Totally Weird Problem: Can Access Internet But Cannot Ping It

[Arsynic]

Out of six nodes in my WAN two of them have been giving me a headache. I noticed that their respective Netware servers have been falling out of sync. So I pinged the time source locally and it was still up. I then tried to ping the same time source remotely from the server and I got no response? So something must be wrong with the Netware server right? Well, I tried to isolate that by attempting to ping that time source from a Terminal Server on the same node. Timeouts all the way through. So I try to ping "

http://www.microsoft.com".

Timeouts. I then tried to ping another server from the WAN and guess what, it responds. I thought I had seen it all. Is it a problem with connecting to the Internet? Nope. I fired up the browser on the Terminal Server and I was able to browse to my hearts content. I even browsed by IP address instead of URL and it worked. So here's what I gathered:

--I can communicate with the Internet from both nodes.
--Both nodes are connected to the WAN via IDSN.
--I can ping all computers within the WAN with no problem.
--I can surf the net on the problem nodes.
--Both nodes started exhibiting the same problem at the same time.
--Both nodes have the same firewall hardware (but so does 4 other nodes).

The only thing I can come up with that intersects both sites is the IDSN. If they have the same ISP then maybe that's the problem. But if you guys can think of anything, please let me know.

 

[bcastner]

Because of Denial of Service attacks many sites, and many routers, are refusing to carry ICMP traffic.

It is sad, but a ping test has become an iffy proposition unless you test an external site that you know will respond reliably to a ping request.

Consider using Tracert instead of ping.

 

[Arsynic]

Tracerts produce timeouts as well. Thanks for reminding me to mention that.

 

[bcastner]

As the ISPs involved. Is tracert showing the timeouts on the inter-router side, or at the far end?

 

[Arsynic]

I can't tell.

It's like:

1 * * * * Request timed out.

2 * * * * Request timed out.

...and so on.

 

[bcastner]

The first hop should be your router. (Is it blocking ICMP traffic?)

The second hop is then unreachable.

This strongly suggests a firewall setting on either the server or the router.

 

[Arsynic]

The ISP just called me and said that they changed their core router. We have a lot of that info hard coded into the firewall so that may be the problem...or not. We'll see.

 

[bcastner]

Sounds like you are on the right track.

Best,
Bill Castner

 

[johnnybgud]

http://www.yahoo.com

is pingable