Wireshark · Ethereal-users: Re: [Ethereal-users] Extremely strange network problem - 3com Superstack 3

[Joe Elliott <joe@xxxxxxxxx>]

Hello Kevin,
	Whenever I see problems like this I immediately suspect the switch
negotiation settings. I have run into this situation a number of times where a
new switch cannot correctly negotiate with a client the correct speed to
communicate.

The server sets the speed at 100M/b full duplex and the client 100Ms/s half
duplex. The connection still works but the actual throughput drops to around
1Mb/s and has a lot of CRC errors.

Look for errors on the switch for that specific port and check the port
speed setting at both ends of the wire.

I remember one client who had this problem with his new Cat5500 megabuck
switch and I increased performance 10x by replacing the whole switch with a
16 port NetGear hub from Frys! Of course we fixed the problem and put the
switch back in the end, but its a simple test to do.

Let me know how it works out ... Joe.

-- 
                                          __o       _~o       __o
           "Know your Network"           `\<,      `\<,      `\<,
 ______________________________________(*)/_(*)__(*)/_(*)__(*)/_(*)________
 Im a 21st Century Digital Boy ... I aint got a life, but I got lotsa toys.
 *************** Joe Elliott  joe@xxxxxxxxx  AOL:xqos  ********************
 -   NetContExt  - sniffer trace forensics - tcp follow stream analysis   - 
 -  Extract data files and Images from tcpdump & ethereal packet payloads -
        Inetd.Com Network analysis solutions http://www.inetd.com
 --------------------------------------------------------------------------


On Mon, 31 Oct 2005, Beaumont, Kevin wrote:

