imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 I've downloaded this thing called wireshark, would it help if I posted some of the results from it from my server?
TheMinister Posted June 1, 2011 Posted June 1, 2011 Wireshark will capture every packet, either sent or received from the server. There should be millions of packets travelling back and forth every day. To filter through them all is a long and arduous task. Log into the web interface of the switches and check their ARP tables. Most switches will give you statistics and LOGS of what the device has been doing. You can trend what's happening from there.
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 is an average of 4400 packets per second a lot?
TheMinister Posted June 1, 2011 Posted June 1, 2011 Depends on what this server hosts and how much load is being produced. Work the theory the opposite direction - ping from the server to another device (router, switch or printer) and see whether it drops packets. Wiresharking the server won't help you with diagnosing if a switch is your issue. You need to view the logs of the device.
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 Ok, thanks for all your help! The staff will be coming in soon so hopefully the problem has passed and shit doesn't hit the fan once again
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 This is what I get when pinging the router... Reply from 192.168.0.1: bytes=32 time=822ms TTL=64 Reply from 192.168.0.1: bytes=32 time=1778ms TTL=64 Reply from 192.168.0.1: bytes=32 time=806ms TTL=64 Reply from 192.168.0.1: bytes=32 time=1241ms TTL=64 Reply from 192.168.0.1: bytes=32 time=537ms TTL=64 Reply from 192.168.0.1: bytes=32 time=688ms TTL=64 Reply from 192.168.0.1: bytes=32 time=418ms TTL=64 Reply from 192.168.0.1: bytes=32 time=1002ms TTL=64 Reply from 192.168.0.1: bytes=32 time=926ms TTL=64 Reply from 192.168.0.1: bytes=32 time=299ms TTL=64 Reply from 192.168.0.1: bytes=32 time=609ms TTL=64 Request timed out. Reply from 192.168.0.1: bytes=32 time=380ms TTL=64 Reply from 192.168.0.1: bytes=32 time=436ms TTL=64 Reply from 192.168.0.1: bytes=32 time=1056ms TTL=64 Reply from 192.168.0.1: bytes=32 time=886ms TTL=64 Ping statistics for 192.168.0.1: Packets: Sent = 338, Received = 314, Lost = 24 (7 Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 2537ms, Average = 433ms
bodminman Posted June 1, 2011 Posted June 1, 2011 That doesn't look good at all. The time is way too high and having requests timing out indicates something wrong too. Try pinging the router from different machines that are plugged into the different switches. What's the result?
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 Getting the same sorts of numbers from different machines. When it goes that high our IP phones cut off too and the internet becomes unavailable. It will be fine for a few minutes, latency under 1ms, then suddenly we get a surge for a minute or two of high latencies. Could the router be creating lots of unnecessary traffic? This only seems to happen when we have lots of people logged on, like now, this morning when only a few staff were on it was working fine.
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 Here is a trace route btw: Tracing route to 192.168.0.1 over a maximum of 30 hops 1 414 ms 284 ms 608 ms 192.168.0.1 Trace complete.
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 That is my workstation > switch > router I believe.
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 Here are the trace routes from my workstation to a computer on the top floor ( me > switch > switch > workmate) And then me > switch > server : Tracing route to Halil-Turkey [192.168.0.8] over a maximum of 30 hops: 1 1 ms <1 ms <1 ms Halil-Turkey [192.168.0.8] Trace complete. C:\Users\Tom>tracert 192.168.0.253 Tracing route to EAL-CORE [192.168.0.253] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms EAL-CORE [192.168.0.253] Trace complete.
Dos_Box Posted June 1, 2011 Posted June 1, 2011 But why would the internet fail? Since the server and router are not connected to each other, they are both on separate ports on the switch BTW, each workstation is configured with the server as primary DNS, and the router as secondary DNS. The internet fails because all of the clients look to the server for DNS resolution when looking for web sites. No server, no internet.
SYNACK Posted June 1, 2011 Posted June 1, 2011 Your router could well be some of the problem, can you connect to it directly and try the same thing?
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 Thanks for your advice, going to buy another router in a moment. So is it bad practise to have the router set as one of the DNS servers in a client config? Should I just have the server as the DNS?
eduabncs Posted June 1, 2011 Posted June 1, 2011 (edited) Thanks for your advice, going to buy another router in a moment. So is it bad practise to have the router set as one of the DNS servers in a client config? Should I just have the server as the DNS? Simple answer is yes. Better to set the server to be the DNS for the network configued with fowarders to your ISP DNS servers. Edited June 1, 2011 by eduabncs
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 RIP was off, would that have made a difference? It's on now and seems to be well :/
imperium2335 Posted June 1, 2011 Author Posted June 1, 2011 never mind still have massive latencies occasionally
SYNACK Posted June 1, 2011 Posted June 1, 2011 Those latencies are horible, it almost makes an NZ internet connection look plausable in comparison. Can you get into the router and check its CPU usage/memory usage. Some are really bad at filtering stuff like multicast traffic and will cap themselves unhelpfully.
RW_LUNS Posted June 4, 2011 Posted June 4, 2011 (edited) never mind still have massive latencies occasionally Mate, looking at those RTT's and loss, I'd say there is a good chance that there is a loop on your network somewhere. A switch could be looped back to itself with a patch cable or there might be a ring of switches ending up back at the original switch. Have you mapped out your network or anything to check for something like this? You could also try disconnecting portions of your network (out of hours) to narrow down (in a crude way!) which part of the network is causing the problem. Do you get similar ping results if you hit other devices around your network? (this would rule out if the problem was a misbehaving router or an internal network issue) p.s. I should add - the size of your network is well within reasonable levels and I wouldn't necessarily suggest VLANs would help except to possibly break a layer 2 loop Edited June 4, 2011 by RW_LUNS add p.s.
ricki Posted June 5, 2011 Posted June 5, 2011 Hi My guess is that its something bombarding the network and a switch is crashing and rebooting. Have a look in the event logs of the servers for indications things like event id 2012 errors or connectivity errors. Snif the traffic using wireshark Wireshark · Download and then analyses it using the free version of capsa. Free Network Analysis Tools, Free Network Analyzer Download, Free Network Sniffers Download, Free Protocol Analyzer Download - Colasoft Try turning on tree spanning on the switches to stop loops. Also look for flashing lights on the switches instead of twinkling lights it could indicate a loop.
ricki Posted June 5, 2011 Posted June 5, 2011 Hi Be careful about pinging swtiches they priorities traffic so this might not be an indication of problems try pinging the server. Richard
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now