-----Original Message-----
From: Paul Raulerson [mailtoaul.raulerson@mac.com]
Sent: Wednesday, 15 October 2008 12:44 PM
To: John Pitman
Subject: Re: [HP3000-L] network gremlin?

I'm just going to stick my neck out a bit here, because I have no idea
how to trace this down on a 3000.

However, in a general sense, what appears to be happening is that
something is rapidly trying to connect to your server, which in a way
makes sense if you have had a network "event" and "something" changed.

I have this happen occasionally, especially with spooled printer jobs.
Might check whatever kind of print server you use.

Also, ARP resolution can do this to you, in particular if you have a
NIC overloaded with more than one IP address. (Very common of course,
overloaded here does not mean a great number or exceeding some
capacity, just more than one.)

There are other, more ominous things that could be responsible, but it
really just sounds like you have something wild on the net.

If there is a way to flush ARP resolution on the 3000- do that first
thing, then stop your network interface. Then, if you can, flush the
ARP resolution in your switches and firewalls. *Then* restart the 3000
network interface. ***Caution***!! This will most likely disconnect
any VPN tunnels you have running.

You can also probably do that by cycling the switches.

I don't know what kind of disruption your site can tolerate, but if
that doesn't clear up the problem, start looking for out of control
PC's and printers. There are tools that would allow you to identify
the culprit, but I don't know how to use them on a 3000, or if they
even exist.

If you have a linux, HP-UX, Solaris, etc. box - look at "tcpdump".
Wireshark is also superb.
And here are a couple websites that will help.

http://packetstormsecurity.org/sniffers/

http://www.wireshark.org/


By the way - this happens to all of us that manage networks - even
networks of very modest size. It ain't personal, even if it seems
like it is!


-Paul

On Oct 14, 2008, at 5:49 PM, John Pitman wrote:

> Further to my last post, we are seeing odd things in showproc , as
> below.......any ideas please?
> Printers are falling off spooling connection, and having to be
> restarted, still seeing max connections exceeded and insufficient
> resources msgs
>
> C152 0:00.093 WAIT S12166 832 :RUN control.pub
> C152 0:00.165 WAIT S12166 742 (CONTROL.PUB.STOCK2K)
> C152 0:00.117 WAIT S12166 663 (AA92.PUB.STOCK2K)
> C152 0:00.086 WAIT S12164 298 :RUN control.pub
> C152 0:00.160 WAIT S12164 709 (CONTROL.PUB.STOCK2K)
> C152 0:00.190 WAIT S12164 1403 (AA92.PUB.STOCK2K)
> C152 0:00.089 WAIT S12168 458 :RUN control.pub
> C152 0:01.086 WAIT S12168 1237 (CONTROL.PUB.STOCK2K)
> C152 0:00.185 WAIT S12168 1084 (AP01Z.PUB.STOCK2K)
> C152 0:00.773 WAIT S12168 1696 (VTSERVER.NET.SYS) ±±
> >>>>>>>>>>>>>>>why do some (but not all) sessions have
> ^ this
> process on the end?
>
>
> * To join/leave the list, search archives, change list settings, *
> * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *

just to add to Paul's comments - depending on your network topology
and what services are used from the 3000 - it often makes sense to put
the 3000 on a 'quiet' or even its own switch. we have found that
sometimes just the 'noise' on a network causes multiple hardware-level
interrupts for the NIC card and that this can cause instability
because the network stack passes these up to MPE. we have a 3000 that
became unstable on our network even though none of the traffic to the
3000 itself had increased, but non-unicast packets were driving it
crazy. hope that helps.