Re: Strange networking issue

From: Willeat, Todd (TWilleat@MHP.SMHS.COM)
Date: Fri Apr 25 2003 - 11:37:26 EDT


I see nothing coming from 170.29.112.30 but a lot of packets from other
addresses...

-----Original Message-----
From: Sippel, Christian [mailto:Christian.Sippel@IZB.DE]
Sent: Friday, April 25, 2003 6:22 AM
To: aix-l@Princeton.EDU
Subject: AW: Strange networking issue

My 0.02c:
AFAIK traceroute sends an message to the destination IP. The first message
has TTL value of 0 so the message is thrown away at the first hop. This
first hop sends an SNMP-message to the source machine and that's how
traceroute on the source machine knows about the first hop. As there are
machines where this SNMP-replys are blocked, after a timeout traceroute send
the next messages with TTL of the last message+1 to reach the second hop. So
the output of the traceroute command shows that the machine is sending
messages with increasing TTLs but never gets a reply.

When you ping from W2K to AIX can you see the incoming ip packet on AIX when
you listen on the interface with iptrace?

Christian

> ----------
> Von: Holger.VanKoll@SWISSCOM.COM[SMTP:Holger.VanKoll@SWISSCOM.COM]
> Antwort an: IBM AIX Discussion List
> Gesendet: Freitag, 25. April 2003 10:43
> An: aix-l@Princeton.EDU
> Betreff: Re: Strange networking issue
>
> yes, there should be no routing, but it is!
> traceroute should exit after 1 "hop"
>
> post output of
>
> netstat -rn
> ifconfig -a
>
>
> -----Original Message-----
> From: Willeat, Todd [mailto:TWilleat@MHP.SMHS.COM]
> Sent: Friday, April 25, 2003 6:56 AM
> To: aix-l@Princeton.EDU
> Subject: Re: Strange networking issue
>
>
> There shouldn't be any routing since both boxes are on the same
> subnet... But, if it helps, here's the traceroute info:
>
> trying to get source for mhp-aquaman
> source should be 170.29.112.254
> traceroute to mhp-aquaman (170.29.112.30) from 170.29.112.254
> (170.29.112.254), 30 hops max outgoing MTU = 1500 1 * * * 2 * * * 3
> * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 *
> * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * *
> * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * *
> 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * *
>
> -----Original Message-----
> From: John Jolet [mailto:john.jolet@FXFN.COM]
> Sent: Thursday, April 24, 2003 8:16 PM
> To: aix-l@Princeton.EDU
> Subject: Re: Strange networking issue
>
>
> really, really sounds like a routing issue...what does a traceroute from
> the aix to win2k box look like?
>
> -----Original Message-----
> From: Willeat, Todd [mailto:TWilleat@MHP.SMHS.COM]
> Sent: Thursday, April 24, 2003 5:22 PM
> To: aix-l@Princeton.EDU
> Subject: Strange networking issue
>
>
> Hi all,
>
> I have a strange network connectivity issue between a p640 box (AIX
> 4.3.3
> ML11) and a Win2K box (SP3). Both boxes are on the same subnet (and same
> switch), but are having problems pinging each other. The Win2K box has
> no problem connecting to other boxes, and people can telnet to the AIX
> box. The Win2K box has 6 GigE connections in an 802.3ad dynamic team.
> The p640 box has a SysKonnect dual-port GigE card running in failover
> mode (as well as the 2 integrated 10/100s - I have one of these on
> another subnet and the Win2K box can ping that just fine...). Looking at
> the arp tables shows that each box knows the other's MAC address. My
> network admin captured some packets between the 2 and this is what we
> saw:
>
> Pinging from Win2K to AIX - we saw the packet go from Win2K to AIX, but
> AIX did not return any packets. Pinging from AIX to Win2K - we saw the
> packet go from AIX to Win2K and saw the response packet from Win2K to
> AIX, but AIX did not receive it (request timed out).
>
> It appears that AIX is dropping the packets from this Win2K box for some
> reason (I have several other p640s with the same config that work fine).
> However, when I rebooted the Win2K box (after it locked up...), I could
> then ping between the boxes. But this only lasted for a day or so, and
> now it is not working again.
>
> Has anyone seen anything like this before?
>
> _______________________________________
> / Todd A. Willeat \
> | UNIX Administrator |
> | Mercy Health Plans |
> | 425 South Woods Mill Road |
> _ | Chesterfield, Missouri 63017-3492 | _
> / )| (314) 214-2329 / (314) 214-8202 (fax) |( \
> / / | twilleat@mhp.mercy.net | \ \
> _( (_ | http://www.mercyhealthplans.com/ | _) )_
> (((\ \> \/->___________<-=-=-=-=->___________<-\/ </ /)))
> (\\\\ \_/ / \ \_/ ////)
> \ / \ /
> \ _/ \_ /
> / / \ \
> /___/ \___\
>
>
> This e-mail contains information which (a) may be PROPRIETARY IN NATURE
> OR OTHERWISE PROTECTED BY LAW FROM DISCLOSURE, and (b) is intended only
> for the use of the addressee (s) named above. If you are not the
> addressee, or the person responsible for delivering this to the
> addressee (s), you are hereby notified that reading, copying or
> distributing this e-mail is prohibited. If you have received this e-mail
> in error, please contact the sender immediately.
>



This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 22:16:46 EDT