Subject: network connections are suddenly dropped ?

From: "Markus Koch" <[email-masked]>
Date: Tue, 12 Feb 2002 23:32:01 +0100

Hi

One of my servers (PII400/440BX/Intel EtherexpressPro or Realtek and SCSI on
board / 2.4.16) suddenly drops all connections to it (appletalk and samba).
The server is not even reachable by pings. During the workday, this persists
for 1 to 5 min and then everything is fine again. At night or on weekends if
nobody is around, this issue could persist for a whole day.
I sniffed all broadcast and server specific traffic from a second linux
computer within the same network (logs
are attached). It looks to me as if the server suddenly forgets all arp
entries and sends out arp requests. The weird thing is, that he does not
seem to recognize the arp answers but keeps on asking. Is there anybbody
with an isea? I tried almost everything: new NIC, new kernel, new netatalk,
etc. All other servers with similar harware and linux systems but without
appletalk are fine.

thanks

markus

sniffed from 192.168.1.1
(server in question is 192.168.1.2  192.168.1.104 is a win95 that is active
but does not answer)

159447 16:58:38.2394 00:e0:18:90:57:31 -> 00:05:02:e1:a9:5b ARP Who has
192.168.1.120?  Tell 192.168.1.2
159448 16:58:38.2398 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159450 16:58:39.2395 00:e0:18:90:57:31 -> 00:05:02:e1:a9:5b ARP Who has
192.168.1.120?  Tell 192.168.1.2
159451 16:58:39.2398 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159452 16:58:40.2396 00:e0:18:90:57:31 -> 00:05:02:e1:a9:5b ARP Who has
192.168.1.120?  Tell 192.168.1.2
159453 16:58:40.2399 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159454 16:58:41.2396 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.120?  Tell 192.168.1.2
159455 16:58:41.2399 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159457 16:58:42.2397 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.120?  Tell 192.168.1.2
159458 16:58:42.2400 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159459 16:58:43.2398 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.120?  Tell 192.168.1.2
159460 16:58:43.2400 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159461 16:58:43.7198 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.105?  Tell 192.168.1.2
159462 16:58:43.7209 Apple_d7:be:26 -> 00:e0:18:90:57:31 ARP 192.168.1.105
is at 08:00:07:d7:be:26
159463 16:58:44.7199 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.105?  Tell 192.168.1.2
159464 16:58:44.7209 Apple_d7:be:26 -> 00:e0:18:90:57:31 ARP 192.168.1.105
is at 08:00:07:d7:be:26
159466 16:58:45.7199 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.105?  Tell 192.168.1.2
159467 16:58:45.7210 Apple_d7:be:26 -> 00:e0:18:90:57:31 ARP 192.168.1.105
is at 08:00:07:d7:be:26
159468 16:58:45.9900 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.122?  Tell 192.168.1.2
159469 16:58:46.0084 00:0a:27:b6:0d:5c -> 00:e0:18:90:57:31 ARP
192.168.1.122 is at 00:0a:27:b6:0d:5c
159471 16:58:46.9900 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.122?  Tell 192.168.1.2
159472 16:58:46.9902 00:0a:27:b6:0d:5c -> 00:e0:18:90:57:31 ARP
192.168.1.122 is at 00:0a:27:b6:0d:5c
1159475 16:58:47.9901 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.122?  Tell 192.168.1.2
159476 16:58:47.9903 00:0a:27:b6:0d:5c -> 00:e0:18:90:57:31 ARP
192.168.1.122 is at 00:0a:27:b6:0d:5c159574
(snipped)
159579 17:01:03.2613 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.1?  Tell 192.168.1.2
159580 17:01:03.2614 00:30:84:0b:27:c3 -> 00:e0:18:90:57:31 ARP 192.168.1.1
is at 00:30:84:0b:27:c3
159581 17:01:03.7204 00:30:84:0b:27:c3 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.1
159582 17:01:04.2592 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.1?  Tell 192.168.1.2
159583 17:01:04.2593 00:30:84:0b:27:c3 -> 00:e0:18:90:57:31 ARP 192.168.1.1
is at 00:30:84:0b:27:c3
159584 17:01:05.2593 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.1?  Tell 192.168.1.2
159585 17:01:05.2593 00:30:84:0b:27:c3 -> 00:e0:18:90:57:31 ARP 192.168.1.1
is at 00:30:84:0b:27:c3
159586 17:01:06.8494 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.120?  Tell 192.168.1.2
159587 17:01:06.8497 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159588 17:01:07.8495 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.120?  Tell 192.168.1.2
159589 17:01:07.8497 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159590 17:01:08.2204 00:30:84:0b:27:c3 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.1
159591 17:01:08.8495 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.120?  Tell 192.168.1.2
159592 17:01:08.8498 00:05:02:e1:a9:5b -> 00:e0:18:90:57:31 ARP
192.168.1.120 is at 00:05:02:e1:a9:5b
159593 17:01:09.2204 00:30:84:0b:27:c3 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.1
159594 17:01:10.2204 00:30:84:0b:27:c3 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.1
159595 17:01:13.2681 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.1?  Tell 192.168.1.2
159596 17:01:13.2682 00:30:84:0b:27:c3 -> 00:e0:18:90:57:31 ARP 192.168.1.1
is at 00:30:84:0b:27:c3
159597 17:01:14.2599 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.1?  Tell 192.168.1.2
159598 17:01:14.2599 00:30:84:0b:27:c3 -> 00:e0:18:90:57:31 ARP 192.168.1.1
is at 00:30:84:0b:27:c3
159599 17:01:15.2599 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.1?  Tell 192.168.1.2
159600 17:01:15.2600 00:30:84:0b:27:c3 -> 00:e0:18:90:57:31 ARP 192.168.1.1
is at 00:30:84:0b:27:c3
159601 17:01:16.6801 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.2
159602 17:01:17.3301 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.105?  Tell 192.168.1.2
159603 17:01:17.3311 Apple_d7:be:26 -> 00:e0:18:90:57:31 ARP 192.168.1.105
is at 08:00:07:d7:be:26
159604 17:01:17.6801 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.2
159605 17:01:18.3302 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.105?  Tell 192.168.1.2
159606 17:01:18.3312 Apple_d7:be:26 -> 00:e0:18:90:57:31 ARP 192.168.1.105
is at 08:00:07:d7:be:26
159607 17:01:18.6802 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.104?  Tell 192.168.1.2
159608 17:01:19.3302 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.105?  Tell 192.168.1.2
159609 17:01:19.3313 Apple_d7:be:26 -> 00:e0:18:90:57:31 ARP 192.168.1.105
is at 08:00:07:d7:be:26
159610 17:01:19.6003 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.122?  Tell 192.168.1.2
159611 17:01:19.6005 00:0a:27:b6:0d:5c -> 00:e0:18:90:57:31 ARP
192.168.1.122 is at 00:0a:27:b6:0d:5c
159612 17:01:20.6003 00:e0:18:90:57:31 -> ff:ff:ff:ff:ff:ff ARP Who has
192.168.1.122?  Tell 192.168.1.2

