1

I have a simple question that I'm trying to wrap my head around. I know this requires knowledge of my internal network, but at a glance, what do you guys think..

I cannot ping a host in my network (nor can I arping the host), however nmap can detect the host.

Does this mean I have connectivity to the host? Or am I dead in the water?

I have a route to the host in my routes, and iptables is disabled on my server (rhel6).

192.168.6.0     0.0.0.0         255.255.255.128 U     0      0        0 bond2

--- 192.168.6.5 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5212ms

--- 192.168.6.6 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1097ms

Nmap scan report for mdc001 (192.168.6.5)
Host is up (0.00017s latency).
MAC Address: 12:34:56:78:90:AB (Hewlett Packard)
Nmap scan report for mdc002 (192.168.6.6)
Host is up (0.00018s latency).
MAC Address: 12:34:56:78:90:AB (Hewlett Packard)

(MAC's modified for obscurity).

What gives? Am I able to communicate with the host or not? Also, there were link-local routes for the interface on that network (bond2), but I removed them just in case.

Diego

Improve this question

3 Answers 3

Reset to default
4

You might have a device which is not configured to provide an ICMP echo response (the device replying PONG to your PING in essence). That doesn't mean that it isn't there, and NMAP can use other indicators to decide whether or not a device is really 'UP' or not.

One example would be a 'TCP ping'. In this case NMAP would send a SYN or an ACK packet to a TCP port and see if it responds (NMAP will try Port 80 first according to the documentation), if there is a service listening on the device, it will respond to NMAP's request (thus giving away the fact that the device is really there).

Improve this answer
3
  • Are the hosts that get a ping response from mdc001 on the same subnet & vlan as the host that does not get a response? Also, are the hosts that do get a response using RHEL too or another operating system?
    – leftcase
    Apr 22, 2012 at 14:26
  • MDC001 is actually rhel5. Thankfully, these systems are on hp c7000 chassis. I double-checked the vlan configuration in the mezzanine/vc-flex10 interconnect info, and it turned out I had the wrong vlan configured on the interface I was using (these are the backup vlan's, not the primary interface). Now that I have the correct vlan configured on the interfaces, not only can I ping the metadata controller, I can see several hundred more hosts via nmap. Thanks again for all the help guys. Now that the vlan's are correct, I can mount the stornext filesystem without a hitch.
    – slugman
    Apr 22, 2012 at 16:03
  • Awesome. Glad you got it sorted. :-)
    – leftcase
    Apr 22, 2012 at 20:20
3

Nmap scans for other services than just ICMP to detect if a host is up or not.

Improve this answer
1
  • Thanks Lucas, I usually used ping as my net test, I'm trying to familiarize myself more with nmap. I'll try connecting to the host and see what happens.
    – slugman
    Apr 21, 2012 at 22:19
0

I'm not sure why I didn't realize this earlier, but what you said makes compete sense Leftcase.

The thing is, I thought perhaps the server I was trying to contact may have disabled acknowledging incoming icmp rquests

Turns out that is not true. I can ping the mdc001 host from several other members inside the lan. My rhel6 server is the only one which can't communicate to mdc001.

I know I'm missing something, I just can't think what. This mdc001 host is a metadata controller, I need it in order to mount a stornext filesstem

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .