This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

A quick question about lack of ICMP reply in trace

0

Hello

can someone please help me with the following question :)

We have a Windows Server and a NetApp Cluster-Mode iSCSI attached storage (NAS) on the same vLAN

Basically, for want of a better description, one of the interface on the NetApp (one of the LIFs) is not responding (let's just say it's hung).

Therefore when you do a ping (from a Windows command prompt) to the NetApp interface in question (again both on the same subnet) I receive the following

Reply from 172.20.11.249: TTL expired in transit

However, in the Wireshark capture (and I have check I am capturing on the correct interface) there is nothing displayed for ICMP (not a single ICMP packet)

Could it be I am not seeing an ICMP as I am not crossing a router and the interface is just not responding at all and therefore unable to build and ICMP packet of its own to send back?

Any advice most welcome

Thanks Ernie

asked 22 Nov '16, 06:57

EBrant's gravatar image

EBrant
1789
accept rate: 0%


One Answer:

0

If modern versions of Windows cannot find a device on a given interface, it may send the request to the default GW. Is the ping client multihomed? If so, sniff on that interface. You may see ICMP echoes on that interface or ARPs, depending if you are local or not.

So, capture on all interfaces and see what shows.

Finally found a reference to this -

https://blogs.technet.microsoft.com/networking/2009/04/24/source-ip-address-selection-on-a-multi-homed-windows-computer/

Check the section on What about Neighbor Unreachability? and see if it applies to you in this case.

answered 22 Nov '16, 07:01

Bob%20Jones's gravatar image

Bob Jones
1.0k2515
accept rate: 21%

edited 23 Nov '16, 02:40