Network cuts out every 10-15 minutes

[nerd2u]

Hey guys have an odd one here. Have a customer whose network keeps dropping network connectivity every 10-15 minutes until they unplug everything and plug it back in.

I have checked all the cables and changed the switch and had the ISP change the modem still occurs.

Any ideas guys?

Sent from my SM-G870W using Tapatalk

 

[backwoodsman]

It seems unlikely everything needs to be unplugged & replugged to make it work. Unplug & replug one thing at a time until you find the problem. My money would be on some chip in something that's getting flaky when it gets warm.

 

[seedubya]

@backwoodsman 's answer will work if the network is small enough. There really isn't enough here to go on but, given all you've said, my first guess would be that something is flooding the network periodically. I'm making the assumption that, since you've replaced the switch, that there aren't any lookbacks. A managed switch, even temporarily, should help you to isolate the port and thus device that's causing the issue.

 

[backwoodsman]

my first guess would be that something is flooding the network periodically.

That was my next guess. The networking I do is mostly small stuff, so I tend to get tunnel vision.

 

[nerd2u]

That's my guess as well.

I have narrowed it down to a single port but it doesn't seem to matter what I plug in to that port the network comes down after a while.

Going to have to run some packet captures and actually get into the modem to take a look.

I thought loopback but I toned everything out and it's all 1 to 1.



Sent from my SM-G870W using Tapatalk

 

[fencepost]

Yep, and at a very basic level you might be able to just watch the blinkenlights to see if it seems like something's storming the network.

Still, ports fail, or if it's an older switch something may have whiskered across in an unfortunate way. Block the port, or just replace the switch if it's that small a network. Don't spend hours of billable time if you can replace it with a $100 switch and 15 minutes of installation.

 

[glennd]

I have checked all the cables and changed the switch and had the ISP change the modem still occurs.

I have narrowed it down to a single port

There seems to be some confusion here. you swapped the switch in the first post and the problem persisted but later decided it was a specific port on the switch.

I'm curious to know what kind of internet connection it is, cable, dsl, whatever else there is in your country... ??

 

[nerd2u]

I have replaced the switch and moved the affected cable to a new port same results.

I tried a different PC on the same drop thinking the pc was the cause and the same thing happened with a new PC.

I have to dive in a bit deeper to see what is causing the issues.

So far I have changed the modem, switch, cable, tried different ports different PC's.

There are 2 XP boxes on this network with no security I'm getting the feeling one or both is infected.

Going to pull them both to see if it helps.

Going to take a look at the modem too.

Biggest issue is this isn't my network and it's a mess with old hardware all over the place crappy cabling.

I'm going to go back and do some packet scanning and remove boxes and reapply 1 at a time while watching the packet scan.

Sent from my SM-G870W using Tapatalk

 

[nerd2u]

There seems to be some confusion here. you swapped the switch in the first post and the problem persisted but later decided it was a specific port on the switch.

I'm curious to know what kind of internet connection it is, cable, dsl, whatever else there is in your country... ??

Sorry it's not a specific port on the switch rather a specific drop. I have tested the cabling for this drop and it has passed all my test. Doesn't matter where I move this drop on the switch it causes problems.

It is a ADSL connection.

Have to do some more testing. Trying to convince the client they need to improve the network setup and replace XP machine but of course there is no money.

Sent from my SM-G870W using Tapatalk

 

[glennd]

Sorry it's not a specific port on the switch rather a specific drop. I have tested the cabling for this drop and it has passed all my test. Doesn't matter where I move this drop on the switch it causes problems.

It is a ADSL connection.

Have to do some more testing. Trying to convince the client they need to improve the network setup and replace XP machine but of course there is no money.

Sent from my SM-G870W using Tapatalk

ok. Sounds like at some point you've replaced everything from the computer back to the modem with the exception of the wiring from the wall socket up to the switch. So this includes the wall socket RJ45, the cat cable through to the patch bay, the patch bay, the patch lead from the patch bay to the switch. Next step is to plug a computer straight into the switch, confirm that works then plug it in to the patch bay, confirm that works etc working back up the line until the fault appears again.

Having said that, the other common faults I find in adsl setups are: 1) old style digital phones plugged into the same line that recharge themselves from the phone line power and kill the adsl connection in the process, possibly also killing the lan at the same time depending on the modem, and 2) a faulty adsl filter/splitter

Actually I expect anything plugged into the phone line ahead of the filter/splitter would be problematic.

