Subnet issues (need to brainstorm)

[hinesjrh]

We have a clustered webserver that was recently set up. I learned today that the subnet on the cluster is incorrectly set to 255.0.0.0. It should be 255.255.252.0.

Let's brainstorm. What kind of issues might this cause on my network? Yes, users can get to the websites on these clustered servers and in general everthing seems OK. However, I do have an issue on my network where traffic seems higher than normal. When I run Ethereal for packet captures I am seeing traffic from all points on my network, even from other sites on my WAN and I see this no matter where I plug into the network. It is almost like we are using hubs instead of switches. Could the wrong subnet on a server (cluster) cause this? It is my busiest set of servers by the way.

I plan to change this subnet tonight, but I am wondering if this is causing some of the issues I am seeing.

 

[pansophic]

It could potentially be causing the problem. By setting the subnet mask so large, the server would believe that every IP address in the 10.x.x.x (or whatever your actual IP address scheme is) is considered to be a local machine, so the server will be attempting to contact it directly, rather than through any gateway that it would normally utilize.

Because the cluster is broadcasting directly to all hosts (using ARP), it could be overflowing the ARP cache that is stored in the switch, forcing the switch to "learn" which IP addresses are on which ports again. During this learning phase on a switch, it acts like a hub, broadcasting every packet to every port.

Since your server continues to broadcast, the cache is constantly overflowing. I would expect this behaviour to subside when the netmask is set correctly.


pansophic