Kenny Long wrote:
Mike,
Will you provide us with a bit more information? How many of these
misbehaving servers do you have? Are they all on the same broadcast or
switching domain or are they on different networks separated by routers? Do
they all start up the problem at the same exact time? Do you have an
unmanaged or managed switch that these are plugged into? When the problem
occurs, run a "tcpdump -i eth0 -vvvn" where eth0 is the NIC in question.
Then try to ping the server in question from another box on the network, and
see if the server in question is receiving the ARP requests. If its not, it
wouldnt seem likely the problem belongs to the server, but elsewhere in the
network. If you are seeing the ARP requests but your server is not
responding to them, then we can work from there.
There are a total of 4 machines that I have seen this problem on. They
are in different broadcast domains and completely different datacenters.
3 are running Linux but I messed with those a while ago and I haven't
seen the problem lately on them. Or at least no one has complained. :)
The one that is causing problems is the one Windows box. I installed
Wireshark on it and started watching the interface for ARP packets. When
the machine was unresponsive from other machines, I tried arping'ing it
and there were no ARP packets seen on the interface. I opened firefox
and it went to is default home page. When I did this, I saw the ARP
packets that were generated by the box and the responses from the
network. So what it is looking like is that the network is not sending
the ARP 'Who Has' broadcast packets down the link to this box. I'll need
to bug the net admins about this. The network is pretty much all Cisco
catalyst gear. I don't have the ability to get into the switches and
routers to see what traffic is going across the links. But I will get
someone to look at that.
Thanks for the suggestion on where to look. I should have thought of
that sooner.
Mike
/*
PLUG: http://plug.org, #utah on irc.freenode.net
Unsubscribe: http://plug.org/mailman/options/plug
Don't fear the penguin.
*/
