Network "intermittence" problem

[rudolphjk]

Hi.
My company's LAN has been having problems since August 2001. In particular, an "intermittent browser" problem (including client email attempts to connect to email server) is the worst, and is priority one to get solved. The LAN has about 25 workstations that have internet access through a Socks5 proxy on an NT 4.0 server, connected to the internet via Cable modem. The intermittence seems to occur at times in the day when traffic is heaviest on the LAN. Some pertinent information:

Physical:
* Cabling is a mix-match of Cat4 (old cabling within building walls) & Cat5 (any newly purchased cabling)
* Hubs & Switches are mix-match of 10, 10/100, & 100 Mbps
Servers:
* 2 Netware 5.0 servers acting as routers for subnets (x.x.43.x & x.x.28.x), running both TCP/IP & IPX, 1 server acting as DHCP server for x.x.28.x subnet & primary time server, packet forwarding is on
* 1 Netware 4.11 server with x.x.59.x subnet only running IPX, acting as DHCP server for x.x.43.x subnet, packet forwarding is on
* 1 NT 4.0 server running Socks5 proxy (we also have been trying to implement Permeo's E-border proxy for more security - we have an evaluation edition installed & about 5 people have been testing the software since March 2001), Wildcat email server, workgroup shares, DNS.
* All servers are multi-homed (all connect to x.x.10.x subnet “backbone” 100 Mbps Hub), and the second NIC is connected to their respective subnets’ hubs servicing the nodes/workstations on the subnets. There are about 65 nodes total; 10 on x.x.59.x (IPX only), 35 on x.x.28.x (TCP/IP & IPX), 20 on x.x.43.x (TCP/IP & IPX).
Things I’ve tried:
* Running logs monitoring socks connections to analyze why packets were not reaching destinations
* Looked at Routing tables to determine if packets were being routed to different destinations
* Monitored bandwidth utilization on NT server
* Checked with Cable ISP for bandwidth/DNS issues
* Mapped physical topology of network, including cabling quality, NIC speeds, & hub/switch speeds

The problem appears to be on the LAN because when workstations have internet connectivity issues, you can browse the internet from the NT server.

Can anyone suggest any other solutions, or possible avenues to look down?
Thanks.

 

[jimbopalmer]

Could just be me but this screams 'spanning tree' to me, could the multihoming be making loops in your ethernet? The one thing you can't give for your heart's desire is your heart. - Lois McMaster Bujold

 

[MWM]

Rudolph333

I usually like to stabalize the patient first. Or, in baseball's idiom, when you have problems, go back to the fundamentals. As they say, more than 50% of network problems are cable-related. I would say that the other major source of problems is marginal hardware.

You mentioned a mix of hubs, 10, 10/100, 100s. 10BaseT hardware is obsolete, really. The internals do not resemble the electronics supporting even the generic 10/100 hubs available today at CompUSA. Chip speeds and internal architecture have improved markedly.

Top end quality in hubs is available from Cisco, at many times the price, showing that the science can be carried to extreme reliability and managability.

I have had the good fortune (I get paid to spot the obvious, sometimes) to be called on troubles with connectivity by clients who I know have old 10-speed hubs. No, it's not the cabling, rather an old hub that locks up when it gets stressed. The problem is that they don't just die, they twitch and moan for a while and even try to recover. When you arrive it may be back on its feet.

Some of these things were supposed to partition off ports with high levels of collision, etc., but that science has progressed a lot recently. The early ones just did not succeed that well, though it was a start.

Then think about that CAT 4 wiring and just what you have demanded of those runs. A Fluke can generate loading on the cable or the system, too.

But first getting the physical plant in order makes sense.

Yours,
Mike McCune, RCDD

 

[wybnormal]

:::snip:::
I have had the good fortune (I get paid to spot the obvious, sometimes) to be called on troubles with connectivity by clients who I know have old 10-speed hubs. No, it's not the cabling, rather an old hub that locks up when it gets stressed. The problem is that they don't just die, they twitch and moan for a while and even try to recover. When you arrive it may be back on its feet.
:::snip::


This is SO true... Equipment that should have been retired years ago will cause no end of troubles. As will the cheapo piece of garbage that someone threw into the network without telling anyone .. " where did THAT come from???"

MikeS Find me at

http://www.packetattack.com

"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[rudolphjk]

All, thank you for the suggestions.

I do not believe we have a spanning tree problem. I mapped out our topology, and we have no redundancy in physical wiring. The 10.x subnet connects the servers to each other, and the remaining server NICs in the multi-homing configuration connect each server/router to it's individual subnet.

The company is looking to move from the current building within the next few months. At this point, as far as the physical network, it's duct-tape time & bubble gum time. The company will not throw money at upgrading the physical network, just to move out in a few months. Also, considering our industry's current financial pinch, it's been difficult to get money for "possible" solutions. If we upgrade our 10 Mbps Hubs, I'm not convinced this would give us bandwidth gains, considering our cabling is sub-100 Mbps (Cat4). If it truly is a bandwidth issue, and the cabling/hubs need to be upgraded, it may have to wait until a company move, although this solution will probably not sit well.

Aside from the physical network, another option that seems probable is the proxy configuration on our NT server. I'm not very familiar with proper proxy configurations, but would it be possible that opening only 1 port to http connections via socks is a bottlenecking our internet connections?

 

[threedots]

Here's something you might try: if your hubs are located within convenient reach of either just yourself or only a few fellow co-workers:

Ask company workers to notify you immediately when network troubles arise. When consensus tells you that this is your mystery guest paying another visit, reset all of your hubs simultaneously (or as close to simultaneously as you can).

If this solves the problem, then your issue is in one of the repeaters. get or borrow another repeater that you know works well, and use it to switch out your hubs one-by-one until you identify the culprit. Time-consuming, but within the company's budget (ie, free except for your time...)

Threedots

 

[wybnormal]

The hubs are not for performance ... the upgrade to even cheapo switch is to break up the collision domain to lessen traffic across the hubs. IF you have troubles with browsing during high usage, it's almost certainly a traffic vs. response time issue. If you sniff the network, you more then likely will see browser *wars* since the master browser is not responding in timely manner to the update requests. As chunks of the network drops off line from a browser perspective, you would not be able to *see* them from the browser. You still would be able to use IP to map it though.. and sometimes, the FIND comand will find the PC on the net even with broken browsing.

You are looking at maybe, 50- 150 bucks a switch.. might be even less if you snake a few used ones off eBay.. Linksys and Netgear come to mind as fairly reliable and cheap switches.

MikeS

MikeS Find me at

http://www.packetattack.com

"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin