Todd Pearsall wrote:
If you shrink the MTU on an internal system and it suddnely starts working, you'll at least know that's the problem you're fighting.Have you tried changing the MTU on your internal machines, and/or sniffing the traffic to see what it looks like?
I haven't tired changing the MTU of the internal machines. The office is one of our consulting offices so our folks from other offices are frequently roaming through with laptops. At any one moment only about half the people on the network are actually consistently in that office, so changing the MTU of everyone who comes in will be a pain and then will leave them "less than optimal" when they go somewhere else, unless they change it back. That being said, if it's valuable from a troubleshooting standpoint I definitely can change the MTU of a machine for testing.
Note that a slightly smaller MTU is not all that terrible...I run the MS machines in my office with a smaller than 1500 MTU to keep my VPN performance up. The slightly higher overhead for large downloads (or copies on the local lan) is not noticable, and while a smaller MTU will marginally reduce the bandwidth capacity of ethernet, if you're pushing that envelope you have lots of other issues.
I can't tell you what to look for other than you want to try and capture "broken" traffic. If you've told us what sort of traffic this is (web browsing, file-sharing, e-mail, ftp, whatever), I don't recall.I suspect you'll make more headway by sniffing your problematic traffic at this point...once you figure out what's wrong, an appropriate fix will likely present itself.
I will grab tcpdump and run it on the router to look around. Any hints on what I'm looking for? I've only every used tcpdump to verify that traffic was being encrypted so I may be in over my head on using it to troubleshoot.
I'd run tcpdump with the -n (or possibly even -nn) switch to keep the generated logs more readable. The intermixed arp and icmp traffic can be confusing, but is typically important. There's also the potential for lots of non-related traffic to clutter things up, confusing things even more.
If you can't figure out what's going on, post a chunk of the tcpdump output along with a description of what you were trying to test at the time (and what other things might have been happening in the background), and we can try to help decode it. Don't try to be helpful and pull any lines from the tcpdump...you might pull something significant and not realize it.
--
Charles Steinkuehler
[EMAIL PROTECTED]
-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
