Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So, I have a Site to Site VPN from my Main office (192.168.0.x - Cincinnati) to my branch office (192.168.1.x - Chicago).

I was having some issues that prompted me to add domain controller at Chicago to remedy my problems. (DNS speed, and occasional logon issues)

The problem I am having is the server in Chicago ( is receiving DNS responses from the Cincinnati server ( but it is either denying/dropping them and I have no clue what is going on.

Below are links to screen shots of packet captures. The one screenshot is from Wireshark and it shows that the server is receiving the DNS responses. The other screenshot is from Microsoft Network Monitor (3.4) and it is showing that it is sending DNS queries, but not receiving any responses.

I appreciate any help you can give me.

share|improve this question
What is doing the VPN connectivity between Cincinnati and Chicago? Could an edge device (firewall) be preventing the inbound VPN replies? DNS is a UDP-based protocol, so a stateful firewall is required to open a pinhole for the reverse traffic. – jimbobmcgee Aug 13 '12 at 17:18
The VPN is an IPsec VPN between a cisco concentrator and a sonicwall tz210. I know the only proof I posted is a pcap, but I am 90% sure that the traffic is getting to the server... but the server is not accepting it. I have been on a Microsoft forum if this helps you think of anything...… – user131991 Aug 13 '12 at 18:03
Can you set up syslogging on the Cisco/Sonicwall devices (and any edge firewalls in the network stack) and point them at a common syslog receiver? This should give you a straightforward logical trail to determine whether connections are being dropped by any intermediary device. Otherwise, you are going to have to pcap each device interface and analyse those to determine where the packets are dropped. – jimbobmcgee Aug 13 '12 at 18:18
I have done both of those exactly with the exact same result... they are passing through everything and stop at the server in Chicago. I just made a little progress... it is for sure something with the MS server. The link I posted last comment is slowing taking me a few directions – user131991 Aug 13 '12 at 19:06
What filter did you use on your Wireshark screenshots? Was it an ip.addr-based filter or a udp.port-based filter? – jimbobmcgee Aug 14 '12 at 8:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.