The arp-scan tool found machine but i can't ping

Question

I have two VPS that i buyed from one corporation, OS of two VPS is ubuntu and when i ran arp-scan -l on one of the both machine and i can see IP of other machine, but i havn't any type of access to other machine such as ping or ssh.

VPS1 by IP xxx.156.28.44 - 45 -132 - 133 addresses:

$ ifconfig

eno16777984 Link encap:Ethernet  HWaddr 00:50:56:ba:13:08  
          inet addr:xxx.156.28.44  Bcast:xxx.156.29.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:feba:1308/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:68581784 errors:0 dropped:395 overruns:0 frame:0
          TX packets:546712 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4117524421 (4.1 GB)  TX bytes:42148204 (42.1 MB)

eno33557248 Link encap:Ethernet  HWaddr 00:50:56:ba:5d:c3  
          inet addr:xxx.156.28.45  Bcast:xxx.156.29.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:feba:5dc3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:68593610 errors:0 dropped:391 overruns:0 frame:0
          TX packets:549257 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4119620083 (4.1 GB)  TX bytes:51059039 (51.0 MB)

eno50336512 Link encap:Ethernet  HWaddr 00:50:56:ba:11:8a  
          inet addr:xxx.156.28.132  Bcast:xxx.156.29.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:feba:118a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:68577854 errors:0 dropped:385 overruns:0 frame:0
          TX packets:537761 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4147035543 (4.1 GB)  TX bytes:38477032 (38.4 MB)

eno67115776 Link encap:Ethernet  HWaddr 00:50:56:ba:7f:ff  
          inet addr:xxx.156.28.133  Bcast:xxx.156.29.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:feba:7fff/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:68623163 errors:0 dropped:381 overruns:0 frame:0
          TX packets:563315 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4187533469 (4.1 GB)  TX bytes:42074769 (42.0 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:12740522 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12740522 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4573274548 (4.5 GB)  TX bytes:4573274548 (4.5 GB)

And then:

# arp-scan -l

Interface: eno16777984, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 512 hosts (http://www.nta-monitor.com/tools/arp-scan/)
xxx.156.28.1     ec:bd:1d:ee:90:56       (Unknown)
xxx.156.28.144   00:50:56:ba:44:e4       VMware, Inc.
xxx.156.28.145   00:50:56:ba:2d:ff       VMware, Inc.
xxx.156.28.213   00:50:56:ba:70:95       VMware, Inc.

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 512 hosts scanned in 2.328 seconds (219.93 hosts/sec). 4 responded

VPS2 by IP xxx.156.28.144 - 145 addresses:

$ ifconfig

ens160    Link encap:Ethernet  HWaddr 00:50:56:ba:44:e4  
          inet addr:xxx.156.28.144  Bcast:xxx.156.29.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:feba:44e4/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:106955 errors:0 dropped:12 overruns:0 frame:0
          TX packets:12740 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:9203357 (9.2 MB)  TX bytes:5273326 (5.2 MB)

ens192    Link encap:Ethernet  HWaddr 00:50:56:ba:2d:ff  
          inet addr:xxx.156.28.145  Bcast:xxx.156.29.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:feba:2dff/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:128548 errors:0 dropped:12 overruns:0 frame:0
          TX packets:29882 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:14260145 (14.2 MB)  TX bytes:30421730 (30.4 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:335736 errors:0 dropped:0 overruns:0 frame:0
          TX packets:335736 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:72935084 (72.9 MB)  TX bytes:72935084 (72.9 MB)

And then:

# arp-scan -l

Interface: ens160, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 512 hosts (http://www.nta-monitor.com/tools/arp-scan/)
xxx.156.28.1     ec:bd:1d:ee:90:56       (Unknown)
xxx.156.28.44    00:50:56:ba:13:08       VMware, Inc.
xxx.156.28.45    00:50:56:ba:5d:c3       VMware, Inc.
xxx.156.28.132   00:50:56:ba:11:8a       VMware, Inc.
xxx.156.28.133   00:50:56:ba:7f:ff       VMware, Inc.
xxx.156.28.213   00:50:56:ba:70:95       VMware, Inc.

7 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 512 hosts scanned in 2.629 seconds (194.75 hosts/sec). 6 responded

And also:

$ sudo iptables -L -n -v

Chain INPUT (policy ACCEPT 141 packets, 17067 bytes)
 pkts bytes target     prot opt in     out     source           

    destination         
      155 13020 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    75563   15M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
     6344  630K f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
        7   588 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 2293 packets, 476K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain f2b-sshd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   13   788 REJECT     all  --  *      *       121.18.238.98        0.0.0.0/0            reject-with icmp-port-unreachable
 5294  566K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Also already iptables installed on both VPS, and I used below command to enable ping access:

sudo iptables -A INPUT -p icmp -j ACCEPT

And my problem not solved, i havn't very experience on networking, how can i resolve this problem?

Show iptables rules and output of command `ifconfig` on both servers. What mac-address was showed in your command `arp-scan -l`? — Mikhail Khirgiy, Jan 12 '17 at 04:51
This the IP of the other machine in the range of your network? — Broco, Jan 12 '17 at 04:52
The order of rules in `iptables` is important, so showing us one rule you added is no help at all. We will need to see the output of `iptables -L -n -v` on the unpingable machine. — MadHatter, Jan 12 '17 at 06:25

score 1 · Answer 1 · answered Jan 12 '17 at 06:37

1

sudo iptables -A INPUT -p icmp -j ACCEPT

Depending on how your INPUT chain is configured this may not work due to the way iptables works try

sudo iptables -I INPUT -p icmp -j ACCEPT

answered Jan 12 '17 at 06:37

user9517

115,471
20
215
297

This command, not change anything... – M.J Jan 12 '17 at 09:04

score 0 · Answer 2 · answered Jan 12 '17 at 06:23

Make sure iptables isnt blocking outbound ICMP as well.

sudo iptables -nL OUTPUT

to see, or in general,

sudo iptables -nL

to see all tables on your system (you may have more than just INPUT, OUTPUT and FORWARD defaults if you have any firewalling software or more complex configs).

sudo arp -na

Will show you your current arp table on the system as well. (Note that arp entries expire after a short time if there is no traffic attempted between the hosts).

The arp-scan tool found machine but i can't ping

2 Answers2