Weird network problem

[Mustafa Dogan]

Hello all,

I've experienced an unusual (at least for me) network problem for a couple
of weeks.
Our server is an IBM 346 with
3 GHz. Xeon processor,
two Broadcom gigabit ethernet,
1 GB RAM,
72 GB SCSI HDD
etc.

Server runs with NetBSD 3.1. Applications we are using is Apache 2, MySQL,
SpamAssassin,
ClamAV and mail and DNS services. It was working nearly 2 years without
problem.

I'm observing a network problem. Server doesn't permit network connections
until reboot.
I can access server console and doesn't appear any error or warning.
"netstat -w 3" produced this output below: (We are using 512K bandwith)

bge0 in bge0 out total in total out
packets errs packets errs colls packets errs packets errs colls
1797220 1884 2941122 0 0 1850096 2954 2990324 0 0
0 11 0 0 0 0 17 2 0 0
0 8 2 0 0 0 10 3 0 0
0 12 3 0 0 0 15 3 0 0
0 11 1 0 0 0 14 1 0 0
0 7 1 0 0 0 8 1 0 0
0 9 0 0 0 0 10 0 0 0
0 7 2 0 0 0 9 2 0 0
0 8 6 0 0 0 12 7 0 0
0 13 3 0 0 0 14 3 0 0
0 3 1 0 0 0 5 1 0 0
0 6 1 0 0 0 9 1 0 0
0 6 0 0 0 0 17 0 0 0
0 10 0 0 0 0 16 0 0 0
0 6 2 0 0 0 12 2 0 0
0 10 3 0 0 0 10 3 0 0

I replaced ethernet cables, changed ethernet which server used for
connection, even changed server itself.
Results are the same.

Is this a serious problem, or any ideas? Is there any known DoS attack for
this result?

TIA
Mustafa Dogan


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Manuel Bouyer]

Post by Mustafa Dogan
Hello all,
I've experienced an unusual (at least for me) network problem for a couple
of weeks.
Our server is an IBM 346 with
3 GHz. Xeon processor,
two Broadcom gigabit ethernet,
1 GB RAM,
72 GB SCSI HDD
etc.
Server runs with NetBSD 3.1. Applications we are using is Apache 2, MySQL,
SpamAssassin,
ClamAV and mail and DNS services. It was working nearly 2 years without
problem.
I'm observing a network problem. Server doesn't permit network connections
until reboot.

When you says "doesn't permit network connections", what is the exact
symptom ? Does the client gets a connection reset ? Does the
connection time out ? Can you still ping the server ?

Post by Mustafa Dogan
I can access server console and doesn't appear any error or warning.
"netstat -w 3" produced this output below: (We are using 512K bandwith)

does 'dmesg' show anything unusual ?
Also the outout of 'netstat -a -n' and 'netstat -m' could be usefull.

[Mustafa Dogan]

Post by Manuel Bouyer

Post by Mustafa Dogan
Server runs with NetBSD 3.1. Applications we are using is Apache 2, MySQL,
SpamAssassin,
ClamAV and mail and DNS services. It was working nearly 2 years without
problem.
I'm observing a network problem. Server doesn't permit network connections
until reboot.

When you says "doesn't permit network connections", what is the exact
symptom ? Does the client gets a connection reset ? Does the
connection time out ? Can you still ping the server ?

I don't know exactly how it happens. It's happening infrequently. Sometimes
one day, sometimes one hour later after boot, server becomes unresponsive.
I can't even ping the server.

While network stopped, "netstat -w 3"
bge0 in bge0 out total in total out
packets errs packets errs colls packets errs packets errs colls
1797220 1884 2941122 0 0 1850096 2954 2990324 0 0
0 11 0 0 0 0 17 2 0 0
0 8 2 0 0 0 10 3 0 0
0 12 3 0 0 0 15 3 0 0
0 11 1 0 0 0 14 1 0 0

As you can see, all receiving packets are shown on "errs" column.

Post by Manuel Bouyer

Post by Mustafa Dogan
I can access server console and doesn't appear any error or warning.
"netstat -w 3" produced this output below: (We are using 512K bandwith)

does 'dmesg' show anything unusual ?
Also the outout of 'netstat -a -n' and 'netstat -m' could be usefull.

"dmesg" doesn't show anything unusual.
"netstat -a -n" shows few connection, naturally.
"netstat -m" shows:
1046 mbufs in use:
810 mbufs allocated to data
236 mbufs allocated to packet headers
76167 calls to protocol drain routines
^^^^^
Normally protocol drain routines is 0. This number increasing very fast
while network problem seen.

Additional info: Currently, ipf or pf or any other packet filter doesn't run
on server.


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Joerg Sonnenberger]

Post by Mustafa Dogan
810 mbufs allocated to data
236 mbufs allocated to packet headers
76167 calls to protocol drain routines

The number of mbufs is quite near the default mbuf cluster limit, you
might want to increase that first.

Joerg

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de