StarDestroyer.Net BBS

Posted: **2005-06-07 02:33pm**

Well not really anymore, let me begin by giving you an idea of the network I am working in. You see in our LAN at work all computers have an internal IP only, a 192.168.xxx.xxx deal, the LAN is connected to the internet via a (D-link)router that acts as a firewall and gateway.
From that router there is one wire that connects the gateway to a main switch elsewhere and one that goes to a WLAN transreciever and one to the boss' son's laptop.

Now lately we've been having connection problems, internet access dies off now and then, pinging the gateway yields a timeout, what I've done so far when this happened was to pull the plug on the gateway and restart it, fixes it for a while, sometimes it might fix itself too.
I was getting fed up with this though and I asked the people who created this whole setup what todo, according to them the Gateway and the main switch had communication issues, something about switching from 10/100 properly or something, so they added a 10mps hub as a buffer between the switch and gateway, however after some redesigning this hub was gone.
Anyone know what they mean? They where very vauge

However they sent a completely new switch and it was up to me to install it, well this was my first time ever doing anything like this, I just put the connections from the old into the new in the same numbered places(in retrospect useless gesture since the printed list was so old and outdated it was wrong anyway).
So after popping it in the net works, then stops, the boss and others complain about certain programs(that access a database on a server) being very slow after the new switch got installed.

I had no idea what to do, asking the guy who sent me the thing he said there is probably a computer somewhere putting a heavy strain on the network or having some other problems, well ok.

Now to figure out how figure that out

Well I got a program called LANSPY and scanned the whole network range and took down the IP numbers and MAC addresses, I tried to access the switch but it didn't have an IP number, this meant I had to connect to it using a serial cable, too bad the cable was not long enough and the only laptop I could use had no serial port. I had to put the old switch back, take the new one to my workstation and work on it, put the new switch back and then telnet into it.

I didn't much get anywhere except that the network kept working sporadically but sometimes I couldn't ping the switch but I could ping the gateway even though the path to the gateway goes through the switch

Then I manually map all the ports to the right computers and hubs and printers, that was just pretty much taking out a connection from the switch, ping switch from machine I am testing(or ping printer from other machine) and repeat.

I noticed just now that doing that was really useless since I accessed my workstation from home with SSH and telneted into the switch again just to look around and I saw it had a list of the MAC addresses of machines connected to various ports, dammit, using the earlier report from LANSPY I could have compared MAC addresses to IP numbers and gotten this whole thing done much faster.

Well anyway I disconnect my boss' son's laptop and the problems stop occuring, it seems that his computer is the cause of all this bullshit, the slow programs started moving as they should and all.

What the hell is up with his laptop? What can cause it to behave like this?

Hmm, I guess this is more like a log than a question thread... ops.

Actually I do have some other questions too, how much do I need XP SP2 anyway? I don't want to loose raw socket support. And are there any good(and free) programs for analysing network traffic?

Posted: **2005-06-07 03:16pm**

You are in luck.

Okay first off some useful tools.

Install this first
Winpcap Network Packet capture

And then install
Ethereal Protocol analyzer

A easy tool to use but the output can be hard to decode if you don't know what you are looking at.

But check out these settings first.

Because you have changed the router a lott of settings might have been lost, and if the computers connected to the old router was on static ip and or not rebotted after the change a lot of stuff might be wrong right now.

Connect the old router and check the firewall settings in it, copy those to the new router.

Check all cables and connections.

Remove the switch connected from the WAN and to the router

Check the if the DHCP server is running on the router.

Renew the DHCP lease on all clients.

Verify the DNS adresses

Reboot the cpmputers

Try pinging other clients at the ip adress

If still no joy give more info about the problem.

Edit

Damn I only read half the problem description, ahh well.

And if the laptop kill the network it is usually one of two things.

1. A shitload of trojans/viruses doing funky crap on the network. CHeck the laptop for trojans and viruses.

2. A broken NIC the is broadcasting like there is no tomorrow, unusuall but it hapens. Change the NIC.

Posted: **2005-06-07 03:35pm**

Faram wrote:You are in luck.

Okay first off some useful tools.

