A brand new linux box running Ubuntu 16.04.1 (LTS) Server was installed into a Citrix VM. It was set up with openSSH.

When connecting to it via, it will timeout. This happens even immediately after I exit a live ssh session and try to ssh again.

If I'm in a session, it will often cut me off, with an error about a broken pipe. I've set up a basic Apache HTTP web server on it, and I often won't be able to reach the pages the server should be serving up.

This all doesn't work unless I run a ping command in another window to that box.

I know it looks weird. But it works. No broken pipes. Web server responsive. It almost seems like the VM falls asleep unless I constantly prod it with a ping command. It will wake up if I nmap the server (long enough at least for me to ssh in). Once I'm connected, the web server works intermittently.

Anyway, what could be happening here? I don't think this is purely about client/server timeout settings. After all, if it was, would it start accepting connections after pinging or nmapping the remote host?

  • You should try disabling the firewall to see if it makes a difference. Sep 15 '16 at 22:35
  • Just ran sudo ufw status verbose and it returned with status: inactive
    – tralston
    Sep 15 '16 at 22:37
  • Check that Citrix isn't slowing down the CPU too aggressively
    – roaima
    Sep 15 '16 at 22:39
  • I don't have access to the Citrix hypervisor, unfortunately. The IT worker who set it up said he built it with all the default new VM settings (i.e. he didn't change any cpu/memory settings from default).
    – tralston
    Sep 15 '16 at 22:42

I smell an IP address conflict. See SSH host key keeps changing for an explanation. The symptoms match: TCP connections get broken after a while (when the other contender grabs the IP address) and keeping a ping running helps (because then the same contender tends to remain in the ARP caches).

This could be explained by a flaw in the VM setup procedures: the VM may have inherited the same IP address as another VM. Make sure that each VM gets a unique MAC address and a unique IP address.

This is a plausible explanation, but I do not claim that it's the only possible explanation by any means.

  • I haven't verified this is the case yet, but how does this explain the fact that when I start pinging the VM, I can connect via SSH? The same applies to the web service on the VM. If I navigate to the machine's IP address on the intranet, nothing happens, but when I start pinging the VM, all of the sudden the machine's web service is active and I can browse it on the intranet. It's like without pinging, it is in hibernation or something.
    – tralston
    Jun 1 '17 at 22:16
  • @tralston If it's an IP address conflict then pinging wouldn't make the VM reachable, but it would keep the VM reachable as long as the pinging is going on. Does ping work all the time with no delay? If it does then I think it isn't an IP address conflict. Jun 1 '17 at 22:29
  • Whenever it's pinging, it's reachable. When I stop (there may be a slight delay) it is not reachable. Note that the machine is still working in the background, as it is performing tasks. But the network interface is not reachable. Once I start pinging it again, I can instantly ssh and web browse the VM.
    – tralston
    Jun 2 '17 at 2:29
  • another interesting wrinkle. I've found that pinging the machine only gives ME access on our intranet. My colleagues (on the same subnet) cannot access the machine unless they also ping it. Weird! This is really discouraging me ... any thoughts?
    – tralston
    Jun 3 '17 at 0:07
  • @tralston If it's on the same network segment then that's consistent with an IP address conflict: each peer has to update its ARP cache independently. What isn't consistent with an IP address conflict is that ping works instantly and then SSH works instantly — if there was another machine with the same IP address then ping would always work (assuming both machines reply to ping) but SSH would work or not depending on which machine is answering the pings. I'm afraid your problem is beyond my meager network engineering skills. Jun 3 '17 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.