Why does ssh return "no route to host" unless tshark is running?

Question

My Raspberry Pi is connected to a laptop with an Ethernet lead. Xubuntu 14.04 is running on the laptop, and the wired connection is shared to other devices.

SSH server is running on the raspberry pi (checked using the HDMI output connected to a screen), but I can't get the connection working. Each time I try, the raspi returns a "no route to host" message.

This is happening with my Raspi B, and B+, and I have the same problem using raspbian or openelec. Here is the nmap output when tshark is not running:

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-18 12:12 GMT
Nmap scan report for 10.42.0.1
Host is up (0.00030s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

Nmap done: 256 IP addresses (1 host up) scanned in 3.22 seconds

I am expecting the following IP: 10.42.0.76, which is the IP of the raspberry pi.

When I run the following:

sudo tshark -i eth0

nmap returns:

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-18 12:13 GMT
Nmap scan report for 10.42.0.1
Host is up (0.00011s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

Nmap scan report for 10.42.0.76
Host is up (0.0093s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
111/tcp open  rpcbind
445/tcp open  microsoft-ds

Nmap done: 256 IP addresses (2 hosts up) scanned in 3.20 seconds

and the ssh connection is now working, I can connect to the raspi without any problem. The same thing is happening for the web interface of openelec: it's working only if tshark is launched.

Since I don't want to launch tshark each time I need to connect to the raspi, is there a method to make it (ssh and http) work all the time ? Thanks.

Answer 1

Running tshark on the laptop puts its eth0 NIC into promiscuous mode, which cause the NIC to pass all packets received up the stack, rather than packets that have the correct Ethernet destination field of your laptop (or of broadcasts, or of multicasts to which the laptop is subscribed).

Since with tshark running on you get results, conclusion is something is preventing the laptop from receiving packets from the RPi due to an Ethernet issue. "No route to host" errors on what is a local link connection are definitely due to problems with IP to Ethernet address resolution (ARP).

Try turning off firewall rules on the laptop (or at least on the eth0 interface).

Try hardcoding the Ethernet address of the RPi in the laptop ("arp -s 10.42.0.76 ") with the tshark process OFF. If that fixes it, look for things that might be ARP packets or redirecting them.

It would be helpful if you could post network information ("ifconfig" and "route -n" output) for both the RPi and the laptop, as well as the nmap command line. Also the content of "arp -a" on the laptop and RPi when the problem is occurring (with tshark off).