Cannot wake up agent from EPO, agent listening only on IP v6

[Former Member]

We have mcafee agent service TCP only listen on IPv6 address port 8081. Have tried different agent version 5.0.5, 5.5.0 5.5.1,restart the servicesdisable windows firewall and hips but doesnt help.

Found in the log as 

http.server listening to IPV6 only socket.

Telnet localhost 8081 works but 127.0.0.1 doesnt obviously. Hence, we cannot wake up agents from epo.

Wondering if something on the OS level that I need to change or the McAfee agent 

OS:windows 2012 r2

[Hem]

Hi,

Please  send wakeup call and share ePO server log.

[Former Member]

error code found in epo log as 10060 and -999. the task eventually timed out with 'unknow error'. IPV6 is disabled on the server. 

[cdinet]

If IPV6 is disabled on epo server and the client is only using IPV6, you won't be able to send wakeup calls over that method. 

In epo server settings, agent contact method, what is that set to?  If IP address is first, move it to last and see if that helps.  Does nslookup for the client by netbios name resolve?

[Former Member]

problem is not on the epo side, its the agent service binding to IP v6 socket only not ip v4. Regardless of agent contact method , wake up will never work. I am seeking if there is a way to force it to bind to IP v4 or its somewhere in the OS. 

netstat shows agent service pid on [::] not 0.0.0.0 while ipv6 is disbled.

[cdinet]

Is IPV4 enabled on the client?  Have you tried disabling ipv6 on the client?

[Former Member]

correct IPv4 is enabled, mcafee agent can initiate the communication with epo just fine (from agent monitor) IP v6 is disabled.

[cdinet]

Is that the only system doing that or others?  That is very strange and sounds like an OS issue.  The agent binds to the network interface that the OS identifies.  Possibly something going on with that network stack on the server if that is the only one affected.

[Former Member]

there are couple of more boxes having the exact same problem which is quite odd 🙂

[cdinet]

Yes, it is.  I don't even know if Wireshark or tcpview would show what is going on.  Try running tcpview to see what is listening on your wakeup port.  It might be possible that there is something else listening on that port and preventing the agent from binding to it.  You might also want to put the agent in trace logging mode (kb82170).  When you put it in trace mode from command line, you have to check the agent logs for the word trace.  If it isn't there yet for new entries, restart the agent services.  That will then stay in trace mode till next restart of services. The macmnsvc log might show errors listening to that port.