Re: Linksys LAN -- network fails at a switch

From: prg (rdgentry1_at_cablelynx.com)
Date: 01/31/05


Date: 30 Jan 2005 20:00:39 -0800


Sally Shears wrote:

Not sure there is any "more specific" info you could provide that would
tie this down -- not for me anyway.

Could it be that the switches and hosts are coming back up after a
power outage in such a manner/sequence that the problem converges on
the suspect location and craps the spanning tree -- if you're running
spanning tree, that is.

Also could the learning mode be corrupted or the MAC/IP tables be
getting boinked by way of a "sneaky" hidden pathway in the physical
connections that causes one (or more) of the MACs to appear as
originating on different ports or on different sides of the switch.
Perhaps you need spanning tree running?

Can you monitor or at least dump the switch MAC tables? Nearby host
arp cache might help also. Any possibility that someone has manually
changed/set the MAC address of a host nic that duplicates MAC elswhere?
Does anyone move from one switch to another, thus causing their MAC to
appear in different parts of the switch fabric?

I've had times when MACs began appearing on different sides of a switch
for no apparent reason. This can bring the switch(es) to their knees.
Hard to "see" it without sniffing the wire and the problem source can
be difficult to track down.

Resetting the switches clears the tables and you start clean again.
After some interval X, the problem accumulates/reappears and brings the
switches down again.

Double check, then double check again, that there are no loops in the
physical pathways. That must be confirmed (as well as you can) before
getting to the ugly stuff.

Confirm that each switch is properly configured for the role it plays.
Think. Should I really be using a router here instead of a switch?
Think again. Confirm to your own satisfaction that a switch is the
correct appliance.

You've already played with cable replacement. Tried different ports?
Tried swapping out the "bad" switch with one upstream/downstream or
sibbling to see if you can make the problem "follow" the switch.

If it does not follow the switch, begin to suspect a loop or
malfunction that originates elsewhere but converges at this point.
What about your setup/usage would cause the problem to converge here
and not elsewhere?

If you cannot narrow it down at this point, you'll have to get out the
sniffer and monitor packet flows. If you have several Linux boxes
spread around you can use them to monitor traffic with something like
MTRG or something, anything, that will reveal a spike as switches start
bouncing packets around.

If you're real lucky, a sniffer will reveal that a MAC is showing up on
two sides of one or more switches but does not cause serious problems
till after interval X. This situation sometimes shows up as eratic
behavior with one or two particular hosts before it shows elsewhere.
Keep an eye out for sporadic host behavior or complaints about
clunkiness. Don't rule out a misbehaving nic.
good luck -- you likely need it ;)
prg
email above disabled



Relevant Pages

  • RE: Exploit code for IP Smart Spoofing
    ... If there is a MAC violation, this is logged and the port is ... traffic of one other host on the switch. ... but there is no way to protect against ...
    (Bugtraq)
  • Re: Network scanning
    ... > level before the switch will enable that port... ... > new MAC and disable the port. ... >> informieren Sie bitte sofort den Absender und vernichten ... Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich ...
    (Security-Basics)
  • Re: [fw-wiz] How to find hidden host within LAN
    ... identify this host within my LAN: ... if you ping do you get something like "host unknown" (means ethernet ... can't find the MAC) or or just no answer (he may have a firewall ... I assume you don't have a fancy switch that lets you trace ethernet ports... ...
    (Firewall-Wizards)
  • Re: Leopard market share???
    ... only), MacBook Pro C2Duo connecting wirelessly, Mac Pro directly connected to switch. ... Airport Extreme connected to switch and to cable modem. ... Ethernet configured automatically (If the MP is set to a large MTU it can no longer administer the Airport Extreme!) ... I have been working with networking for over 15 years. ...
    (comp.sys.mac.advocacy)
  • Re: Leopard market share???
    ... GreyCloud wrote: ... another Mac. ... Airport Extreme connected to switch and to ... I've been into networking since the early 80s. ...
    (comp.sys.mac.advocacy)