Wireshark-users: [Wireshark-users] need to find what blocks icmp
From: "Boris Blinchevsky" <nesb@xxxxxxxxxxxxx>
Date: Wed, 19 Aug 2009 11:42:59 -0500

Hello,

 

Trying:  To find out what blocks ping from laptop to desktop.

Have:    2 computers. 1. Dell M140 laptop ( Comodo firewall, Symantec Enterprise Edition 11.0)   IP   192.168.1.3   subnet 255.255.255.0

                                2. Dell desktop (Comodo firewall, Symantec Enterprise Edition 11.0)  IP   192.168.1.2   subnet 255.255.255.0

 

Issue:  I can ping laptop from desktop, but I can not ping desktop from laptop. Both comps have tcp/ip configured correctly. Both computers have can ping linksys router (192.168.1.1) and Internet addresses.

What I did for test purposes:

 

I connected laptop (192.168.1.3)  directly (via ethernet cable) to the desktop computer (192.168.1.2). The ping still times out from the laptop to the desktop, but it works the other way around. I did check arp table on the laptop & desktop. Both are able to see each other's MAC's addresses. I also disabled Comodo firewall on both computers (selected exit on the task bar tray). Symantec Endpoint protection firewall was also disabled by stopping all Symantec services under Windows Services. Still doesn't work. I'm pretty sure now that the problem is on the laptop, because I tried combination of pings from each computer to each other with 'netstat -s' option to see wich one is not receiving ICMP echos and which one is not sending back ICMP echo replies. Desktop is not receiving icmp echos from the laptop and laptop, obviously, not receiving replies. I did try to stop as many services under Task Managers as I could just to see if that would help... but still no luck.

 

Sniffer: I installed WireShark sniffer. I do see source and destination, protocol and info in Wireshark window when I ping from laptop to desktop. The only packets it captures are ICMP Echo (ping) request.  So, what I do now? How I can find out what application blocks ICMP packet??

 

Thank you!

Boris