Install this first
Winpcap Network Packet capture

And then install
Ethereal Protocol analyzer

A easy tool to use but the output can be hard to decode if you don't know what you are looking at.

I did install those, couldn't make heads or tails of it.

Because you have changed the router a lott of settings might have been lost, and if the computers connected to the old router was on static ip and or not rebotted after the change a lot of stuff might be wrong right now.

Connect the old router and check the firewall settings in it, copy those to the new router.

Check all cables and connections.

Remove the switch connected from the WAN and to the router

Check the if the DHCP server is running on the router.

Renew the DHCP lease on all clients.

Verify the DNS adresses

Reboot the cpmputers

Try pinging other clients at the ip adress

If still no joy give more info about the problem.

The switch that I replaced did not handle any such things, it was merely coordinating traffic, all that DHCP stuff is handled elsehwere.

Maybe by the gateway, I am not sure(that D-link router i mentioned). The people who we have our internet link with handle that one, I don't even have access to it, all the info for the DNS servers comes from elsewhere too, our supplier handles that part, I am not sure if one router can be set up to all that.

All computers have DHCP except my computer, because I always need to have 192.168.111.5 for other reasons, the webserver which has .10, two printers, the gateway/firewall and switch(.2 and .3)

The problem as I mentioned was anyway tracked to the boss' sons computer, it was his computer that for some reason manages to bring the gateway(and thusly all non-internal communication) crashing down in the most bizzare manner, I would like to have a program watching network traffic and see if it goes bizzarro when I plug in the malfunctioning client, did ran something called toolbox or such, seemed to show alot of good info but not alot of it, but since my workstation is connected to a secondary hub I doubt it's in the best place to sniff the network.

I guess I'll go look and see if Etheral has some way to making sense of all the data it captures.

EDIT: I see you edited, me too.

Posted: **2005-06-07 03:53pm**

If an other computer is running DHCP be sure to disable it in the D-Link.

The default scope for dlink is

192.168.0.100-254/24
192.168.0.1

And when your computer is using 192.168.111.x then the D-Link as a disaster vaiting to hapen.

Open TCP, 80 Wan- 192.168.111.10 if you want the webserver on the net.

And I can decode the Ethereal log data for you, only 700skr/h min 4h.

Posted: **2005-06-07 03:55pm**

Oh and a easier NW scanner is

Languard, nice to find open ports and stuff on a network.

Posted: **2005-06-07 04:09pm**

Faram wrote:If an other computer is running DHCP be sure to disable it in the D-Link.

The default scope for dlink is

192.168.0.100-254/24
192.168.0.1

And when your computer is using 192.168.111.x then the D-Link as a disaster vaiting to hapen.

Open TCP, 80 Wan- 192.168.111.10 if you want the webserver on the net.

Uhm, the webserver is on the net, always has been.
Our network is functioning fine, it has functioned fine for years, the problems where recent and they where fixed, my queries all had to do with how it could have happened and my plans for running tests on it.

Also as I said, I do not have access to the D-link, our internet supplier handles it and I do not have the password or anything. And our internet supplier knows I have static IP on my comp and has never said anything about it.

Personally I don't see why the DHCP would have a problem with a few static IP's, I mean if 192.168.111.5 is taken it's not like the DHCP server would actually hand it out to a client that is connecting, infact it seems to give the same clients the same IP's when they log on even though they have DHCP, there are also only like 12 computers on the network.

All the computers are running DHCP except:
My workstation(192.168.111.5)
Gateway(192.168.111.2)
The switch(192.168.111.3)
Two printers(192.168.111.11 and .180)
Webserver(192.168.111.10)

I don't see why the DHCP server would give out IP's already in use on the network, never has so far either.

Posted: **2005-06-07 04:20pm**

Your LAN IP

192.168.111.x

D-Link DHCP Enabled buy deefault.
192.168.0.x

If any client gets a DHCP adress from the D-Link it will not and can not connect to any other network resource.

Two DHCP servers in one network segment is a BAD idea, and Yes I know clients connected to an AD are only supposed to pick up DHCP adresses from an authenticated server, but do not count on it.

