I was wondering if someone would be able to help me with a head scratcher. We have a device that has communicated with our server but is not sending back any data.
I am able to ping the IP address which pings successfully but when I do a netstat on the machine the IP address is not listed.
Why would this be? How can an IP address be pingable but not connected? Are there any other tools I could use to help me diagnose this issue?
Update:
Sorry for using the comments below. I didn't realize I could edit my own post!!
EightBitTony, I think I see what your getting at when you say: "netstat -a shows connected machines, not just the ip address of every machine anywhere".
This outstation device's only job is to come online and send data to our servers. The Ip Address of the device is: 10.113.201.155 and the port number it should connect to is: 6102.
When I do a netstat I was expecting it to be connected to this port number (6102) but it is not. 6102 is the port the server software listens on.
This outstation has not sent back any data now for the last 2 days which is the problem we are experiencing yet it is pingable suggesting it is online. Unfortunately this device is not located in an office anywhere where I could simply reset it.
We are going to have to send a maintenance team out but I wanted to better understand what is going on and why this is happening.
I have another question. If the outstation comes online but does not bind to the port 6102 will it not be shown in netstat? I think I know the answer here (no).
Update 2:
Thank you EightBitTony. You have explained that perfectly to me and I understand what you mean. After reading your answer I believe that the application has in some way failed on that machine and is in some kind of crashed state.
I tried to "up" your answer but do not have enough rep points!!
Best Answer
You can ping any IP address anywhere that network routing and firewalls allow, but that doesn't mean it's connected to your computer and so won't show up in netstat.
Netstat shows which TCP ports have got active connections (i.e. machines connected, not just machines which might or which used to connect). Ping uses ICMP (sometimes UDP) and doesn't rely on TCP ports.
In your case, it sounds like the application is not connecting but the operating system is still up and running, so you can ping the machine (because that's the OS responding), but the application can't connect to your server either because it's not running, or because it's got other issues.
If you can't connect back to it remotely and log in to check the app you'll need to send someone to it.
You also asked,
We don't know what OS or application this 'outstation' is running, but it's applications which connect to ports, and yet it's operating systems (or rather, components of those operating systems) which bring up and manage the network. So if you application connects, yes you'll see it. But if the outstation boots and brings up the network it won't do anything until the running application tries to do anything, if it crashes, then you'll see nothing at your end. Network and application are separate.
Last example, assuming your computer can connect to the internet, you can
ping www.google.combut it doesn't mean www.google.com has ever tried to connect to your computer.