network gremlin? - Hewlett Packard

This is a discussion on network gremlin? - Hewlett Packard ; Further to my last post, we are seeing odd things in showproc , as below........any ideas please? Printers are falling off spooling connection, and having to be restarted, still seeing max connections exceeded and insufficient resources msgs C152 0:00.093 WAIT ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: network gremlin?

  1. network gremlin?

    Further to my last post, we are seeing odd things in showproc , as below........any ideas please?
    Printers are falling off spooling connection, and having to be restarted, still seeing max connections exceeded and insufficient resources msgs

    C152 0:00.093 WAIT S12166 832 :RUN control.pub
    C152 0:00.165 WAIT S12166 742 (CONTROL.PUB.STOCK2K)
    C152 0:00.117 WAIT S12166 663 (AA92.PUB.STOCK2K)
    C152 0:00.086 WAIT S12164 298 :RUN control.pub
    C152 0:00.160 WAIT S12164 709 (CONTROL.PUB.STOCK2K)
    C152 0:00.190 WAIT S12164 1403 (AA92.PUB.STOCK2K)
    C152 0:00.089 WAIT S12168 458 :RUN control.pub
    C152 0:01.086 WAIT S12168 1237 (CONTROL.PUB.STOCK2K)
    C152 0:00.185 WAIT S12168 1084 (AP01Z.PUB.STOCK2K)
    C152 0:00.773 WAIT S12168 1696 (VTSERVER.NET.SYS) ħħ >>>>>>>>>>>>>>>why do some (but not all) sessions have
    ^ this process on the end?


    * To join/leave the list, search archives, change list settings, *
    * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *


  2. Re: network gremlin? - rebooted an hour ago, so far so good.

    -----Original Message-----
    From: Paul Raulerson [mailtoaul.raulerson@mac.com]
    Sent: Wednesday, 15 October 2008 12:44 PM
    To: John Pitman
    Subject: Re: [HP3000-L] network gremlin?

    I'm just going to stick my neck out a bit here, because I have no idea
    how to trace this down on a 3000.

    However, in a general sense, what appears to be happening is that
    something is rapidly trying to connect to your server, which in a way
    makes sense if you have had a network "event" and "something" changed.

    I have this happen occasionally, especially with spooled printer jobs.
    Might check whatever kind of print server you use.

    Also, ARP resolution can do this to you, in particular if you have a
    NIC overloaded with more than one IP address. (Very common of course,
    overloaded here does not mean a great number or exceeding some
    capacity, just more than one.)

    There are other, more ominous things that could be responsible, but it
    really just sounds like you have something wild on the net.

    If there is a way to flush ARP resolution on the 3000- do that first
    thing, then stop your network interface. Then, if you can, flush the
    ARP resolution in your switches and firewalls. *Then* restart the 3000
    network interface. ***Caution***!! This will most likely disconnect
    any VPN tunnels you have running.

    You can also probably do that by cycling the switches.

    I don't know what kind of disruption your site can tolerate, but if
    that doesn't clear up the problem, start looking for out of control
    PC's and printers. There are tools that would allow you to identify
    the culprit, but I don't know how to use them on a 3000, or if they
    even exist.

    If you have a linux, HP-UX, Solaris, etc. box - look at "tcpdump".
    Wireshark is also superb.
    And here are a couple websites that will help.

    http://packetstormsecurity.org/sniffers/

    http://www.wireshark.org/


    By the way - this happens to all of us that manage networks - even
    networks of very modest size. It ain't personal, even if it seems
    like it is!


    -Paul

    On Oct 14, 2008, at 5:49 PM, John Pitman wrote:

    > Further to my last post, we are seeing odd things in showproc , as
    > below.......any ideas please?
    > Printers are falling off spooling connection, and having to be
    > restarted, still seeing max connections exceeded and insufficient
    > resources msgs
    >
    > C152 0:00.093 WAIT S12166 832 :RUN control.pub
    > C152 0:00.165 WAIT S12166 742 (CONTROL.PUB.STOCK2K)
    > C152 0:00.117 WAIT S12166 663 (AA92.PUB.STOCK2K)
    > C152 0:00.086 WAIT S12164 298 :RUN control.pub
    > C152 0:00.160 WAIT S12164 709 (CONTROL.PUB.STOCK2K)
    > C152 0:00.190 WAIT S12164 1403 (AA92.PUB.STOCK2K)
    > C152 0:00.089 WAIT S12168 458 :RUN control.pub
    > C152 0:01.086 WAIT S12168 1237 (CONTROL.PUB.STOCK2K)
    > C152 0:00.185 WAIT S12168 1084 (AP01Z.PUB.STOCK2K)
    > C152 0:00.773 WAIT S12168 1696 (VTSERVER.NET.SYS) ħħ
    > >>>>>>>>>>>>>>>why do some (but not all) sessions have

    > ^ this
    > process on the end?
    >
    >
    > * To join/leave the list, search archives, change list settings, *
    > * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *


    * To join/leave the list, search archives, change list settings, *
    * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *


  3. Re: network gremlin? - rebooted an hour ago, so far so good.

    just to add to Paul's comments - depending on your network topology
    and what services are used from the 3000 - it often makes sense to put
    the 3000 on a 'quiet' or even its own switch. we have found that
    sometimes just the 'noise' on a network causes multiple hardware-level
    interrupts for the NIC card and that this can cause instability
    because the network stack passes these up to MPE. we have a 3000 that
    became unstable on our network even though none of the traffic to the
    3000 itself had increased, but non-unicast packets were driving it
    crazy. hope that helps.

+ Reply to Thread