All clients lose connection

[carlosmcse]

We have a client that has a cisco 2950 switch and once in a while all computers lose network connection (they can't connect to any resources on their own LAN) all devices have static IP's. In order to everything working again they have to unplug the power from the switch and then turn it back up and they every device can connect to the network with no problem. We have no access to this switch since it;'s managed by their Software vendor. This only happens once or twice a week. What can it possible be wrong? I would like to see the switch logs for any errors collitions etc. I had a problem similar to this before where a NIC on a client pc was sending alot of broadcasts, collitions errors to a switch and the switch blocked all traffic to all ports. can this be the case what should i look for? (If I get access to their switch?)

Thanks in advance for any advice.

 

[bpinning]

Hi,

I you can't get access to the switch, Can you get to a machine on the network?

If you can, Run Etheral Packet Analyser (Free to download and a brilliant peice of software) and see what is flying around the network. You might find a virus or a specific machine spitting out too many packets.

We had this problem a few weeks ago, It was a user doing a scheduled backup over the network after they left at lunch....

Let us know,

Brett

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.eyetstore.com

NSW, Australia
(Unless you want to pay for our trip?)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[chieftan]

Ethereal traces could help to solve this issue.

You need to know if it is the same time each week that this happens.
Also, what is going on at the time that this happens.

Although the following scenario is highly unlikely on a Cisco Cat, it is not impossible:-

If a user / users are performing high transfer intensive work then this can cause CPU and buffering problems on the switch. Check the throughput with ethereal and see how many packets per second are traversing the switch..... the packet size is normally ethernet MTU which is around 1512 bytes. The do the math on this and work out the throughput on the switch. The result should tell you if buffering is being used. The switch will start to buffer when the port is being utilised at around 93 - 95%.

 

[carlosmcse]

I lose connection to everything not anly to the switch, there's no specific time that this happens. If i use the ethereal to capture the traffic don't i have to do something on the switch to be able to see all traffic from all ports, I thought when you use a switch I can only see traffic that is originating from my port and to my port not all ports and all devices connected to the switch. I'm sure it's probably a bad NIC somewhere or probably the buffering. How can i make sure that I can capture all LAN traffic comaing and going to this switch using ethereal?

 

[bpinning]

Ok,

I was thinking more down the line of one specific machine Broardcasting on the network, therefore not having to worry about the port settings on the switch.

But, You can go to the web console of you Cisco Switch and view the ports, then change the port you are on to a monitor port, and you will get all the traffic on the switch.

If it is a bad NIC, its probably broardcasting, try ehteral or Wireshark (As it is now known,

http://www.wireshark.org)

first and then change the port on the switch.

Goodluck,

Brett

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.eyetstore.com

NSW, Australia
(Unless you want to pay for our trip?)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[chieftan]

Yes, you need to set Monitor up and then set the destination port and plug your ethereal machine into that port and then sniff.

Here is the CLI command structure to achieve that:-

monitor session 1 source <specify port range> rx
monitor session 1 destination interface <ethereal port>

As long as you specify the complete port range on the Monitor session command then that will be the entire switch.