Blah missed the part that it came preconfiged to you.

I suppose that the have disabled the DHCP servver in it if they have any scense, to damn tired I suppose.

Posted: **2005-06-07 04:28pm**

Oh you mean in that way, well I guess the people who set it up made sure it only used the 111.xxx range because every client on our network gets their IP's from the D-link, it's always given IP's in the 111 range, infact I am utterly sure this is on purpose.

I mean this setup has been working for years like this, I don't understand why default settings are involved? I can't even change any settings on it, the D-link has been there for ages you know, set up properly by the networking guys who we get net access from.

The new part I have been talking about was another switch that performs no such functions whatsoever, it's just a big hub, also where are you getting the idea we have two DHCP servers?

Posted: **2005-06-07 04:32pm**

His Divine Shadow wrote:Oh you mean in that way, well I guess the people who set it up made sure it only used the 111.xxx range because every client on our network gets their IP's from the D-link, it's always given IP's in the 111 range, infact I am utterly sure this is on purpose.

I mean this setup has been working for years like this, I don't understand why default settings are involved? I can't even change any settings on it, the D-link has been there for ages you know, set up properly by the networking guys who we get net access from.

The new part I have been talking about was another switch that performs no such functions whatsoever, it's just a big hub, also where are you getting the idea we have two DHCP servers?

Complete and utter misunderstanding, I thought the D-Link was replased.

Damn I shold not post while tired..

Posted: **2005-06-07 04:39pm**

Well that laptop is foobaring the gateway somehow.

I will check out etheral more closely but I think the computer doing the sniffing might be required to be connected to the same hub the laptop is.

Just a hunch

Posted: **2005-06-08 03:44am**

Dammit, the problems came back this morning and apps that accessed databases over the lan where really slow, and that laptop had been out all day and night, I telneted into the switch and checked the port stats, hmmm...

Code: Select all

            Allied Telesyn Ethernet Switch AT-8024 - AT-S39 v3.3.1
                                  Kontors Switch
Login Privilege: Manager
                             Display Port Statistics
STATISTICS   Port 1     Port 2     Port 3     Port 4     Port 5     Port 6
TOTAL_COUNT. 8889387    8756759    55122856   6382504    1044509    282995
TX_COUNT.... 7437491    7329289    11102227   1287059    933297     270897
RX_COUNT.... 1451896    1427470    43229516   5095388    111212     12098
RX_BRDCAST.. 81         273        388        66         34         16
RX_MLTCAST.. 7          5          0          0          0          0
RX_UNICAST.. 9260       7903       59160      6935       1640       91
RX_OVERFLOW. 0          0          0          0          0          0
CRC_ERROR... 0          0          425        0          0          0
UNDERSIZE... 0          0          0          0          0          0
FRAGMENT.... 0          0          325        1          0          0
PRT_DISCARD. 0          0          13224      0          0          0

Check out the CRC errors on port 3, none of the other ports have any CRC errors at all.
Port 3 is connected to a 100mbit hub that is in turn connected to my computer, webserver, and more.

What I did was to replace the hub, I have a small 10mbit hub there instead now and the network is now functioning properly and no more CRC errors have occured.

Posted: **2005-06-08 04:01am**

Any other port having those problems?

Do you run any taged or untagged vlan on that switch? If so for errorcheking clone port 3 to some other port if you have any free and move the etherenet cable to that port.

Othervise just move the cable to any free port and see if you get the errors there.

Posted: **2005-06-08 04:19am**

Nope, this is the only port with CRC errors.

Well I replaced the hub connected to port 3 about 2 hours ago and no more problems have occured.

I am new to this software but I can see port 3 is running on half-duplex

Code: Select all

Prt Link Neg    MDIO Spd  Dplx        PVID VLanID Flow     State
----------------------------------------------------------------------
001 Up   Auto   MDIX 0100 Full-Duplex 00001 00001 None     Forwarding
002 Up   Auto   MDIX 0100 Full-Duplex 00001 00001 None     Forwarding
003 Up   Auto   MDI  0010 Half-Duplex 00001 00001 None     Forwarding
004 Up   Auto   MDIX 0100 Full-Duplex 00001 00001 None     Forwarding
...
...

