This is our old Q&A Site. Please post any new questions and answers at

I have an odd situation --- |Svr02| --- --- |Srv01| ---

When I ping and from Srv01 I can see the echo requests and echo replies are received and the pings report as successful.

When I ping and from Srv02 only sends the echo replies.

When doing a wireshark trace I can see the failing ping request from Srv02 goes like this

  • echo request sent out of
  • interface echo request recieved on
  • Then however, I see no attempt on Srv01 to send an echo reply on any interface

Why could this be?

asked 09 Nov '15, 10:47

wshark_man_123's gravatar image

accept rate: 0%

edited 09 Nov '15, 12:29

You haven't stated whether the icmp echo requests from Srv01 are sent from or I would suspect some firewall to block icmp on the interface of srv01. What happens if you shut down and try to ping from Srv02?

permanent link

answered 09 Nov '15, 12:47

sindy's gravatar image

accept rate: 24%

I can see Windows Firewall drops inbound for the failed pings which is why no echo reply is being generated.

(09 Nov '15, 23:36) wshark_man_123

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).

(10 Nov '15, 00:24) Kurt Knochner ♦

So my assumption was correct and according to the principles of the site you should mark my answer as correct/helpful.

If the behaviour seems weird to you: libpcap (Wireshark) is hooked as close as possible to the hardware so it gets any incoming packet before the Windows firewall. So you can see incoming packets dropped by the firewall in the capture but they don't reach higher levels of the protocol stack because the firewall drops them. For sent packets, however, the same arrangement means that if an application sends a packet but the firewall drops it, the packet does not reach libpcap and so you won't see it in the capture. This would hardly happen in case of icmp but it does happen for application protocols.

(10 Nov '15, 00:33) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 09 Nov '15, 10:47

question was seen: 3,989 times

last updated: 10 Nov '15, 00:33

p​o​w​e​r​e​d by O​S​Q​A