 

[nerd2u]

Thanks for that never even thought to check the phones I'm used to dealing with larger networks where a dry loop is brought in for ADSL.

Also this customers has no patch panels or anything wall drops come straight back to the switch.

Going to check the phones and run a packet scan while plugging everything back in.

Will get out the butt set and test the lines for noise as well.

Also going to have to double check every drop they tell me nothing has changed but I have a feeling something has changed.

Sent from my SM-G870W using Tapatalk

 

[glennd]

Also this customers has no patch panels or anything wall drops come straight back to the switch.

they tell me nothing has changed

Don't believe the customer, do your own testing.

 

[nerd2u]

Ya I'm getting the feeling this didn't just start for no reason.

Sent from my SM-G870W using Tapatalk

 

[YeOldeStonecat]

Drops internal connectivity? Or broadband connectivity?
Run a ping -t to the internal gateway address (like 192.168.1.1 and a local server), and also run a ping -t to some public IP address. Which one is failing?

 

[nerd2u]

Loses internal and external. They have the modem acting as a router and wifi access point so it's a pain because it has such limited functionality and no logs.

They are running fine this morning so if it continues I'm going to loop in the ISP.

I have a wireshark packet capture running on their network so I can do some analysis and see if anything is sending odd traffic or is flooding traffic

Sent from my SM-G870W using Tapatalk

 

[nerd2u]

So they ran all afternoon without their pos software and ran fine they fire up their pos software this morning and boom down within 10 min.

Sent from my SM-G870W using Tapatalk

 

[NETWizz]

What do the logs show if you do a "show logging" and what do the Interface Statistics show?


GigabitEthernet1/1/24 is up, line protocol is up
Port up for 106 day(s) 5 hour(s) 3 minute(s) 31 second(s)
Hardware is GigabitEthernet, address is cc4e.24aa.aaaa (bia cc4e.24dd.dddd)
Configured speed 100Mbit, actual 100Mbit, configured duplex fdx, actual fdx
Configured mdi mode AUTO, actual MDI
Member of L2 VLAN ID 100, port is untagged, port state is FORWARDING
BPDU guard is Disabled, ROOT protect is Disabled, Designated protect is Disabled
Link Error Dampening is Disabled
STP configured to ON, priority is level0, mac-learning is enabled
Openflow is Disabled, Openflow Hybrid mode is Disabled, Flow Control is config enabled, oper disabled, negotiation disabled
Mirror disabled, Monitor disabled
Mac-notification is disabled
Not member of any active trunks
Not member of any configured trunks
Port name is Metro-E Circuit IUEJ.123456.ATI
Inter-Packet Gap (IPG) is 96 bit times
MTU 1500 bytes, encapsulation ethernet
300 second input rate: 5602016 bits/sec, 719 packets/sec, 5.71% utilization
300 second output rate: 1111480 bits/sec, 586 packets/sec, 1.20% utilization
5113189297 packets input, 4384214818648 bytes, 0 no buffer
Received 1 broadcasts, 0 multicasts, 5113189296 unicasts
0 input errors, 0 CRC, 0 frame, 0 ignored
0 runts, 0 giants
4520850439 packets output, 1579347159458 bytes, 0 underruns
Transmitted 57269 broadcasts, 458829 multicasts, 4520334341 unicasts
0 output errors, 0 collisions
Relay Agent Information option: Disabled

Egress queues:
Queue counters Queued packets Dropped Packets
0 1018933240 316022
1 11671064 4109
2 15851 0
3 656 0
4 77851593 0
5 190435487 0
6 261814 0
7 458829 0

 

[nerd2u]

This is not a fancy network there is no show anything.

Wireshark is showing a stp flood. Now to narrow down what is causing it. I think I have it down to the debit/credit terminal

Sent from my SM-G870W using Tapatalk

 

[Your PCMD]

and no logs

Every modem has logs. Check 192.168.100.1

Have you went to the switch and systematically started disconnecting patches from it while running an active ping and wire shark? If not try that and when everything goes back to OK you know you have found the problem and were to start fixing. My guess would be a bad NIC?

 

[nerd2u]

So it was the debit / credit pin pad that was causing issues the vendor is working on determining why

Sent from my SM-G870W using Tapatalk