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:E0:18:90:57:31
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          EtherTalk Phase 2 addr:65280/94
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:349589 errors:0 dropped:0 overruns:0 frame:0
          TX packets:208378 errors:0 dropped:0 overruns:0 carrier:0
          collisions:132288

---

From: Magnus Stenman <[email-masked]>
Date: Wed, 13 Feb 2002 06:48:00 +0100

You have a lot of collisions...

Also, try to eliminate physical problems with your network, e.g. by
pulling a separate, known good ethernet cable to a known good switch?

/m

---

From: Dejan Muhamedagic <[email-masked]>
Date: Wed, 13 Feb 2002 12:11:43 +0100

Hi,

Have you tried changing the port on your hub/switch (I guess that
it's a hub because there are collisions, and way too many at that)?
Another thing to check is the cabling.  Try one or the other when
the problem reappears.

Cheers,

Dejan

---

From: Thomas Schierle <[email-masked]>
Date: Thu, 14 Feb 2002 00:48:45 +0100

On 2002-02-12 23:32 +0100, Markus Koch wrote:

> The server is not even reachable by pings.

do you have log entries similar to those below:

>> servername afpd[1767]: dsi_stream_send: Connection reset by peer
>> servername afpd[1767]: afp_read: Connection reset by peer
>> servername afpd[1767]: [1767]: dsi_stream_write: Broken pipe
>> servername netatalk(pam_unix)[1767]: session closed for user username

If so, you might want to recompile with "sendfile_flavor_linux" disabled:
run ./configure [options_to_your_liking], then edit config.h.

Replace the line
#define SENFILE_FLAVOUR_LINUX 1

by
/# *undef SENFILE_FLAVOUR_LINUX */

-Thomas

-- 
Thomas Schierle, Munich, Germany

PGP key [DSS/DH] 0xA23CDA1D available at various public key servers