Weird n0tworking issue

[two00lbwaster]

The company I work for has been experiencing a very strange networking issue with one of their web servers. Even weirder is that it is only one of them and not all of them. Although, this particular server is hosted at a different company than the other servers.

I will outline the issue. We have a front end CMS that the clients and our admin staff use to update content on our various websites. We on the technical team tend to do everything via RDP and ftp.

However, after transmitting a certain amount of data to the server either via ftp or the CMS, or accessing the site generally checking pages etc, the computer will no longer be able to connect to the server.
The connection will time out on any connection protocol that you can imagine, as if the server no longer exists.
In addition, it will only effect that one computer in the whole office, other computers will still be able to find the server, including VMs hosted on the afflicted machine (Starting up a duplicate copy of a VM, when the original VM has been affected, shows that this is not a local machine caching issue as the duplicate is also adversely affected).

Now this has been going on since April and the way we have found around the issue is to release and renew the IP, or in our case use a program that does a similar job, so we use Technitium MAC address changer v5. But this can happen quite often and has become quite tedious.

I'm guessing that it is some local networking issue as external tests have led to no fault found. I guess it would be handy to point out that we have building supplied networking, where each office seems to be hosted on its own private network, although the subnet is the usual 255.255.255.0, and no other IP address ranges appear to be present.
In addition, connected to one of those ports is a WGR614v7 Router which provides secured wireless access and gives the office a few more ports. Now the router is just acting like a switch, with one of the ports going into the port to the main office switch hosted by the building with the other three ports being taken up by two computers and a printer.

I hope one of you guys can help here. It’s rather a strange one.

[Jay]

are you being blacklisted for sending too much data to the server, maybe its thinks you are DDoSing it?

[two00lbwaster]

are you being blacklisted for sending too much data to the server, maybe its thinks you are DDoSing it?

I don't think so, as the hosting company have looked into it and said that it must be an issue our end. Also it would affect all the office computers if that was the case as we only have one external facing IP address.

Releasing and renewing the IP seems to be what does the trick. Though, sometimes you have to do it several times. With the MAC address changer program it tends to work immediately.

We're only doing normal ftp stuff although I have to admit that that can involve a rather a large amount of data. The CMS updating side is not all that intensive with just textual updating being done usually, although with some uploading of images and, infrequently, other media related files.

Thanks for asking the question though. The more that are asked the more chance that I might actually be able to track down the issue.

[Steve]

Pfff, really not sure about this one.

I used to get intermittent connectivity issues when the MTU was set too large on my NIC (had to lower it to something less than 1500).

Not sure this is quite the same scenario, though.

[two00lbwaster]

Pfff, really not sure about this one.

I used to get intermittent connectivity issues when the MTU was set too large on my NIC (had to lower it to something less than 1500).

Not sure this is quite the same scenario, though.

Hmmm, that doesn't seem to fit either and as far as I know it seems that MTU is set to 1500 which is a fairly default setting.
We would also experience it more generally, across the whole office of computers, I would have thought, and it would not be fixed by renewing the IP lease.

I also think that the one Vista machine we have in the office doesn't experience any issues (all other machines are XP32 with latest SPs and updates). I know Vista does networking differently which might provide some clues.

[Steve]

A fair assumption, and an interesting observation about the Vista thing.

Do all the machines have the same NIC? Perhaps it's something going on in the driver? Might be worth having a play.

[two00lbwaster]

A fair assumption, and an interesting observation about the Vista thing.

Do all the machines have the same NIC? Perhaps it's something going on in the driver? Might be worth having a play.

There is quite a varied mix of machines, with different motherboards for different generations of processors (AXP, A64, early C2D and C2Qs). I'll look into what drivers are used and what iNIC chips they are using. May just be, but one is an HP machine and I'm fairly sure that wont have an embedded realtek chip in it.

[blueball]

i cam across a situation once where a whole heap of compaq laptops were dlivered to a clients site and they ALL had the same MAC address. Might it be a MAC issue?

[b0redom]

DHCP lease expiring? If that happens and your IP changes it would break the connection. This would also explain the intermittantness of the problem.

As an aside you've turned off DHCP on your WGR614v7 right?

It's fairly bad practice to go around changing MAC addresses.

[patch]

What's the OS on the web server? And how do you get to it (on the LAN, across the internet)? If internet, what router do you use to get out? If not on LAN, can you get a computer on the same LAN as the server and then try the transfer? If you can RDP to the server, can you try pulling the data on to the server, rather than pushing it from your end?

[two00lbwaster]

i cam across a situation once where a whole heap of compaq laptops were dlivered to a clients site and they ALL had the same MAC address. Might it be a MAC issue?

Hmmm, I'm erring towards it not being, as I've checked and they all seem to be individual, even though technitium seems to do the job more effectively.

DHCP lease expiring? If that happens and your IP changes it would break the connection. This would also explain the intermittantness of the problem.

As an aside you've turned off DHCP on your WGR614v7 right?

It's fairly bad practice to go around changing MAC addresses.

Hmmmm, this might be something to investigate in regard to the networking equipment we don't have access to. Also it seems to happen quite regularly at 3pm so I think you're right, this might be the issue.

Yes, the DHCP was turned off in the WGR614v7 router by the guy that configured it. Why did you ask? Is there a known issue with this router version?

:S Yeah, MAC spoofing isn't good but it was the only solution that was working reliably.

[two00lbwaster]

What's the OS on the web server? And how do you get to it (on the LAN, across the internet)? If internet, what router do you use to get out? If not on LAN, can you get a computer on the same LAN as the server and then try the transfer? If you can RDP to the server, can you try pulling the data on to the server, rather than pushing it from your end?

Os is Server 2003 64bit.
The server is hosted at a remote location to the office, we have five such servers although all the other servers are 32bit versions; hmmmmm.
I can't say how we connect to the internet as I don't have access to the building's comms room. Might see if that can be changed though; I need to know more.
Can't get a computer on the same LAN as the server, it is hosted after all.
We do RDP to the server however they're locked down and unlocking them to allow them to ftp up the data, and sorting out the ftp at this end, would be a nightmare including getting the connection through the building's firewall and switch system to which I have no access