CyberNerd Posted September 13, 2013 Posted September 13, 2013 I have a 12port HP 4500G that is connected via 2xLACP links to the core. From the 12 port HP 4500G are 2x HP 48 port 4500 switches (also via 2GB links) and 3x Wireless AP's. There are 4 or 5 vlans across the switches. Our clients in one of the rooms with the 48 port 4500 PXE boot their operating system (thinstation) over the network tftpboot. Regularly, a couple of times per day, the clients loose connection halfway through their boot. Once a citrix connection is established they are ok and don't loose connection. My first guess is that Citrix is just ok at dealing with flakey connections and tftpboot isn't (UDP??). Rebooting the 4500G temporarily fixes the issue for a couple of hours. hp network node manager tool detects nothing wrong with the 4500G (or the other switches). There is nothing obvious in the logbuffer. Can't see any signs of loops. I didn't notice any flooding of that VLAN. Where else should I look? Should I just get another switch?
twin--turbo Posted September 13, 2013 Posted September 13, 2013 Can you run a steady ping on it, and then spot if that drops out and see if there are any warnings from the switches.. Enabling syslog and having a syslog server may also help. Rob
CyberNerd Posted September 13, 2013 Author Posted September 13, 2013 That's the bizarre thing - it doesn't seem to be dropping any ICMP data, just the tftp booting gets interrupted!? The tftpbooting is working elsewhere in the school just not attached to that switch. No recent config changes. I'll have another look at logs
glennda Posted September 13, 2013 Posted September 13, 2013 I have seen various things with HP switches in that they randomly decide to block a port but don't appear to tell you anywhere that they have done it (hence the reboot or re port works. Are they switches up to date firmware wise?
CyberNerd Posted September 13, 2013 Author Posted September 13, 2013 Are they switches up to date firmware wise? No. I meant to do that. Might give it a go but can't see it's going to help much - no network changes
snoerre Posted September 13, 2013 Posted September 13, 2013 Rebooting the 4500G temporarily fixes the issue for a couple of hours. Do all clients have that disconnect at the same time? I´d suggest do setup a mirror port on the HP and wireshark everything. Perhaps you can see something within the datastream. (Also do a firmware upgrade: https://h10145.www1.hp.com/downloads/DownloadSoftware.aspx?SoftwareReleaseUId=3931&ProductNumber=JE057A , it´s HP and I´ve read too many strange things they fixed in some other switching series I have the last months/years...) 1
CyberNerd Posted September 14, 2013 Author Posted September 14, 2013 Just realised it's actually a 4200G, not that it makes much odds. https://h10145.www1.hp.com/downloads/SoftwareReleases.aspx?ProductNumber=JE015A&lang=&cc=&prodSeriesId= I've just done a firmware update (from home!) and I'll see how that pans out on monday and look at the port mirroring if the firmware didn't help.
plexer Posted September 14, 2013 Posted September 14, 2013 Speak to HP support? one of the first things they'll ask you to do is to upgrade the firmware so the fact you've already done that is good. Ben
CyberNerd Posted September 16, 2013 Author Posted September 16, 2013 The firmware upgrade didn't help at all. I couldn't see anything obvious (to me!) in the wireshark port mirror so I swapped it out with an A5120 (JE73A). While I was unplugging it I noticed one of the PoE injector bricks that was plugged directly into the switch had a red 'fault' light on it - could this be responsible? I'll probably never know as I replaced that too!
Duke5A Posted September 16, 2013 Posted September 16, 2013 I had a similar problem last year. Our phone switches were on the same subnet as instructional machines (don't blame me, it was like this when I got here) and were dropping calls like crazy every morning. I setup a rolling packet capture on the subnet with Wireshark and set a 500MB limit. As soon as the problem cropped up again I went into the capture file and discovered a ton of broadcast traffic coming from a teacher machine in the lab down the hall. It turns out the teacher was starting classroom management software that uses broadcast traffic for student computer discovery. Moving the phone switches over to their own VLAN solved the issue. TFTP is connectionless and the slightest burp will cause it to drop packets.
m25man Posted September 16, 2013 Posted September 16, 2013 I just got one of these to play with, http://www.flukenetworks.com/enterprise-network/network-testing/OneTouch-AT-Network-Assistant Just the thing for finding those types of issues. 1
glennda Posted September 17, 2013 Posted September 17, 2013 The firmware upgrade didn't help at all. I couldn't see anything obvious (to me!) in the wireshark port mirror so I swapped it out with an A5120 (JE73A). While I was unplugging it I noticed one of the PoE injector bricks that was plugged directly into the switch had a red 'fault' light on it - could this be responsible? I'll probably never know as I replaced that too! Do these switches have any sort of basic intrusion detection? Are 4500 comware?
CyberNerd Posted September 21, 2013 Author Posted September 21, 2013 Do these switches have any sort of basic intrusion detection? Are 4500 comware? yes comware, I don't think they have any intrusion detections other than broadcast suppression to counter network storms. Anyhow, I replaced the switch and everything is fine now so I'll write this one up as dodgy hardware.
CyberNerd Posted September 21, 2013 Author Posted September 21, 2013 I just got one of these to play with, OneTouch Just the thing for finding those types of issues. Nice. Looks pricey.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now