10

So, here's a curious situation. Forgive me if it's obvious and perhaps I'm just missing it.

I have a client device (Surface Pro 4) which as far as I can tell is online. The user can browse the web, receive emails and ping any other device on the network.

Now, if anyone else on the same LAN tries to communicate with the device, it comes back as unresponsive or offline.

enter image description here

Pings to either the hostname or IP Address come back as "Request timed out", trying to remote in via IP or hostname (RDP, DNTU) comes back as unresponsive, etc.

See below for the device's ipconfig /all results.

device IPCONFIG results

That being said, I can remote in using an application where the user has to access a webpage and download an applet (LogMeIn Rescue).

See below for the device's network status.

device status

Any idea what's going on here? The device is connected to Ethernet via the Surface Pro Docking Station.

2
  • 3
    Is there a firewall enabled on the device?
    – Alex
    May 25, 2017 at 17:26
  • Why s this unusual? This is perfectly normal behaviour fir a device with basic security enabled
    – Stevetech
    May 26, 2017 at 6:27

1 Answer 1

16

TL;DR:

The host is online, but isn't responding because of a firewall. Use ARP to verify it's connected to the network.

Inbound Traffic Is Blocked

The Surface has a software firewall enabled (e.g. Windows Firewall) that's configured to block unsolicited incoming traffic, including ICMP echo requests (ping). This also explains why your other connection attempts are failing. However, connecting through a service such as LogMeIn works because, technically, the Surface is initiating the connection in that case.

How To Find Connected But Firewalled Nodes Using ARP

If you're on the same subnet as the device you can prove to yourself that the machine is connected to the network even if it doesn't respond to ping requests. Do so as follows:

  1. Ping the device. This causes your computer to send an ARP request to the local subnet asking, "What device has IP address X?" If the node is online, despite any configured firewall it will send a reply to your machine saying "My MAC address is Y and I have IP address X." This response is stored in your local machine's ARP Cache.
  2. Run the command arp -a and observe whether there's an entry for the device's IP address. If there is, the device is online.

A Note About ARP Caching

ARP entries can be cached, though in Windows Vista and newer the cache timeout is less than 45 seconds. However, if you really want to ensure the remote node is online the precise moment you issue your ping command, run one of the following before step 1 above:

To remove only the target node's entry from your ARP cache, run:

arp -d <remote_ip>

Or, to clear the entire ARP cache, run:

arp -d *
5
  • That did it! I was able to verify that the IP and MAC Address were in the ARP table and matched the information from the device. I went into the Windows Firewall settings and disabled it on Domain Networks since we have our own hardware firewall on the network. Thanks!
    – Jacob K
    May 25, 2017 at 17:38
  • 4
    Glad this helped. I would encourage you to consider the value of having a firewall on individual devices, even when the entire network is protected by an Internet-facing firewall. If one node becomes compromised, other devices are easier to infect if they expose ports that do not need to be opened. Just a thought. May 25, 2017 at 17:41
  • Can't arp -a be a response from an ARP Cache, therefore not revealing the real state of the machine?
    – Alex
    May 25, 2017 at 19:36
  • 2
    @Alex Absolutely, however on Windows Vista and newer the ARP cache timeout is a random value between 15 and 45 seconds, making this a negligible factor. May 25, 2017 at 19:39
  • 1
    @Alex Answer updated to address your observation. May 25, 2017 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .