2

We used to have a sysadmin person months ago who had disabled ping response on one of our servers. But now we want to re-enable ping response.

I tried to check if the ping was disabled from config. These values are set to 0.

root@dumpty:/mnt/NAS# cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
0
root@dumpty:/mnt/NAS# cat /proc/sys/net/ipv4/icmp_echo_ignore_all 
0

And here is the sysctl.conf:

root@dumpty:/mnt/NAS# cat /etc/sysctl.conf | grep icmp
#net.ipv4.icmp_echo_ignore_broadcasts = 1
#net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.icmp_echo_ignore_broadcasts = 0
net.ipv4.icmp_echo_ignore_all = 0

The ping is still not working. I know that the server is able to recieve ping because I can see the requests in the tcpdump but I don't see the outgoing responses, examples:

tcpdump capture for ping:

root@dumpty:/mnt/NAS# tcpdump -nni eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
18:39:45.260686 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 1, length 64
18:39:46.259975 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 2, length 64
18:39:47.260289 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 3, length 64
18:39:48.259971 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 4, length 64
18:39:49.261652 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 5, length 64
18:39:50.261956 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 6, length 64
18:39:51.260058 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 7, length 64
18:39:52.260309 IP 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 8, length 64
^C
8 packets captured
13 packets received by filter
0 packets dropped by kernel

I may be wrong but this is the command I found on web that's supposed to capture incoming packets:

root@dumpty:/mnt/NAS# tcpdump -nni eth0 -e icmp[icmptype] == 8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
18:40:48.260108 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 64, length 64
18:40:49.260064 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 65, length 64
18:40:50.260119 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 66, length 64
18:40:51.260092 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 67, length 64
18:40:52.260285 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 68, length 64
18:40:53.260465 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 69, length 64
18:40:54.262405 00:10:db:ff:10:01 > bc:30:5b:da:51:a6, ethertype IPv4 (0x0800), length 98: 103.227.98.242 > SEVERIP: ICMP echo request, id 4799, seq 70, length 64
^C
7 packets captured
7 packets received by filter
0 packets dropped by kernel

and this is outgoing

root@dumpty:/mnt/NAS# tcpdump -nni eth0 -e icmp[icmptype] == 0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

I don't see any outgoing packets, I also checked iptables for any rules blocking icmp

root@dumpty:/mnt/NAS# sudo iptables -L INPUT | grep reject
REJECT     tcp  --  anywhere             anywhere             tcp dpt:9200 reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpt:httpflags: FIN,SYN,RST,ACK/SYN #conn src/32 > 15 reject-with tcp-reset
root@dumpty:/mnt/NAS# sudo iptables -L INPUT | grep icmp
REJECT     tcp  --  anywhere             anywhere             tcp dpt:9200 reject-with icmp-port-unreachable
root@dumpty:/mnt/NAS# sudo iptables -L INPUT | grep drop
root@dumpty:/mnt/NAS# 

We have a reject on port 9200 but I think it shouldn't be blocking all ports? What else can stop our pings from responding? Did I miss any other config?

I tried my best to debug, any help is much appreciated.

Note: I edited the output of my console and replaced our sever IP with SEVERIP

EDIT:

Adding iptables OUTPUT chain

root@dumpty:/mnt/NAS# sudo iptables -L OUTPUT
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

EDIT2:

root@dumpty:/mnt/NAS# iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
root@dumpty:/mnt/NAS# iptables -t raw -vnL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
root@dumpty:/mnt/NAS# iptables -t mangle -vnL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  • 2
    Could you also include the iptables rules, if any, for the OUTPUT chain? – Ralph Rönnquist Apr 6 '16 at 8:00
  • @RalphRönnquist added iptables OUTPUT – pahnin Apr 6 '16 at 9:41
  • Does ping work if your turn off iptables? – user1700494 Apr 6 '16 at 10:16
  • Silly question, but making sure: "dumpty" indeed has an interface for SERVERIP? Check ifconfig. Other than that, you should check the "raw", "mangle" and "nat" tables, like iptables -t nat -vnL. (Probably all empty) – Ralph Rönnquist Apr 6 '16 at 11:51
  • "dumpty also needs a return route for targeting 103.227.98.242 ... check route -n – Ralph Rönnquist Apr 6 '16 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.