On Thu, May 10, 2012 at 4:30 PM, Dj <[email protected]> wrote: > No - the pings timeout. > > Only one interface present - eth0 and of course lo > > I am stumped. Its like the system sends traffic to that host to a blackhole > and it never gets to tcpdump. > > I am thinking I will try rebuilding the server since the ping traffic > "disappears" and is not even seen by tcpdump. >
It definitely sounds like a server issue. Double check your routing and iptables. > On Thursday, May 10, 2012 1:17:35 PM UTC-4, Dj wrote: >> >> The VMware host that our OSSEC guest server was running on recently >> crashed and ever since the crash one of our agents is not connecting to the >> OSSEC server. >> >> Here is what I have attempted for troubleshooting - >> >> Created a new agent profile on the Server, extracted the key and >> configured the agent with the new key. When this was performed, the server >> reports that the agent has never connected to the OSSEC server. >> Ran tcpdump on the server to see if the traffic was getting to the server >> on port 1514 since the remote agent is on another network with a firewall >> between. This agent was working before the VMware host crash. The tcpdump >> output shows the UDP traffic getting to the server, but the server is not >> responding to the agent. >> Ran tcpdump on the server for another agent that is on a different subnet >> and results show traffic to the server and back to the agent from the >> server. >> >> Could there be something on the server that is preventing the server from >> responding to the agent's connection since the UDP traffic from the agent >> was seen in the tcpdump capture on the server, but no response was detected >> in the tcpdump capture? >> >> Are there any debug settings I can enable to try and see further what is >> happening on the server? >> >> We are running OSSEC 2.6 on the server and the agent. >> >> >> >> >> >
