When I ran a Symantec Ghost 7.5 backup task to create an image backup of a system over the LAN, the task failed. I looked at the event log for the backup task by right-clicking on the failed task.
I saw that the initialization failed.
The event details showed that the client timed out.
A Ghost client system should be listening on UDP port 1346. The Ghost server sends a datagram from UDP port 1347 to port 1346 on the client to start the backup. But when I scanned the client system with Foundstone's free ScanLine program, I found it wasn't responding on port 1346.
C:\>sl -u 1346 192.168.0.14 ScanLine (TM) 1.01 Copyright (c) Foundstone, Inc. 2002 http://www.foundstone.com Scan of 1 IP started at Sat Jul 12 13:29:59 2008 ------------------------------------------------------------------------------- 192.168.0.14 Responded in 0 ms. 0 hops away Responds with ICMP unreachable: Yes UDP ports: ------------------------------------------------------------------------------- Scan finished at Sat Jul 12 13:29:59 2008 1 IP and 1 port scanned in 0 hours 0 mins 0.02 secs
And when I examined the network traffic between the two systems with MicroOLAP's tcpdump when I ran the backup task, I saw the client system was returning a "udp port 1346 unreachable" message.
I logged onto the system from the server using the
Remote
Desktop Protocol (RDP). When I logged on and checked whether the
system was listening on UDP port 1346 with netstat, I saw it
was listening.
C:\Documents and Settings\Administrator>netstat -a | find "1346" UDP Ellie:1346 *:*
When I disconnected and scanned the system from the Ghost server again using ScanLine, I could then see it was responding on UDP port 1346. Apparently just logging on to the system caused it to start accepting data on port 1346 again.
C:\Program Files\Network\Scanning\Scanline>sl -u 1346 192.168.0.14 ScanLine (TM) 1.01 Copyright (c) Foundstone, Inc. 2002 http://www.foundstone.com Scan of 1 IP started at Sat Jul 12 14:09:32 2008 ------------------------------------------------------------------------------- 192.168.0.14 Responded in 0 ms. 0 hops away Responds with ICMP unreachable: Yes UDP ports: 1346 ------------------------------------------------------------------------------- Scan finished at Sat Jul 12 14:09:36 2008 1 IP and 1 port scanned in 0 hours 0 mins 4.02 secs
But when I ran the Ghost task again, it again failed. And when I scanned
the system with ScanLine again, I found the client system was no longer
responding on port 1346. And when I checked from the system itself by
using the netstat command again, I found netstat was no longer
showing it listening on port 1346.
From the client system itself, I ran ngctw32.exe, which is located
in C:\Program Files\Symantec\Ghost. When I ran
ngctw32, the ScanLine program showed it listening on port 1346 as
did netstat. I then reran the Ghost task from the server. This
time the backup started.
