Go Back   Technibble Forums > Technical Discussions > Networking

  Technibble Sponsor

Reply
 
Thread Tools Display Modes
  #1  
Old 03-20-2012, 04:32 PM
evlfred's Avatar
evlfred evlfred is offline
 
Join Date: Nov 2008
Posts: 53
evlfred is an unknown quantity at this point
Angry Odd Network Problem- network comes to a halt when server is connected

I setup this network a couple years ago and now it's having a major problem. There are about 10 PC's, 3 printers, and one application dedicated server that just hosts an application they use for patient billing, the application is accessed via HTML and runs solely on the server. There server doesn't handle the network. Everything is connected to a 24 port gigabit switch and the router ( now a DIR-827) handles DHCP. The server is on a static IP below the DHCP range. It seems that the network stops functioning after a while when the server is connected. At first I thought the router was at fault, because they could not get internet access, and the router was taking 10 minutes to power cycle, super slow. I replaced the router but still couldn't get internet access, UNTIL I unplugged the server and rebooted everything. Reconnected the server and everything is fine for a day, then no internet traffic or pinging of the router again. One other symptom, they have to print to the network printers from inside the server hosted application, but the prints stopped coming later in the day and finally printed hours later. Then that night the internet stops working again. It's almost like the server is sending tons of data around and locking everything up, but I have no direct evidence of that. Anyone got any suggestions? I don't admin the server as it's completely handled by the application company.
Reply With Quote
  #2  
Old 03-20-2012, 04:42 PM
Martyn's Avatar
Martyn Martyn is online now
Administrator
 
Join Date: Apr 2010
Location: Bedfordshire UK
Posts: 5,705
Martyn has a spectacular aura aboutMartyn has a spectacular aura about
Default

Are you sure the nic on the server hasn't gone faulty and is flooding the network with packets? Have a look with Wireshark. Just a quick thought.
Reply With Quote
  #3  
Old 03-20-2012, 04:52 PM
ProTech-MN ProTech-MN is offline
 
Join Date: Feb 2010
Location: Blaine, MN
Posts: 330
ProTech-MN is on a distinguished road
Default

Quote:
Originally Posted by Martyn View Post
Are you sure the nic on the server hasn't gone faulty and is flooding the network with packets? Have a look with Wireshark. Just a quick thought.
+1 for sniffing the network. Also, try swapping out the cables, try a different switch port, etc.

-Randy
Reply With Quote
  #4  
Old 03-20-2012, 06:43 PM
kwisher's Avatar
kwisher kwisher is offline
 
Join Date: Nov 2009
Posts: 87
kwisher is an unknown quantity at this point
Default

Does the server have dual NIC's? If so try the other one if you can access it and make the appropriate changes.
__________________
The instructions said "Requires Windows XP or better". So I installed Linux.
Reply With Quote
  #5  
Old 03-20-2012, 06:46 PM
YeOldeStonecat's Avatar
YeOldeStonecat YeOldeStonecat is offline
 
Join Date: Nov 2011
Location: Southeast Connecticut
Posts: 8,086
YeOldeStonecat is a splendid one to beholdYeOldeStonecat is a splendid one to beholdYeOldeStonecat is a splendid one to beholdYeOldeStonecat is a splendid one to beholdYeOldeStonecat is a splendid one to beholdYeOldeStonecat is a splendid one to behold
Default

Is it a decent switch? Might be failing.
cables
server might have malware
workstation(s) may have malware
__________________
Resident "Geek on a Harley" doing IT in Southeast Connecticut
http://www.dynamic-alliance.com/
https://www.facebook.com/YeOldeStonecat
Reply With Quote
  #6  
Old 03-20-2012, 07:39 PM
evlfred's Avatar
evlfred evlfred is offline
 
Join Date: Nov 2008
Posts: 53
evlfred is an unknown quantity at this point
Default

I did just find a trojan with a backdoor on the server, so let's see if it wasn't participating in a DDOS or something. It would be nice if it were that simple.
Reply With Quote
  #7  
Old 03-20-2012, 08:29 PM
rsarceno's Avatar
rsarceno rsarceno is offline
 
Join Date: Jul 2011
Location: Elk Grove, CA
Posts: 994
rsarceno will become famous soon enough
Default

+1 for sniffing the network and avoid guessing.

Disconnect the server form the switch.
Connect a HUB to the switch
Connect the server to the hub
Connect your laptop w/wireshark to the hub
Run Wireshark and analyze the capture.
Wireshark comes with smart analyst if your not familiar reading the capture files.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 05:31 AM.


Powered by vBulletin®
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Technibble.com is based out of MELBOURNE, AUSTRALIA.