Host unreachable on my own network?

[JBruyet]

Hey all,
I was doing a network scan and found an address that shouldn't exist in a reserved range of addresses. I did a quick PING test to make sure it was still up so I could NMAP it to find out more about it and received a "Destination host unreachable" response. The address I'm pinging from is 192.168.2.19 and the address I'm pinging is 192.168.2.89. I thought my test machine had been bumped off the network so I tried pinging a different machine and that worked. Here are the results of two ping tests, one successful and one NOT successful (which is the one I'm trying to find out about):

C:\>ping 192.168.2.10

Pinging 192.168.2.10 with 32 bytes of data:

Reply from 192.168.2.10: bytes=32 time<1ms TTL=128
Reply from 192.168.2.10: bytes=32 time=1ms TTL=128
Reply from 192.168.2.10: bytes=32 time<1ms TTL=128
Reply from 192.168.2.10: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.2.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms

C:\>ping 192.168.2.89

Pinging 192.168.2.89 with 32 bytes of data:

Reply from 192.168.2.19: Destination host unreachable.
Reply from 192.168.2.19: Destination host unreachable.
Reply from 192.168.2.19: Destination host unreachable.
Reply from 192.168.2.19: Destination host unreachable.

Ping statistics for 192.168.2.89:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Did anyone else notice that the "Reply from" address is the address that I'm PINGing FROM??? Every address under .100 is a manually applied static address. My DHCP servers start their addresses at .101. Am I overlooking something obvious here? I thought that maybe the .89 device was on a different subnet, but then my network scan wouldn't have picked it up, right? Any help here would be greatly appreciated!

Thanks,

Joe B
(Jobee 1)

 

[burtsbees]

That usually means an access-list blocking echo replies, or maybe Windows Firewall, or maybe even a duplicate address...try changing your IP to something else not in use, and try the ping again and see if the response comes from your own machine again.

Burt

 

[JBruyet]

Nope, I'm still getting the same response. I changed my address from .19 to .20 and retried the PING:

C:\>ping 192.168.2.89

Pinging 192.168.2.89 with 32 bytes of data:

Reply from 192.168.2.20: Destination host unreachable.
Reply from 192.168.2.20: Destination host unreachable.
Reply from 192.168.2.20: Destination host unreachable.
Reply from 192.168.2.20: Destination host unreachable.

Ping statistics for 192.168.2.89:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

I tried PINGing some other addresses to make sure that works and it does. Any other suggestions?

Thanks,

Joe B

 

[gb0mb]

Can you try to ping those and then post your arp table.

It is weird that the ip you ping and the reply ip are different.

Gb0mb

........99.9% User Error........

 

[JBruyet]

Ok, I pinged a couple of addresses and ran ARP -a and here are the results (I didn't PING all those entries, they're just there):