> Date: Mon, 31 Oct 2005 15:27:59 -0000
> From: "Beaumont, Kevin" <kevin.beaumont@xxxxxxxxxxxxx>
> Reply-To: Ethereal user support <ethereal-users@xxxxxxxxxxxx>
> To: "'Ethereal-users@xxxxxxxxxxxx'" <Ethereal-users@xxxxxxxxxxxx>
> Subject: [Ethereal-users] Extremely strange network problem - 3com
>     Superstack 3
> 
> Guys,
> 
> We've recently installed some new 3com Superstack 3 equipment.  Since then,
> we're sporadically seeing some systems unable to access certain network
> services.  Some times it is fine.
> 
> Example - we have a Debian 3.1 box which currently can not use apt-get.  It
> was working earlier today.  It works elsewhere on the network on another
> Debian 3.1 box.
> 
> Following is a tcpdump of everything going to our proxy server
> (10.1.255.244) from our debian box in question (10.3.0.50).
> 
> If anybody has *ANY* suggestions please let me know.  I feel like I'm
> banging my head against a brick wall as this is obviously causing a lot of
> grief.  The "nop, nop,sack sack 1" status of the packets interests me.
> 
> Can supply packet dumps from a different internal network from a box
> successfully using apt-get via the same proxy server if required (the
> different network uses Procurve equipment).
> 
> 
> --
> 
> 16:00:52.326569 IP (tos 0x0, ttl  64, id 45017, offset 0, flags [DF],
> length: 56) 10.3.0.50.32805 > 10.1.255.244.www: S [tcp s
> um ok] 4191353099:4191353099(0) win 5840 <mss 1460,sackOK,timestamp 546514
> 0>
> 16:00:52.331592 IP (tos 0x0, ttl  64, id 56096, offset 0, flags [DF],
> length: 56) 10.3.0.50.32806 > 10.1.255.244.www: S [tcp s
> um ok] 4201090547:4201090547(0) win 5840 <mss 1460,sackOK,timestamp 546515
> 0>
> 16:00:52.340840 IP (tos 0x0, ttl 120, id 56803, offset 0, flags [DF],
> length: 60) 10.1.255.244.www > 10.3.0.50.32805: S [tcp s
> um ok] 2869593484:2869593484(0) ack 4191353100 win 65535 <mss
> 1460,nop,nop,timestamp 0 0,nop,nop,sackOK>
> 16:00:52.340854 IP (tos 0x0, ttl  64, id 45018, offset 0, flags [DF],
> length: 52) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 1:1(0) ack 1 win 5840 <nop,nop,timestamp 546516 0>
> 16:00:52.341042 IP (tos 0x0, ttl  64, id 45019, offset 0, flags [DF],
> length: 644) 10.3.0.50.32805 > 10.1.255.244.www: P 1:593
> (592) ack 1 win 5840 <nop,nop,timestamp 546516 0>
> 16:00:52.348458 IP (tos 0x0, ttl 120, id 56808, offset 0, flags [DF],
> length: 60) 10.1.255.244.www > 10.3.0.50.32806: S [tcp s
> um ok] 381206461:381206461(0) ack 4201090548 win 65535 <mss
> 1460,nop,nop,timestamp 0 0,nop,nop,sackOK>
> 16:00:52.348462 IP (tos 0x0, ttl  64, id 56097, offset 0, flags [DF],
> length: 52) 10.3.0.50.32806 > 10.1.255.244.www: . [tcp s
> um ok] 1:1(0) ack 1 win 5840 <nop,nop,timestamp 546517 0>
> 16:00:52.348650 IP (tos 0x0, ttl  64, id 56098, offset 0, flags [DF],
> length: 1155) 10.3.0.50.32806 > 10.1.255.244.www: P 1:11
> 04(1103) ack 1 win 5840 <nop,nop,timestamp 546517 0>
> 16:00:52.579185 IP (tos 0x0, ttl 120, id 56908, offset 0, flags [DF],
> length: 52) 10.1.255.244.www > 10.3.0.50.32805: . [tcp s
> um ok] 1:1(0) ack 593 win 64943 <nop,nop,timestamp 66762833 546516>
> 16:00:52.579311 IP (tos 0x0, ttl 120, id 56909, offset 0, flags [DF],
> length: 52) 10.1.255.244.www > 10.3.0.50.32806: . [tcp s
> um ok] 1:1(0) ack 1104 win 64432 <nop,nop,timestamp 66762833 546517>
> 16:00:52.648767 IP (tos 0x0, ttl 120, id 56929, offset 0, flags [DF],
> length: 407) 10.1.255.244.www > 10.3.0.50.32806: P 1:356
> (355) ack 1104 win 64432 <nop,nop,timestamp 66762833 546517>
> 16:00:52.648774 IP (tos 0x0, ttl  64, id 56099, offset 0, flags [DF],
> length: 52) 10.3.0.50.32806 > 10.1.255.244.www: . [tcp s
> um ok] 1104:1104(0) ack 356 win 6432 <nop,nop,timestamp 546547 66762833>
> 16:00:52.669629 IP (tos 0x0, ttl 120, id 56933, offset 0, flags [DF],
> length: 1500) 10.1.255.244.www > 10.3.0.50.32805: . 345:
> 1793(1448) ack 593 win 64943 <nop,nop,timestamp 66762833 546516>
> 16:00:52.669640 IP (tos 0x0, ttl  64, id 45020, offset 0, flags [DF],