Bad cable or is it this small 10mbit hub I use as a temporary replacement that causes it to go half-duplex?

And it appears I am running tagged mode:

Code: Select all

                                System Config Menu

1 - MAC Aging Time .................... 300 seconds
2 - Switch Mode ....................... Tagged
3 - Console Disconnect Timer Interval . 10 minute(s)
4 - Web Server Status ................. Enabled
5 - SNMP Access ....................... Disabled
6 - Console Startup Mode .............. Menu
7 - Reset to Factory Defaults

Posted: **2005-06-08 04:35am**

His Divine Shadow wrote:Nope, this is the only port with CRC errors.

Well I replaced the hub connected to port 3 about 2 hours ago and no more problems have occured.

I am new to this software but I can see port 3 is running on half-duplex
Code: Select all
Prt Link Neg    MDIO Spd  Dplx        PVID VLanID Flow     State
----------------------------------------------------------------------
001 Up   Auto   MDIX 0100 Full-Duplex 00001 00001 None     Forwarding
002 Up   Auto   MDIX 0100 Full-Duplex 00001 00001 None     Forwarding
003 Up   Auto   MDI  0010 Half-Duplex 00001 00001 None     Forwarding
004 Up   Auto   MDIX 0100 Full-Duplex 00001 00001 None     Forwarding
...
...
Bad cable or is it this small 10mbit hub I use as a temporary replacement that causes it to go half-duplex?

And it appears I am running tagged mode:

I would bet on the hub.

Did you use the uplink/cascade port on the hub? usually port one or a port next to port one wo any number.

Also check if there is a small button to press next to the port.

And why use a hub? Buy a small switch! they are cheap!

His Divine Shadow wrote:

And it appears I am running tagged mode:

Code: Select all

                                System Config Menu

1 - MAC Aging Time .................... 300 seconds
2 - Switch Mode ....................... Tagged
3 - Console Disconnect Timer Interval . 10 minute(s)
4 - Web Server Status ................. Enabled
5 - SNMP Access ....................... Disabled
6 - Console Startup Mode .............. Menu
7 - Reset to Factory Defaults

Well the switch is running in taged mode but it might or may not be enabled on the ports.

Check the port config if it is running taged vlan.

EDIT
Meh port 3 is running vlan with tag1.

If you move the cable to any other port make sure to use vlan1 on that port.

EditEdit
Typos...

Posted: **2005-06-08 04:45am**

Faram wrote:Did you use the uplink/cascade port on the hub? usually port one or a port next to port one wo any number.

The wire from the switch was in port nr. 1, port nr. 8 has a switch next to it that allows you to change from MDI to MDI-X, I think 8 might be the uplink port, and I think it should be MDI since it's going to a switch and not a PC.

And why use a hub? Buy a small switch! they are cheap!

This was all there was at hand to use, its temporary.

Port 3 settings seems fine:

Code: Select all

Configuring Ports 3
0 - Description .......
1 - Status ............ Forwarding
2 - Negotiation ....... Auto
5 - Flow Control ...... None
6 - Advertise 10FDX ... Yes
7 - Advertise 10HDX ... Yes
8 - Advertise 100FDX .. Yes
9 - Advertise 100HDX .. Yes
M - MDI/MDIX Mode ..... Auto
C - Broadcast Control . No Broadcast Control

Posted: **2005-06-08 04:52am**

His Divine Shadow wrote:
The wire from the switch was in port nr. 1, port nr. 8 has a switch next to it that allows you to change from MDI to MDI-X, I think 8 might be the uplink port, and I think it should be MDI since it's going to a switch and not a PC.

Use the MDI-X port to cascade the hub to the switch.

Posted: **2005-06-08 04:55am**

Really I should set it to MDI-X mode? Weird that it says "To PC" under that choice.

Posted: **2005-06-08 04:59am**

His Divine Shadow wrote:Really I should set it to MDI-X mode? Weird that it says "To PC" under that choice.

HP Info on MDIX

StarDestroyer.Net BBS

Networking woes

Networking woes