host shows down but it is not [check_icmp]

[Kevin Keane]

Joe Konecny wrote:
> On 10/14/2009 3:36 PM, Marc Powell wrote:
>
>   
>> After taking a peek at the code, I do believe that it really sent out
>> 5 ICMP_ECHO requests and only received the first one back. You should
>> be able to verify this with wireshark.
>>     
>
> Yes that is what wireshark seemed to prove on one of my earlier posts.
>
>   
>> Is this something that is happening for all hosts or just this one
>> host? Is there a firewall between the hosts (even running locally on
>> either). Is there anything special about the target host? Anything
>> that would rate limit ICMP_ECHO requests or responses?
>>     
>
> Yes there is a firewall but I'm not sure about what it is doing to
> rate limit icmp requests.  I do know that any host outside of my
> local network fails in the same way.
>   
Do you have access to the firewall logs? They might tell you more.

My hunch is that the packets that check_icmp sends out are different in 
a subtle way from those that ping sends. Maybe check_icmp has a longer 
payload that the firewall interprets as a type of attack? Carefully look 
at the packets that Wireshark traced and compare the check_icmp ones 
with the ping ones.

-- 
Kevin Keane
Owner
The NetTech
Find the Uncommon: Expert Solutions for a Network You Never Have to Think About

Office: 866-642-7116
http://www.4nettech.com

This e-mail and attachments, if any, may contain confidential and/or proprietary information. Please be advised that the unauthorized use or disclosure of the information is strictly prohibited. The information herein is intended only for use by the intended recipient(s) named above. If you have received this transmission in error, please notify the sender immediately and permanently delete the e-mail and any copies, printouts or attachments thereof.


------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null