A server cannot ping to other servers unless a wireshark is capturing packet. And I believe that a process is capturing packets before ping process. But how to find this process?

  • You mean you cannot ping the remote server unless the remote server has a packet capturing software running? In this case my bet would be a firewall that drops ICMP packets on the target. Please be more specific in your question. Log in to SuperUser with your StackExchange account to regain access to the question and edit it accordingly.
    – Baarn
    Sep 7 '12 at 11:41

OK. I solve this problem myself. The truth is that the packet send to my server has a correct IP address but a wrong MAC address. So in case the wiredshark is turned off, the network interface card(NIC) will drop it directly. But if the wiredshark is turned on, it will capture the packet and modified the MAC address to a correct one.


I am experiencing the same problem while pinging my Ethernet target device from a Windows 7 machine (Enterprise, SP1). In my configuration there are 2 USB2Ethernet adapters and the Ethernet interface in Windows comes from the adapter's driver. This hardware configuration works for sure (it does when pinging from Linux). But not from Windows.

Unfortunately, your answer does not clarify the root of the problem. If you mean that ICMP response has a wrong MAC addr., the question is why it is actually wrong. If you are using off-the-shelf software (standard tools shipped with your OS) and no hand-made ICMP requests/responses, the question is still open, what is the root of the wrong MAC addr. problem? The TCP/IP stack (with ICMP implementation being part of it) works AFAIU first discovering the MAC addr. via ARP broadcast request and then selects the destination MAC addr. based on the given response[s].

Anyway, I have tried setting static ARP entry for the destination IP (tried both the USB2Ethernet's MAC addr. connected to the Windows peer and the MAC addr. of the target Ethernet interface). No luck so far.

At the target system (the one being pinged) I can see, that ICMP responses are actually sent, but Windows system seems to be filtering them out.

With Wireshark listening to the port the problem is fixed, and networking with the target system works perfectly (ICMP and all other protocols).

I suppose it has something to do with the promiscuous mode the Wireshark brings the Ethernet interface into while sniffing and/or some Windows settings/services I am not aware of.

  • The root of the problem can vary. For my case, I was experimenting a new network protocol which mistakenly set the wrong MAC address.
    – RandyTek
    Jul 13 '16 at 19:31
  • This is really a comment and not an answer to the original question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. Please read Why do I need 50 reputation to comment? What can I do instead?
    – DavidPostill
    Jul 13 '16 at 19:59
  • I wanted first to get response specifically from RandyTek to narrow down my "problem solving search space", and thanks to him I've got it. I'm sorry if I broke some StackExchange rules of conduct, but have I had created a new topic, how would I catch RandyTek's attention? My reputation is < 50 now and hence I cannot post comments to somebody elses' questions, and there are no personal messages or whatever. How else would I be able to accomplish that?
    – Student4K
    Jul 14 '16 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.