Help Center/ Virtual Private Cloud/ FAQs/ Connectivity/ Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?
Updated on 2025-01-17 GMT+08:00
View PDF
Share

Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?

Symptom

Two ECSs in the same VPC cannot communicate with each other or there is packet loss when they communicate.

Troubleshooting

The issues here are described in order of how likely they are to occur.

Troubleshoot the issue by ruling out the causes described here, one by one.

Figure 1 Troubleshooting
Table 1 Troubleshooting

Possible Cause

Solution

Security group rules

See Security Group Rules

Network ACL rules

See Network ACL Rules

ECS's network interface configuration

See ECS Network Interface Configuration

Port unreachable

See Port Unreachable

Security Group Rules

Check whether the security group rules of the ECS's network interface allow the outbound and inbound ICMP traffic.

Take the inbound direction as an example. The security group rules must contain at least one of the following rules.

Figure 2 Inbound security group rule

If packets of other protocols are tested, configure the security group rules to allow the corresponding protocol traffic. For example, if UDP packets are tested, check whether the security group allows the inbound UDP traffic.

Network ACL Rules

  1. Check whether the subnet of the ECS's network interface has an associated network ACL.
  2. Check the network ACL status in the network ACL list.
    • If Disabled is displayed in the Status column, the network ACL has been disabled. Go to 3.
    • If Enabled is displayed in the Status column, the network ACL has been enabled. Go to 4.
  3. Click the network ACL name and configure rules on the Inbound Rules and Outbound Rules tabs to allow the ICMP traffic.
  4. If the network ACL is disabled, all packets in the inbound and outbound directions are discarded by default. In this case, delete the network ACL or enable the network ACL and allow the ICMP traffic.

ECS Network Interface Configuration

The following procedure uses a Linux ECS as an example. For a Windows ECS, check the firewall restrictions.
  1. Check whether multiple network interfaces are configured for the ECS. If the ECS has multiple network interfaces and the EIP is bound to an extended network interface, configure policy-based routes for the ECS.

    For details, see How Do I Configure Policy-Based Routes for an ECS with Multiple Network Interfaces?

  2. Log in to the ECS and run the following command to check whether the network interface has been created and obtained a private IP address. If there is no network interface information or the private IP address cannot be obtained, contact technical support.

    ifconfig

    Figure 3 Network interface IP address
  3. If the CPU usage exceeds 80%, the ECS communication may be adversely affected. Run the following command to check whether the CPU usage of the ECS is too high:

    top

  4. Run the following command to check whether the ECS has any restrictions on security group rules:

    iptables-save

  5. Run the following command to check whether the /etc/hosts.deny file contains the IP addresses that limit communication:

    vi /etc/hosts.deny

    If the hosts.deny file contains the IP address of another ECS, delete the IP address from the hosts.deny file and save the file.

Port Unreachable

  1. If a port of the ECS cannot be reached, check whether the security group rules and network ACL rules enable the port.
  2. On the Linux ECS, run the following command to check whether the ECS listens on the port: If the ECS does not listen on the port, the ECS communication may be adversely affected.

    netstat -na | grep <Port number>

Submitting a Service Ticket

If the problem persists, submit a service ticket.

Parent topic: Connectivity