Solved PC randomly loosess the ability to communicate with different subnets

[srandazitra]

Good day Windows wizards,

our company has been struggling with the issue written in "thread title" for several months. It all began after the update of Kaspersky antivirus from version 8 to version 10. The symptoms are the following: PC is able to access internet or services located in another subnets. It suddenly stopps to communicate and looses ability to contact other computers in different subnets. The PCs located in same subnet are pingable and visible from this problematic non-communicating PC, though. There is temporary solution to that issue - if we delete ARP table with arp -d *, the PC begins to communicate again (for limited period of time, the issue with communication loss is recurring).

What we already tried to do and didn't help: Uninstall Kaspersky

• Reinstall Kaspersky
• Update Kaspersky as much ass possible
• netsh int ip reset
• Update PC as much as possible
• Update network drivers
• Use different network card

We also proved there isn't any problem with network connectivity. We used Port mirroring and sniffed all the traffic comming from and to PC. We were pinging to different subnets and when the communication stopped (ping said destination is not reachable), we saw that ICMP requests are leaving the NIC of the PC and ICMP replies are coming back to PC. Apparently, the PC isn't able to process the reply back and it says destination unreachable instead. The communication may restore after some time or we can restore it immediately with arp -d *. One PC was already reinstalled and it helped. However, we want to avoid that remediation procedure, because quite a bunch of PCs are affected with this issue.

Do you happen to know what remediation procedure could we try? I'd be glad for any advices.

Thank you in advance, best regards,
Stan

 

[GokAy]

Try command: "route print" when this happens next, and see if default route is correct .
Then try (run as admin): "netsh interface ip delete destinationcache" and see if it helps

You may perhaps use Download Complete Internet Repair - MajorGeeks with options:
- reset Internet Protocol
- repair Winsock (read the warning, hover mouse over icon - left side)
- and any other you may see fit.

 

[srandazitra]

Hello GokAy,

thank you for your inventions and ideas. I can't be sure at the time, but it seems we resolved this issue after few months. We disabled the arp -d * planned task on the most problematic clients we had and it seems they all communicate as desired. Guy from external company shot his ideas to us over the phone and one of the options was DHCP. We verified the setup, went through the logs and at the end, we saw that our DHCP servers don't have the "check if the address isn't already taken" feature enabled. What a crappy DHCP server. I thought this is obligatory feature, which is always turned on. I'm marking this thread as resolved.

Have nice day,
Stan