Ping Issue on Windows Server 2003

I I'm having an unusual issue with my Terminal Server.

First, workstations have a problem establishing connections to the
server. A ping session to the server goes like this:

ping 10.1.1.80 /t
0 one initial reply, then after a pause, "Request Timed Out"
1 continues 20 - 100+ "request timed out"
2 begins to receive consistent replys (with no pause)
3 if left to ping, will ping with replies indefinitely with no loss of
connection
4 If ping is stopped, after approx. 10 minutes, the ping will go back to
state 0



Other considerations:

The server can ping itself without any problems

all networking to the TS server is affected similarly as ping (TS and
NetBios)

the ping reply may happen if the ping is stopped when still timing out
and restarted (ie, ping -> pause -> time out -> ctrl-c -> wait ~60 sec
-> ping -> reply)

these events seems to be independent of workstation, that is, a computer
establishing a ping doesn't effect another computer establishing a ping.

The server can ping any other computer on the network without problems.

The other servers plugged into the network beside the TS server
similarly cannot ping the TS server

Workstations can ping the other servers beside the TS server without
problems

Ping 10.1.1.80 /t Sample:

Pinging 10.1.1.80 with 32 bytes of data:

Reply from 10.1.1.80: bytes=32 time<10ms TTL=128
(immediate response, and then pauses for 2-3 sec)
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
....
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 10.1.1.80: bytes=32 time<10ms TTL=128
Reply from 10.1.1.80: bytes=32 time<10ms TTL=128
Reply from 10.1.1.80: bytes=32 time<10ms TTL=128
Reply from 10.1.1.80: bytes=32 time<10ms TTL=128
....

Ping statistics for 10.1.1.80:
Packets: Sent = 76, Received = 11, Lost = 65 (85% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
Control-C


Here's the output from ipconfig /all on

Windows IP Configuration

Host Name . . . . . . . . . . . . : xxxx-xx-xxx-ts1
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 4:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : ATI AT-2500TX PCI Fast Ethernet
Adapter
Physical Address. . . . . . . . . : 00-xx-xx-xx-xx-00
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.1.1.80
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.1.1.1
DNS Servers . . . . . . . . . . . : 10.1.1.50


Here's the output from another server beside this one:
Windows IP Configuration

Host Name . . . . . . . . . . . . : xxxx-xx-sqlsvr
Primary Dns Suffix . . . . . . . : Metis.org
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Metis.org

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 CT Network
Connection
Physical Address. . . . . . . . . : 00-xx-xx-xx-xx-xx
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.1.1.90
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.1.1.1
DNS Servers . . . . . . . . . . . : 10.1.1.50

As an update, I've determined that changing the IP address of the
computer to 10.1.1.81 resolves the ping issue, but .80 continues to
cause problems. Any ideas?

Jason

Jason wrote:
> I I'm having an unusual issue with my Terminal Server.
>
> First, workstations have a problem establishing connections to the
> server. A ping session to the server goes like this:
>
> ping 10.1.1.80 /t
> 0 one initial reply, then after a pause, "Request Timed Out"
> 1 continues 20 - 100+ "request timed out"
> 2 begins to receive consistent replys (with no pause)
> 3 if left to ping, will ping with replies indefinitely with no loss
> of connection
> 4 If ping is stopped, after approx. 10 minutes, the ping will go back
> to state 0
>

On Thu, 17 Aug 2006 17:37:14 -0600, Jason wrote in
microsoft.public.windows.server.networking:

>As an update, I've determined that changing the IP address of the
>computer to 10.1.1.81 resolves the ping issue, but .80 continues to
>cause problems. Any ideas?

Could there be another device on the network with an address 10.0.1.80?

To test, disconnect the TS from the network (or disable the network
card), and ping that address from some other machine? Do you get a
response?

--
Michael Bednarek http://mbednarek.com/ "POST NO BILLS"

I searched last night after finding the address .80 was not the problem.
No other device responds to .80, however it is possible that the device
consuming .80 isn't responding to ping.

I am performing additional tests to narrow the problem on .80 to the
server or LAN

Michael Bednarek wrote:
> On Thu, 17 Aug 2006 17:37:14 -0600, Jason wrote in
> microsoft.public.windows.server.networking:
>
>> As an update, I've determined that changing the IP address of the
>> computer to 10.1.1.81 resolves the ping issue, but .80 continues to
>> cause problems. Any ideas?
>
> Could there be another device on the network with an address 10.0.1.80?
>
> To test, disconnect the TS from the network (or disable the network
> card), and ping that address from some other machine? Do you get a
> response?
>

The issue is definitely that there is "something" telling windows that
..80 is unavailable on the network. Setting any NIC on any computer to
..80 results in the "address in use" message.

So the address .80 appears to be in use somewhere on the network,
excepts that I am unable to locate the device through pings or
portscans. Can anyone offer any advice about tracking down the source to
this problem?

I can force the server to use .80 as well, and the server eventually
does respond to pings on .80.



Michael Bednarek wrote:
> On Thu, 17 Aug 2006 17:37:14 -0600, Jason wrote in
> microsoft.public.windows.server.networking:
>
>> As an update, I've determined that changing the IP address of the
>> computer to 10.1.1.81 resolves the ping issue, but .80 continues to
>> cause problems. Any ideas?
>
> Could there be another device on the network with an address 10.0.1.80?
>
> To test, disconnect the TS from the network (or disable the network
> card), and ping that address from some other machine? Do you get a
> response?
>

Just for the sake of completeness here ...

Further investigation shows that the MAC address entries under ARP -a
10.1.1.80 change between immediately right after the ping and when the
server finally answers. Creating static ARP entries on the workstations
for 10.1.1.80 solved the problem immediately (band aid solution).

The offending device was found to be a misconfigured firewall that
someone introduced on the network. I have to locate and purge the
incorrect ARP entries from our networking appliances, and that may yet
take some time, but I feel I have things under control now.


Jason wrote:
> The issue is definitely that there is "something" telling windows that
> .80 is unavailable on the network. Setting any NIC on any computer to
> .80 results in the "address in use" message.
>
> So the address .80 appears to be in use somewhere on the network,
> excepts that I am unable to locate the device through pings or
> portscans. Can anyone offer any advice about tracking down the source to
> this problem?
>
> I can force the server to use .80 as well, and the server eventually
> does respond to pings on .80.
>
>
>
> Michael Bednarek wrote:
>> On Thu, 17 Aug 2006 17:37:14 -0600, Jason wrote in
>> microsoft.public.windows.server.networking:
>>
>>> As an update, I've determined that changing the IP address of the
>>> computer to 10.1.1.81 resolves the ping issue, but .80 continues to
>>> cause problems. Any ideas?
>>
>> Could there be another device on the network with an address 10.0.1.80?
>>
>> To test, disconnect the TS from the network (or disable the network
>> card), and ping that address from some other machine? Do you get a
>> response?
>>

On Mon, 21 Aug 2006 11:12:13 -0600, Jason wrote in
microsoft.public.windows.server.networking:

>Just for the sake of completeness here ...
>
>Further investigation shows that the MAC address entries under ARP -a
>10.1.1.80 change between immediately right after the ping and when the
>server finally answers. Creating static ARP entries on the workstations
>for 10.1.1.80 solved the problem immediately (band aid solution).
>
>The offending device was found to be a misconfigured firewall that
>someone introduced on the network. I have to locate and purge the
>incorrect ARP entries from our networking appliances, and that may yet
>take some time, but I feel I have things under control now.
[snip]

Congratulations to your detective work, and thanks for the feed back.

--
Michael Bednarek http://mbednarek.com/ "POST NO BILLS"