Interface: 192.168.2.20 --- 0x9
Internet Address Physical Address Type
192.168.2.1 00-12-d9-48-e7-89 dynamic
192.168.2.6 00-11-85-5c-73-d4 dynamic
192.168.2.8 00-17-31-58-f6-af dynamic
192.168.2.9 00-11-d8-3e-41-84 dynamic
192.168.2.10 00-17-31-58-f2-ac dynamic
192.168.2.11 00-02-a5-ea-4e-2d dynamic
192.168.2.12 00-18-71-92-79-60 dynamic
192.168.2.13 00-30-c1-9f-e5-80 dynamic
192.168.2.14 00-12-79-ec-42-40 dynamic
192.168.2.15 00-18-fe-3a-c6-c0 dynamic
192.168.2.16 00-0f-20-b7-b3-40 dynamic
192.168.2.17 00-11-0a-fe-3b-e0 dynamic
192.168.2.22 00-0e-0c-9f-f8-4b dynamic
192.168.2.25 00-01-80-0c-43-23 dynamic
192.168.2.26 00-60-38-be-6d-22 dynamic
192.168.2.27 00-60-38-bf-cd-25 dynamic
192.168.2.31 00-12-79-d7-85-bb dynamic
192.168.2.32 00-12-79-d6-38-19 dynamic
192.168.2.33 00-12-79-d5-b5-0d dynamic
192.168.2.34 00-16-76-2d-be-52 dynamic
192.168.2.35 00-16-76-22-7f-45 dynamic
192.168.2.37 00-16-17-85-ad-f1 dynamic
192.168.2.38 00-19-bb-33-ad-ba dynamic
192.168.2.41 00-12-17-7a-7a-6e dynamic
192.168.2.42 00-12-17-6d-34-ff dynamic
192.168.2.43 00-16-b6-52-cf-36 dynamic
192.168.2.44 00-16-b6-5c-26-98 dynamic
192.168.2.45 00-18-39-40-82-5b dynamic
192.168.2.51 00-d0-d9-05-cf-5d dynamic
192.168.2.71 00-17-a4-6b-77-82 dynamic
192.168.2.81 00-12-4e-01-42-c4 dynamic
192.168.2.102 00-03-47-af-83-36 dynamic
192.168.2.103 00-11-d8-3e-40-e3 dynamic
192.168.2.104 00-15-f2-3f-ea-4b dynamic
192.168.2.106 00-11-d8-3e-49-11 dynamic
192.168.2.107 00-15-f2-3f-4e-66 dynamic
192.168.2.108 00-11-d8-08-b3-4e dynamic
192.168.2.109 00-11-d8-08-b4-3d dynamic
192.168.2.111 00-0e-0c-b2-53-49 dynamic
192.168.2.114 00-11-d8-08-7c-25 dynamic
192.168.2.116 00-15-f2-41-d8-34 dynamic
192.168.2.117 00-11-d8-08-80-5d dynamic
192.168.2.118 00-11-d8-3e-41-58 dynamic
192.168.2.119 00-11-d8-08-7c-16 dynamic
192.168.2.120 00-03-47-af-83-35 dynamic
192.168.2.121 00-03-47-af-83-38 dynamic
192.168.2.122 00-0e-a6-4f-7c-ca dynamic
192.168.2.123 00-11-d8-3e-41-9e dynamic
192.168.2.125 00-15-f2-3f-4e-5a dynamic
192.168.2.126 00-11-d8-3e-41-88 dynamic
192.168.2.129 00-02-b3-64-62-0b dynamic
192.168.2.130 00-15-f2-41-d8-32 dynamic
192.168.2.131 00-15-f2-41-d8-36 dynamic
192.168.2.132 00-15-f2-3f-ea-af dynamic
192.168.2.133 00-17-f2-01-bb-25 dynamic
192.168.2.134 00-0e-a6-4f-7c-c4 dynamic
192.168.2.135 00-0e-0c-b2-51-9d dynamic
192.168.2.137 00-15-f2-3f-4e-63 dynamic
192.168.2.138 00-0e-a6-4f-7c-c2 dynamic
192.168.2.141 00-0e-a6-4f-7c-cc dynamic
192.168.2.142 00-15-f2-41-d8-41 dynamic
192.168.2.143 00-15-f2-3f-4e-4c dynamic
192.168.2.147 00-0c-6e-e6-ab-be dynamic
192.168.2.148 00-11-d8-08-7c-13 dynamic
192.168.2.149 00-c0-4f-5e-3c-c2 dynamic
192.168.2.151 00-0c-f1-da-d2-03 dynamic
192.168.2.153 00-1a-92-55-fa-aa dynamic
192.168.2.154 00-15-f2-3f-ea-4c dynamic
192.168.2.155 00-c0-85-2f-5e-e1 dynamic
192.168.2.156 00-0e-a6-4f-7c-d2 dynamic
192.168.2.162 00-60-08-91-36-f4 dynamic
192.168.2.176 00-03-47-39-6c-bc dynamic
192.168.2.180 00-15-f2-41-d8-58 dynamic
192.168.2.183 00-15-f2-41-d8-35 dynamic
192.168.2.185 00-03-47-af-83-3c dynamic
192.168.2.216 00-10-5a-0d-4f-6d dynamic
192.168.2.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static

This really has me stumped. AND, the only IP address that gives me the problem is the .89 address. What's up with that? My network device is a Lenovo ThinkPad running Vista Business. I have very little experience with Vista but I can't see that Vista would cause this.

Joe B

 

[gb0mb]

Don't ever underestimate the things Vista can do lol.

This is weird I expected double entries.

Gb0mb

........99.9% User Error........

 

[JBruyet]

This is a bit of a reach, but would it be possible for a program to add its own IP address to the NIC in my laptop and the address not show up in IPCONFIG?

And FWIW, I tried PINGing the .89 address from another workstation and I got the expected "Request timed out" responses. So whatever the problem is it's just with my laptop. Not very encouraging since I do all of my security scanning with it.

Thanks,

Joe B

 

[brianinms]

Security Scanning with Vista?!?!?! What apps are supported on Vista? On a side note something is jacked with your box if you have that many arp entries and didnt just communicate will all the boxes. Do you have VMware or Virtal PC installed? Try an arp -d and ping again.

 

[JBruyet]

Well, the laptop is fairly new but so far I've used Colasoft's Capsa, NMAP (being sure to use "Run As" on the Command Prompt and use Administrator), Ethereal, SpiceWorks (more inventory than diagnostic utility), I guess that's it for now. I've downloaded some other software programs but haven't had a chance to get them installed and see if they're of any value to me.

And as to the large number of entries in the ARP cache, my guess is it was from the SpiceWorks software. I was leaving that running so I could make sure all of my workstations could be accessed by it.

Joe B

 

[JBruyet]

Ok, I had some more time to work on this but when I try to PING that .89 address now I get a normal "Request timed out" message. I'm not sure why it did what it did, and I'll check it from time to time to see if the problem returns, but for now it's working like it's supposed to.

Sheesh,

Joe B

 

[pansophic]

I'm sure that when you check your arp table now, you will see .89 in the table. The difference between Host Unreachable and Request timed out is whether the initial ARP request gets a response (or the host is in the arp cache). For a host on the local network that means that the machine that you are pinging must be turned on, connected to the network and responding to ARP (who has) requests. For a machine that is not on the local network, you just need to have the gateway device responding.

You should be able to recreate the Host Unreachable response by disconnecting .89 and flushing the arp cache on your machine.


pansophic