> length: 64) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 593:593(0) ack 1 win 5840 <nop,nop,timestamp 546549
> 66762833,nop,nop,sack sack 1 {345:1793} >
> 16:01:01.332227 IP (tos 0x0, ttl 120, id 57694, offset 0, flags [DF],
> length: 64) 10.1.255.244.www > 10.3.0.50.32805: . [tcp s
> um ok] 1449:1461(12) ack 593 win 64943 <nop,nop,timestamp 66762921 546549>
> 16:01:01.332234 IP (tos 0x0, ttl  64, id 45021, offset 0, flags [DF],
> length: 72) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 593:593(0) ack 1 win 5840 <nop,nop,timestamp 547415
> 66762833,nop,nop,sack sack 2 {1449:1461}{345:1793} >
> 16:01:01.372076 IP (tos 0x0, ttl 120, id 57699, offset 0, flags [DF],
> length: 396) 10.1.255.244.www > 10.3.0.50.32805: P 1:345
> (344) ack 593 win 64943 <nop,nop,timestamp 66762921 547415>
> 16:01:01.372081 IP (tos 0x0, ttl  64, id 45022, offset 0, flags [DF],
> length: 52) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 593:593(0) ack 1793 win 6432 <nop,nop,timestamp 547419 66762921>
> 16:01:05.919550 IP (tos 0x0, ttl 120, id 58417, offset 0, flags [DF],
> length: 64) 10.1.255.244.www > 10.3.0.50.32806: . [tcp s
> um ok] 1804:1816(12) ack 1104 win 64432 <nop,nop,timestamp 66762967 546547>
> 16:01:05.919557 IP (tos 0x0, ttl  64, id 56100, offset 0, flags [DF],
> length: 64) 10.3.0.50.32806 > 10.1.255.244.www: . [tcp s
> um ok] 1104:1104(0) ack 356 win 6432 <nop,nop,timestamp 547874
> 66762833,nop,nop,sack sack 1 {1804:1816} >
> 16:01:09.215822 IP (tos 0x0, ttl 120, id 59320, offset 0, flags [DF],
> length: 1500) 10.1.255.244.www > 10.3.0.50.32805: . 1793
> :3241(1448) ack 593 win 64943 <nop,nop,timestamp 66763000 547419>
> 16:01:09.215827 IP (tos 0x0, ttl  64, id 45023, offset 0, flags [DF],
> length: 52) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 593:593(0) ack 3241 win 8688 <nop,nop,timestamp 548203 66763000>
> 16:01:16.416228 IP (tos 0x0, ttl 120, id 60160, offset 0, flags [DF],
> length: 64) 10.1.255.244.www > 10.3.0.50.32806: . [tcp s
> um ok] 1804:1816(12) ack 1104 win 64432 <nop,nop,timestamp 66763072 547874>
> 16:01:16.416236 IP (tos 0x0, ttl  64, id 56101, offset 0, flags [DF],
> length: 72) 10.3.0.50.32806 > 10.1.255.244.www: . [tcp s
> um ok] 1104:1104(0) ack 356 win 6432 <nop,nop,timestamp 548923
> 66762833,nop,nop,sack sack 2 {1804:1816}{1804:1816} >
> 16:01:20.912610 IP (tos 0x0, ttl 120, id 60430, offset 0, flags [DF],
> length: 64) 10.1.255.244.www > 10.3.0.50.32805: . [tcp s
> um ok] 4689:4701(12) ack 593 win 64943 <nop,nop,timestamp 66763117 548203>
> 16:01:20.912615 IP (tos 0x0, ttl  64, id 45024, offset 0, flags [DF],
> length: 64) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 593:593(0) ack 3241 win 8688 <nop,nop,timestamp 549373
> 66763000,nop,nop,sack sack 1 {4689:4701} >
> 16:01:29.227806 IP (tos 0x0, ttl 120, id 62842, offset 0, flags [DF],
> length: 64) 10.1.255.244.www > 10.3.0.50.32805: . [tcp s
> um ok] 4689:4701(12) ack 593 win 64943 <nop,nop,timestamp 66763200 549373>
> 16:01:29.227811 IP (tos 0x0, ttl  64, id 45025, offset 0, flags [DF],
> length: 72) 10.3.0.50.32805 > 10.1.255.244.www: . [tcp s
> um ok] 593:593(0) ack 3241 win 8688 <nop,nop,timestamp 550205
> 66763000,nop,nop,sack sack 2 {4689:4701}{4689:4701} >
> 16:01:42.891463 IP (tos 0x0, ttl 120, id 393, offset 0, flags [DF], length:
> 64) 10.1.255.244.www > 10.3.0.50.32806: . [tcp sum
>  ok] 1804:1816(12) ack 1104 win 64432 <nop,nop,timestamp 66763336 548923>
> 16:01:42.891470 IP (tos 0x0, ttl  64, id 56102, offset 0, flags [DF],
> length: 72) 10.3.0.50.32806 > 10.1.255.244.www: . [tcp s
> um ok] 1104:1104(0) ack 356 win 6432 <nop,nop,timestamp 551571
> 66762833,nop,nop,sack sack 2 {1804:1816}{1804:1816} >
> 16:01:48.368094 IP (tos 0x0, ttl 120, id 2475, offset 0, flags [DF], length:
> 64) 10.1.255.244.www > 10.3.0.50.32806: . [tcp su
> m ok] 3264:3276(12) ack 1104 win 64432 <nop,nop,timestamp 66763391 551571>
> 16:01:48.368101 IP (tos 0x0, ttl  64, id 56103, offset 0, flags [DF],
