Office LAN nightmares....help! 2

[xedgex]

Let me outline the office network and WAN setup before I explain the problem.

We have 1 DSL modem; netopia -> linksys 4 port router -> 16 port netgear GBe switch -> patch panel -> drops most of which has a 4 port netgear hub I think 10/100

Default Gateway is the linksys router
DNS is our file server

We have been losing access to the internet on and off pretty frequently lately, while this happens our internal access goes offline too. We've talked to the ISP and while they found issues I feel the problem is mainly internal. What I did was hook myself up to the dsl modem directly with another external ip address and run a continuous ping to google as well as a known external IP address. I watched for this to fail at the same time that our internal network would, but it did not. Out internal ping tests to the router or server failed but I was still able to get ourside through a direct ethernet to the modem.

I figure the issue has to be these little 4 port hubs all over the place or the GbE switch or possibly the linksys (brand new). My first step will be replacing one of the 4 port hubs with a GbE one to see if it helps that area of the office, I have noticed that an internal issue when not being able to ping a resource isnt present for everyone at the same time, it varies on which office they are in / which drop they are connected to.

Also, DNS is set to a win2000 server, which does not have Forwarders added, should I add my ISP's dns addresses here?

Another idea I have is to connect one of the troubled PCs directly into the switch and see if its problems surface with the rest of the office or not.

Could some of these hubs be 'looping' the main switch? I need some advise on troubleshooting this, thank you for any input!!

 

[stubnski]

Out internal ping tests to the router or server failed"

"Yes there is only 1 subnet."

Are your servers are connected to the same switch as the hubs?

Are you using DHCP or static?

When you are unable to ping your internal servers can you ping other workstations?

If you are using DHCP: does a ipconfig /release, ipconfig /renew fix the issue?


Stubnski

 

[xedgex]

Here's something very odd that I dont get. The def GW here is 0.1, dns on this workstation is the def gw 0.1 and 1 public ip. When I do a tracert to an external ip; 4.2.2.2 the 1st hop is always 0.100 which is the internal dns and file server.

Why is it somehow trying to route via the server?

 

[North323]

would need more info to answer that but sounds like you are no the right track. the first hop should be your gw. make sure the 0.100 is not doing some connection sharing. what is the setting of the NICs on that 0.100?

 

[xedgex]

Setting of the .100 NIC (server);

def gw is 0.1 - correct
DNS - 0.100 - itself & 0.1 which is the GW

Here's some items that I don't understand but I think they are wrong;

Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No


I'm not sure what Node Type' broadcast means and IP routing enabled as yes.

please advise. thank you all for the feedback so far!!!!!

 

[brianinms]

How many connections do you have from the server to the network?

 

[xedgex]

Well its a small network - 10 workstations., the server is static and does not do dhcp server.

In addition to above here is netstat -r. I dont fully understand it, but how come I see 0.100 as the gateway? Should I remove these routes somehow? Like I said most workstation when running tracert always have 0.100 as the 1st hop but their def gw and dns is 0.1 not the server;

C:\Documents and Settings\Administrator>netstat -r

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x1000003 ...00 07 e9 f1 b0 58 ...... Intel(R) PRO/1000 MT Network Connection
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.100 1
69.136.68.83 255.255.255.255 192.168.0.1 192.168.0.100 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.100 192.168.0.100 1
192.168.0.100 255.255.255.255 127.0.0.1 127.0.0.1 1
192.168.0.255 255.255.255.255 192.168.0.100 192.168.0.100 1
224.0.0.0 224.0.0.0 192.168.0.100 192.168.0.100 1
255.255.255.255 255.255.255.255 192.168.0.100 192.168.0.100 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None


The 69.x.x.x IP belongs to Comcast, this building JUST became eligible for comcast service, we never had comcast before - I'm not sure what this is about.

 

[dberg35]

xedgex,
I never saw a response here but what is doing DHCP or all pc's set staticly?

 

[North323]

that might be your issue there...your server should not be doing any routing:

Here's some items that I don't understand but I think they are wrong;

Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

 

[rudenate3]

Correct me if I'm wrong, but most likely the reason your seeing the DNS server is because it is the DNS server in use. Most likely that's why your computer has a route to it.

Can you narrow it down to any segments? As in, one part of the office but not the other? If so, can you ping from a working segment to that segment? I would also try running a trace route from the bad section, to another section, the server, your gateway, and a remote location.

Depending on the physical layout, you could always run another cable on the floor to the room having the problem and see if that resolves it. If it does there is something wrong with the cable run or with something in that room.

 

[xedgex]

Problem solved. It turned out that the server was running a content filter application I have since disabled this as a service and all users are back to working order. I still dont know how a server can become the 1st hop if each workstation is set to a static gateway other than the server.

Thank you for all the replies.

 

[North323]

its not the first hop...it tries to go out the gateway but if you have a content filter, it will bounce your request off that server to see if you are allowed to go to that website. could be that the filter or server was misconfigured or out of date