Check the ossec.log file on the server? Just curious if there's any issue there.
Else, you'll probably have to enable debugging on both sides to see whats going on. On Jan 26, 8:56 am, Scott VR <scot...@s0cialpath.net> wrote: > On Jan 26, 2012, at 9:26 AM, Steve Kuntz <stephen.ku...@gmail.com> wrote: > > > I'm reluctant to install wireshark on the agent at this point. > > It may be your quickest path to a resolution, though. That or a span/mirror > port on the switch. > Check the routing table on the server to see how traffic is sent back *to* > the server. Run a tcpdump on all interfaces on the server for traffic > destined *to* the client; it may be that traffic the other direction is > trying to go out a different interface. > > --ScottVR
