#154 added netcnt to the DENYLIST because it started failing, as far as I can tell, running the VM with kvm enabled.
The symptom is that it seems 1 packet too many is sent. Troubleshooting will probably be easier with tcpdump as we could spot what ping believe it is sending.
