pinging ipaddress resolves thru firewall

[Dave Bunting]

I tried to ping my L1K box using my L3K box (#ping 195.xxx.xxx.xxx), but i get a different IP address (203.xxx.xxx.xxx) which is my WinNT firewall's IP address, what seemed to be wrong here, I checked using netstat, no 203.x gateway is included in my routing table. I have two lancards, both are up, same IP family (netconf)
But when i tried pinging L3K using the L1K there is no problem, no name resolution done, just straight ping, ip to ip...

[Stefan Farrelly]

If you disable dns resolution on your L1000 box then ping your L3000 does it report the correct IP ? (mv /etc/resolv.conf /etc/resolv.conf.old to disable DNS temporarily) It should.

Have you checked the dns entries for both servers are correct ?
with DNS enabled an nslookup resolves correctly ?

Does netstat -i on both servers report the correct IP address for each interface ?

Some sites setup their firewall to respond to any ping request with the IP registered to the firewall, this is to stop hackers finding out too much info etc. Ours works the same here.

[Dave Bunting]

Thanks Stefan...
For a clearer picture...
(from my machine L3K, ip 195.xxx.xxx.xxx, subnet 255.255.255.0)
# ping 192.xxx.xxx.xxx
PING 192.x.x.x: 64 byte packets
64 bytes from 192.x.x.x: icmp_seq=0. time=3. ms
64 bytes from 192.x.x.x: icmp_seq=1. time=1. ms
64 bytes from 192.x.x.x: icmp_seq=2. time=1. ms
... after several 192s more...
64 bytes from 203.x.x.x: icmp_seq=2. time=1. ms
64 bytes from 192.x.x.x: icmp_seq=2. time=1. ms
64 bytes from 192.x.x.x: icmp_seq=2. time=1. ms

===!!!!!
where does the 203.x.x.x come from? 203.x.x.x is the ip of my firewall
more help needed Stefan... Thanks

[Stefan Farrelly · Accepted solution]

Hi Dave,

Wow, a ping changing IP while still running, very impressive! Ive not seen that happen before.

Your gateway (which I guess is the same as your firewall - ours is) is screwing up. Youre going to have to show this to your network/firewall people as in my opinion there is definitely a problem on your firewall/gateway server.

[Dave Bunting]

WHOA!!! good suggestion... Thanks Stefan

[Anthony deRito]

Seems to me that this can only be related to a routing issue. The ICMP packets are evidently being delivered to the destination IP however the gateway is reporting information which it believes to be true. If the firewall is configured to respond with its IP during ICMP requests, it may be worth looking at your firewall configuration.

Is the destination IP over a WAN by any chance? This problem may happen if there is a backup WAN connection and the WAN devices are configured with DDR (Dial on demand routing) over ISDN or the like. In this case, the routers may be flip-floping between the primary and backup routes which happens sometimes when DDR is configured incorrectly. The firewall may be responding with whichever interface IP is valid at the time depending on which link is active. Just a thought.

Tony