No - the pings timeout. Only one interface present - eth0 and of course lo
I am stumped. Its like the system sends traffic to that host to a blackhole and it never gets to tcpdump. I am thinking I will try rebuilding the server since the ping traffic "disappears" and is not even seen by tcpdump. On Thursday, May 10, 2012 1:17:35 PM UTC-4, Dj wrote: > > The VMware host that our OSSEC guest server was running on recently > crashed and ever since the crash one of our agents is not connecting to the > OSSEC server. > > Here is what I have attempted for troubleshooting - > > - Created a new agent profile on the Server, extracted the key and > configured the agent with the new key. When this was performed, the > server > reports that the agent has never connected to the OSSEC server. > - Ran tcpdump on the server to see if the traffic was getting to the > server on port 1514 since the remote agent is on another network with a > firewall between. This agent was working before the VMware host crash. > The tcpdump output shows the UDP traffic getting to the server, but the > server is not responding to the agent. > - Ran tcpdump on the server for another agent that is on a different > subnet and results show traffic to the server and back to the agent from > the server. > > Could there be something on the server that is preventing the server from > responding to the agent's connection since the UDP traffic from the agent > was seen in the tcpdump capture on the server, but no response was detected > in the tcpdump capture? > > Are there any debug settings I can enable to try and see further what is > happening on the server? > > We are running OSSEC 2.6 on the server and the agent. > > > > > >
