What failure brings down whole LAN including routers? 1

[DROFNUD]

Last week we had a good one. Can anyone suggest a reason:

The network at the office I am in is a switched LAN, with two or three hubs. There is a router connecting it to the WAN. Pretty straight forward.

Last week the entire network went down. Workstations couln't talk to local servers, and the external interface to the router (WIC1T) was inaccessible from the other offices.

By disconnecting portions of the network we isolated the problem to one switch and eventually to two devices. One workstation and One server. Plug either into the LAN and it goes!!!. Repatched the server to a diffeent port - Same thing, Plugged the server into the test network (with a different local cable) and it did the same on that LAN.

A support guy from another office; unhappy we had unplugged his server took it to another office - plugged it in and it is fine. I'm a bit worried it might happen again though.

We have not reconnected the workstation yet.

What sort of failure would affect a switched LAN and bring down a router? What sort of failure could affect two devices (PC and server) at the same time? What should I test? and how?

I'd be grateful for any advice guys/gals...

 

[rburke]

Well, I've seen this kind of thing if it is a trojan virus that someone is activating to take part in a DoS attack. It took down our entire T1 and 100 Mbps LAN once. Have you checked for viruses? If not one f the best places I've found that is FREE is housecall.antivirus.com, it is owned by Macafee, but it is free and online... As for the reason that it worked at the other office is becuase if it is a virus the host hasn't activated it. That would be my guess as to the situation. When the problem was happening did you notice alot of activity? Anywyas that's my theory.. I would check out that workstation though before putting it back on the LAN.

Burke

 

[telcoadmin]

Another possibility to consider. We had a very similar occurence happen in one of our maunfacturing facilities (pretty large, 1000 plus clients). EVERYTHING was down for a few minutes periodically. It turned out to be a spanning tree issue. We had someone using a Windows XP laptop with a wireless NIC and a wired NIC both installed and active (the wired being in his docking station, etc.). The problem is that he had enabled the "bridging" capabilities of the laptop, so the device was attempting to bridge all traffic from the wireless network to the wired, etc. THIS CHANGE IN NETWORK TOPOLOGY was enough to reset the entire spanning tree for our network, causing minutes of network inacessibility while the tree was rebuilt, etc. I don't know what sort of switching equipment you use, but there should be a way to check the status of the spanning tree protocol on your network. In our case, the 6509 switch reported that the spanning tree topology had changed and even listed the station that initiated the request. Here is sample output from our switch after issuing the command "show spantree statistics 3/1":


VLAN based information & statistics
spanningtree type ieee
spanningtree multicast address 01-80-c2-00-00-00
bridge priority 32768
bridge mac address 00-d0-d3-83-a4-00
bridge hello time 2 sec
bridge forward delay 15(15) sec
topology change initiator: 1/1
last topology change occured: Fri Jul 18 2003, 07:03:13
topology change FALSE
topology change time 35
topology change detected FALSE
topology change count 276
topology change last recvd. from 00-01-96-0f-fe-f1

The "topology change last recvd. from" in the case I spoke of indicated the laptop. From there, we found the laptop and figured out what was going on, etc. Anytime a local area network experiences strange, periodic fits of inaccessibility, spanning tree should be considered.

--Daniel.