Some Mystery Workstations cant ping each other

szahn · 10-19-2009, 04:54 PM

This morning, none of the computers could connect to each other, not even the server. After power cycling the router and switch, restarting the server, we cannot figure out why some computer can talk to each other, but others can't.

The "dead" workstations can ping external websites like google.com but cannot talk to local workstations.

We've come to the conclusion that it isn't a hardware issue but we've swapped NIC's, cables, and even avoided the switch.

It's got to be a software problem...but what?

Some "dead" workstations cannot ping other "dead" workstations.
The "dead" workstations cannot log onto the domain.
The server (192.168.1.5) cannot be pinged by workstation.
Some healthy workstations can be pinged by the "dead" workstations. The healthy workstations can ping the "dead" workstations, except that nobody can ping the server.

We're running anti-virus scans on both the server and workstations but haven't found anything yet.

**johnwill** · 10-20-2009, 09:40 AM

Have you tried booting in Safe Mode with Networking to see if that changes anything?

For one of the "dead" workstations, and one of the "live" ones, let's see this.

Hold the Windows key and press R, then type CMD to open a command prompt:

In the command prompt window that opens, type type the following commands, one at a time, followed by the Enter key:

Note that there is a space before the -n or the /ALL, but there is NOT a space after the - or / in the following commands.

NBTSTAT -n

IPCONFIG /ALL

Right click in the command window and choose Select All, then hit Enter to copy the contents to the clipboard.
Paste the results in a message here.

If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here.

szahn · 10-20-2009, 10:24 AM

A healthy workstation:

Code:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator>nbtstat -n

VMware Network Adapter VMnet8:
Node IpAddress: [192.168.126.1] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    ZAHN           <00>  UNIQUE      Registered
    AMIDOM         <00>  GROUP       Registered
    ZAHN           <20>  UNIQUE      Registered
    AMIDOM         <1E>  GROUP       Registered
    AMIDOM         <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered

VMware Network Adapter VMnet1:
Node IpAddress: [192.168.208.1] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    ZAHN           <00>  UNIQUE      Registered
    AMIDOM         <00>  GROUP       Registered
    ZAHN           <20>  UNIQUE      Registered
    AMIDOM         <1E>  GROUP       Registered
    AMIDOM         <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered

Local Area Connection 2:
Node IpAddress: [192.168.1.107] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    ZAHN           <00>  UNIQUE      Registered
    AMIDOM         <00>  GROUP       Registered
    ZAHN           <20>  UNIQUE      Registered
    AMIDOM         <1E>  GROUP       Registered

Local Area Connection:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache


C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : zahn
        Primary Dns Suffix  . . . . . . . : amidom
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : amidom

Ethernet adapter VMware Network Adapter VMnet8:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for
VMnet8
        Physical Address. . . . . . . . . : 00-50-56-C0-00-08
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.126.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :

Ethernet adapter VMware Network Adapter VMnet1:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for
VMnet1
        Physical Address. . . . . . . . . : 00-50-56-C0-00-01
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.208.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connect
ion
        Physical Address. . . . . . . . . : 00-0D-56-D4-AE-AA
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.107
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 192.168.1.5
                                            64.238.96.12
        Lease Obtained. . . . . . . . . . : Monday, October 19, 2009 9:21:32 PM
        Lease Expires . . . . . . . . . . : Tuesday, October 20, 2009 9:21:32 PM


Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethe
rnet NIC
        Physical Address. . . . . . . . . : 00-40-F4-CB-28-E8

C:\Documents and Settings\Administrator>

A dead workstation (the server)

Code:

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator>nbtstat -n

Local Area Connection 2:
Node IpAddress: [192.168.1.5] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    AMISERVER      <00>  UNIQUE      Registered
    AMIDOM         <00>  GROUP       Registered
    AMIDOM         <1C>  GROUP       Registered
    AMISERVER      <20>  UNIQUE      Registered
    AMIDOM         <1B>  UNIQUE      Registered
    AMIDOM         <1E>  GROUP       Registered
    AMISERVER      <03>  UNIQUE      Registered
    AMIDOM         <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered
    ADMINISTRATOR  <03>  UNIQUE      Registered