> length: 72) 10.3.0.50.32806 > 10.1.255.244.www: . [tcp s
> um ok] 1104:1104(0) ack 356 win 6432 <nop,nop,timestamp 552119
> 66762833,nop,nop,sack sack 2 {3264:3276}{1804:1816} >
> 16:01:50.249326 IP (tos 0x0, ttl  64, id 45026, offset 0, flags [DF],
> length: 64) 10.3.0.50.32805 > 10.1.255.244.www: F [tcp s
> um ok] 593:593(0) ack 3241 win 8688 <nop,nop,timestamp 552307
> 66763000,nop,nop,sack sack 1 {4689:4701} >
> 16:01:50.249446 IP (tos 0x0, ttl  64, id 56104, offset 0, flags [DF],
> length: 72) 10.3.0.50.32806 > 10.1.255.244.www: F [tcp s
> um ok] 1104:1104(0) ack 356 win 6432 <nop,nop,timestamp 552307
> 66762833,nop,nop,sack sack 2 {3264:3276}{1804:1816} >
> 16:01:50.281873 IP (tos 0x0, ttl 120, id 3105, offset 0, flags [DF], length:
> 1500) 10.1.255.244.www > 10.3.0.50.32805: . 4689:
> 6137(1448) ack 594 win 64943 <nop,nop,timestamp 66763410 552307>
> 16:01:50.281887 IP (tos 0x0, ttl  64, id 20, offset 0, flags [DF], length:
> 40) 10.3.0.50.32805 > 10.1.255.244.www: R [tcp sum
> ok] 4191353693:4191353693(0) win 0
> ---
> 
> Non-working apt-get log:
> 
> --
> bradfordmon:~# apt-get update
> Get:1 http://security.debian.org stable/updates/main Packages [137kB]
> Get:2 http://ftp.uk.debian.org stable/main Packages [3347kB]
> Err http://security.debian.org stable/updates/main Packages
>   Connection timed out
> Hit http://security.debian.org stable/updates/main Release
> Err http://ftp.uk.debian.org stable/main Packages
>   Connection timed out
> Hit http://ftp.uk.debian.org stable/main Release
> Hit http://ftp.uk.debian.org stable/main Sources
> Hit http://ftp.uk.debian.org stable/main Release
> Failed to fetch
> http://ftp.uk.debian.org/debian/dists/stable/main/binary-i386/Packages.gz
> Connection timed out
> Failed to fetch
> http://security.debian.org/dists/stable/updates/main/binary-i386/Packages.gz
> Connection timed out
> Reading Package Lists... Done
> W: Couldn't stat source package list http://ftp.uk.debian.org stable/main
> Packages
> (/var/lib/apt/lists/ftp.uk.debian.org_debian_dists_stable_main_binary-i386_P
> ackages) - stat (2 No such file or directory)
> W: You may want to run apt-get update to correct these problems
> E: Some index files failed to download, they have been ignored, or old ones
> used instead.
> ---
> 
> Working apt-get log:
> 
> --
> liverpoolmon:~# apt-get update
> Hit http://ftp.uk.debian.org stable/main Packages
> Hit http://ftp.uk.debian.org stable/main Release
> Hit http://security.debian.org stable/updates/main Packages
> Hit http://ftp.uk.debian.org stable/main Sources
> Hit http://security.debian.org stable/updates/main Release
> Hit http://ftp.uk.debian.org stable/main Release
> Reading Package Lists... Done
> ---
> 
> 
> Thanks,
> 
> Kevin
> 
> 
> **************************************************************************************
> The information contained in this e-mail is private and confidential, may
> be legally privileged and/or protected by law and it is intended only for
> the use of the addressee.
> Any liability (in negligence or otherwise) arising from any third party
> taking any action or refraining from taking any action on any of the
> information contained in this e-mail is hereby excluded. If you are not
> the intended recipient please notify the sender immediately.
> Do not disclose the contents to any other person store or copy the
> information in any medium or use it for any purpose whatsoever.
> Copyright in this e-mail and any attachment created by us belongs to this
> company and we assert the right to be identified as such and object to any 
> misuse.
> Any contract concluded by means of e-mail communications is expressly
> concluded subject to Princes Limited's current standard terms and conditions.
> A copy of these is available on request.
> **************************************************************************************
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>