[lug] Linux boxes drop off the net? Router problem?

[celttechie (Brian Jarrett)]

I have a few observations I'd like to throw in here but I'm not sure if
it'll be useful.

We had a similar problem with a Linux machine that had two interfaces that I
was using to masquerade for a test lab to the company network.  The machine
also had Samba running on it to provide a way for the programmers to get
files into the lab by placing them on the Linux machine and then pulling
them into the test lab.  Things seemed to go well until we installed a
firewall on our corporate network.  It may have been coincidental, but the
problems did start happening about the same time.  In my case, neither
interface would respond to PINGs.  Doing a packet capture revealed that the
Linux box was engaged in sending out a huge amount of DNS queries that I
assumed is what caused it not to PING.  After the machine had been running
for half an hour or so, it would finally respond again.  This condition
degraded though, and soon it wasn't usable at all.  Unfortunately I was gone
when one of the owners got mad and had the lab remove the Linux box and
place an NT machine in its stead.  I need to spend more time on packet
captures, etc. but at the time we had assumed that the problem was somewhere
within SAMBA.  I haven't had the time to investigate further.

Brian


----- Original Message -----
From: "Gary Frerking (TurboPower)" <garyf at turbopower.com>
To: <lug at lug.boulder.co.us>
Sent: Tuesday, February 06, 2001 4:00 PM
Subject: Re: [lug] Linux boxes drop off the net? Router problem?


> >> Anyway, in 'normal' circumstances ARP isn't 'routed', after all, this
is
> the protocol used to detect _hardware_ adresses. <<
>
> Yes, that was my understanding of ARP too.
>
> >> arp. 'arp -anv' will show you the content of the arp cache. <<
>
> I tried that on two of my Linux boxes -- each one had a couple entries
> (these machines don't interact with machines on the local network very
> often). Anyway, there *were* entires at least. I pinged one of the
machines
> from another machine, and the "pinger" was added to the cache as expected.
> For kicks, I checked the ARP cache on a Solaris box connected to the same
> hub as the two Linux boxes I checked -- the Solaris box had *many* entries
> (including entires for each of the Linux boxes; seemingly proving that
they
> indeed respond to ARP requests, and that they indeed have different
hardware
> addresses).
>
> >> BTW, is it possible that some of your boxes are misconfigured? <<
>
> Ohhh, it's always possible -- it's obvious that *something* is
> misconfigured. We've checked the Linux boxes (5 of them) over pretty
> carefully though. The 5 boxes were set up independently by three different
> people that all are fairly good with Linux. Is it possible we all made the
> same mistake? I guess so, but the odds seem a bit slim.
>
> >> Is there anyway that you can isolate a ping so that it does NOT hit the
> router? <<
>
> Nothing immediately comes to mind, but I'll see if I can come up with
> something. I mentioned earlier that we tried the opposite (connected one
of
> the Linux boxes directly into the router) and it showed the same
symptoms --
> wouldn't that effectively eliminate the switch as being the problem?
>
> >> I also believe that both the switch and the Cisco router have the
ability
> to log into and display current ARP tables. <<
>
> Probably so -- I'll see if I can get the SysAdmin to do that for me.
>
> >> Unfortunately this is where my knowledge of routing ends. <<
>
> I reached my limit some time ago. <g>
>
> I just installed ntop on one of the machines, I'll let that cook awhile
and
> see if it yields any further clues.
>
> -- Gary
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com