Local Area Connection:
Node IpAddress: [169.254.176.74] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    AMISERVER      <00>  UNIQUE      Registered
    AMIDOM         <00>  GROUP       Registered
    AMIDOM         <1C>  GROUP       Registered
    AMISERVER      <20>  UNIQUE      Registered
    AMIDOM         <1B>  UNIQUE      Registered
    AMIDOM         <1E>  GROUP       Registered
    AMISERVER      <03>  UNIQUE      Registered
    AMIDOM         <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered
    ADMINISTRATOR  <03>  UNIQUE      Registered

RAS Server (Dial In) Interface:
Node IpAddress: [169.254.191.195] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    AMISERVER      <00>  UNIQUE      Registered
    AMIDOM         <00>  GROUP       Registered
    AMIDOM         <1C>  GROUP       Registered
    AMISERVER      <20>  UNIQUE      Registered
    AMIDOM         <1B>  UNIQUE      Registered
    AMIDOM         <1E>  GROUP       Registered
    AMIDOM         <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered

C:\Documents and Settings\Administrator>



C:\Documents and Settings\Administrator>ipconfig/all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : amiserver
   Primary Dns Suffix  . . . . . . . : amidom
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : amidom

PPP adapter RAS Server (Dial In) Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
   Physical Address. . . . . . . . . : 00-53-45-00-00-00
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 169.254.191.195
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . : amidom
   Description . . . . . . . . . . . : Intel(R) PRO/100+ Server Adapter (PILA847
0B)
   Physical Address. . . . . . . . . : 00-02-B3-61-FA-50
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.1.5
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.5
                                       64.238.96.12

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet Adapter (1
0/100)
   Physical Address. . . . . . . . . : 00-06-5B-05-11-34
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Autoconfiguration IP Address. . . : 169.254.176.74
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

**johnwill** · 10-21-2009, 09:43 AM

Well, I notice that both of those boxes think they're the master browser. This is because they don't see each other, and 99% of the time is a firewall in the way.

szahn · 10-21-2009, 10:04 AM

It turned out to be a worm on the server

**johnwill** · 10-22-2009, 07:45 AM

That's ugly!

I wonder how it blocked traffic between workstations?

10-19-2009, 04:54 PM	#1 (permalink)
szahn Registered User Join Date: Dec 2008 Posts: 3 OS: WinXP	Some Mystery Workstations cant ping each other This morning, none of the computers could connect to each other, not even the server. After power cycling the router and switch, restarting the server, we cannot figure out why some computer can talk to each other, but others can't. The "dead" workstations can ping external websites like google.com but cannot talk to local workstations. We've come to the conclusion that it isn't a hardware issue but we've swapped NIC's, cables, and even avoided the switch. It's got to be a software problem...but what? Some "dead" workstations cannot ping other "dead" workstations. The "dead" workstations cannot log onto the domain. The server (192.168.1.5) cannot be pinged by workstation. Some healthy workstations can be pinged by the "dead" workstations. The healthy workstations can ping the "dead" workstations, except that nobody can ping the server. We're running anti-virus scans on both the server and workstations but haven't found anything yet.

10-20-2009, 09:40 AM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,787 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: Some Mystery Workstations cant ping each other Have you tried booting in Safe Mode with Networking to see if that changes anything? For one of the "dead" workstations, and one of the "live" ones, let's see this. Hold the Windows key and press R, then type CMD to open a command prompt: In the command prompt window that opens, type type the following commands, one at a time, followed by the Enter key: Note that there is a space before the -n or the /ALL, but there is NOT* a space after the - or / in the following commands.* NBTSTAT -n IPCONFIG /ALL Right click in the command window and choose Select All, then hit Enter to copy the contents to the clipboard. Paste the results in a message here. If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

10-21-2009, 09:43 AM	#4 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,787 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: Some Mystery Workstations cant ping each other Well, I notice that both of those boxes think they're the master browser. This is because they don't see each other, and 99% of the time is a firewall in the way. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

10-21-2009, 10:04 AM	#5 (permalink)
szahn Registered User Join Date: Dec 2008 Posts: 3 OS: WinXP	Re: Some Mystery Workstations cant ping each other It turned out to be a worm on the server

10-22-2009, 07:45 AM	#6 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,787 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: Some Mystery Workstations cant ping each other That's ugly! I wonder how it blocked traffic between workstations? __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience