DComTalk.com

Chris Kranz · Guest

I'm not 100% sure whether this is an Exchange issue, or something on our
network, but either way it is very strange...

I have a 3com powered network, 4x 4200's, and a 4400 which is the
central one. I've disabled Broadcast Storm Control (which I thought
might be a problem) and the Multicast Filter on all these.

My problem is, I run a constant ping (as I'm trying to debug this
problem) from my machine to 3 of our servers, the Exchange server, the
DC and SQL server and a NetApp Filer. The trouble is, I'll lose
approximately 5-10% of these pings over the course of the day, for no
particular reason. One of the machines, usually the Exchange or Filer,
will just drop all pings from my machine. However it won't have dropped
pings from all machines. I run the same ping from the DC and it'll run
fine during my outage, although it itself will have problems when I don't.

Quite an aggravating problem, as I have no idea how to trouble shoot
this. The NIC's on all servers are fine, the Exchange box is an
identical hardware build to the DC. The only errors I get in the Event
Logs are that Exchange losses connectivity to the DC and GC occasionally.

The bizarre thing is when I look at the ARP tables on my machine. During
the ping outage, which usually last about 5 minutes, if i bring up the
ARP tables, the IP of the failing machine is identical to the IP of the
gateway box (PIX 515e). If I clear the ARP cache, it will immediately
regain connection to the failing machine.

What I _think_ is happening, is that 1 ping is getting dropped, or
failing, and so the client machine asks the gateway what route to take.
Somewhere the client machine decides that the route to the host machine
is through the gateway, which is where it fails. But again, I don't know
how to trouble shoot or start to fix this problem. Our office is too
small to even start thinking about VLAN's (4 servers, 50 users). However
I need to get this fixed as I need to launch the Exchange server into
production in the next few weeks.

Any help please?

Chris K

Walter Roberson · Guest

In article <430d8808$0$38037$bed64819@news.gradwell.net>,
Chris Kranz <chris@kranz.com> wrote:
:I'm not 100% sure whether this is an Exchange issue, or something on our
:network, but either way it is very strange...

:My problem is, I run a constant ping (as I'm trying to debug this
:problem) from my machine to 3 of our servers, the Exchange server, the
:DC and SQL server and a NetApp Filer. The trouble is, I'll lose
:approximately 5-10% of these pings over the course of the day, for no
:particular reason.

:The bizarre thing is when I look at the ARP tables on my machine. During
:the ping outage, which usually last about 5 minutes, if i bring up the
:ARP tables, the IP of the failing machine is identical to the IP of the
:gateway box (PIX 515e). If I clear the ARP cache, it will immediately
:regain connection to the failing machine.

Install ethereal or equivilent and have it watch ARP packets.
I hypothesize that you'll see an ARP reply from the PIX's MAC with the
IP address of the servers, but if so then one would have to look at
the packet details to see if it is the PIX itself or some other machine
that is triggering that. Another possibility is that a gratitious ARP
with incorrect information is seen by your machine and acted on.

Either way, it's still odd that it'd appear to come from the PIX, which
is effectively a router for this purpose and wouldn't pass ARP packets
(but would do proxy arp.) Unless, perchance, your PIX 515E is running
PIX 7.0 and you have a "transparent tunnel" configured so layer 2
packets -are- going through it? [That's something not possible with
PIX 6.x or earlier.]
--
Entropy is the logarithm of probability -- Boltzmann

	DComTalk.com Forum Index -> Ethernet	All times are GMT
Page 1 of 1