I dead in the water?

I have a route to the host in my routes, and iptables is disabled on my server (rhel6).

192.168.6.0     0.0.0.0         255.255.255.128 U     0      0        0 bond2

--- 192.168.6.5 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5212ms

--- 192.168.6.6 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1097ms

Nmap scan report for mdc001 (192.168.6.5)
Host is up (0.00017s latency).
MAC Address: 12:34:56:78:90:AB (Hewlett Packard)
Nmap scan report for mdc002 (192.168.6.6)
Host is up (0.00018s latency).
MAC Address: 12:34:56:78:90:AB (Hewlett Packard)

(MAC's modified for obscurity).

What gives? Am I able to communicate with the host or not? Also, there were link-local routes for the interface on that network (bond2), but I removed them just in case.

Diego

share|improve this question
add comment

3 Answers

You might have a device which is not configured to provide an ICMP echo response (the device replying PONG to your PING in essence). That doesn't mean that it isn't there, and NMAP can use other indicators to decide whether or not a device is really 'UP' or not.

One example would be a 'TCP ping'. In this case NMAP would send a SYN or an ACK packet to a TCP port and see if it responds (NMAP will try Port 80 first according to the documentation), if there is a service listening on the device, it will respond to NMAP's request (thus giving away the fact that the device is really there).

share|improve this answer
    
Are the hosts that get a ping response from mdc001 on the same subnet & vlan as the host that does not get a response? Also, are the hosts that do get a response using RHEL too or another operating system? –  leftcase Apr 22 '12 at 14:26
    
MDC001 is actually rhel5. Thankfully, these systems are on hp c7000 chassis. I double-checked the vlan configuration in the mezzanine/vc-flex10 interconnect info, and it turned out I had the wrong vlan configured on the interface I was using (these are the backup vlan's, not the primary interface). Now that I have the correct vlan configured on the interfaces, not only can I ping the metadata controller, I can see several hundred more hosts via nmap. Thanks again for all the help guys. Now that the vlan's are correct, I can mount the stornext filesystem without a hitch. –  slugman Apr 22 '12 at 16:03
    
Awesome. Glad you got it sorted. :-) –  leftcase Apr 22 '12 at 20:20
add comment

Nmap scans for other services than just ICMP to detect if a host is up or not.

share|improve this answer
    
Thanks Lucas, I usually used ping as my net test, I'm trying to familiarize myself more with nmap. I'll try connecting to the host and see what happens. –  slugman Apr 21 '12 at 22:19
add comment

I'm not sure why I didn't realize this earlier, but what you said makes compete sense Leftcase.

The thing is, I thought perhaps the server I was trying to contact may have disabled acknowledging incoming icmp rquests

Turns out that is not true. I can ping the mdc001 host from several other members inside the lan. My rhel6 server is the only one which can't communicate to mdc001.

I know I'm missing something, I just can't think what. This mdc001 host is a metadata controller, I need it in order to mount a stornext filesstem

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.