Connection to Switch Drops Packets But Hub Works

Connection to Switch Drops Packets But Hub Works

NewsGroups | Search | Tools
 comp.dcom.lans.ethernet  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Connection to Switch Drops Packets But Hub Works Will 07-10-2007
Posted by Will on July 10, 2007, 1:36 am
If you were  Registered and logged in, you could reply and use other advanced thread options


I have a strange situation that I think others in this group could probably
clarify for me. I have two old Bay Networks / Nortel Accelar 1200
switches, A and B. Switch B uplinks to A, which uplinks in turn to a
Netgear switch which then connects to a firewall. When I plug Computer
One to switch B or switch A directly, the computer works but unreliably.
Occasionally incoming packets are getting dropped (maybe one in six).
Computer One has a single Netgear 10/100 ethernet card in it.

If I take the same Computer One and plug it to a Netgear hub, and then
uplink that hub to either switch A or switch B, now the Computer One works
very reliably, both fast and no dropped packets at all.

Does anyone have an explanation as to why such a behavior would happen?
The sniffer trace when run from the Computer One clearly shows missing
packets, as compared to the sniffer trace taken from the firewall on the
subnet outbound from the firewall to the switch A / B complex. I assume
the problem is at the ethernet level, which unfortunately the trace doesn't
show, except for layer 2 / ARP. I suppose there could be another computer
doing man-in-the-middle attacks and stealing packets using Computer One's
ethernet address, but I'm hoping to find a simpler explanation before going
off on a wild goose chase for a hacker.

--
Will



Pure Networks
Posted by David Schwartz on July 10, 2007, 8:11 am
If you were  Registered and logged in, you could reply and use other advanced thread options



> I have a strange situation that I think others in this group could probably
> clarify for me. I have two old Bay Networks / Nortel Accelar 1200
> switches, A and B. Switch B uplinks to A, which uplinks in turn to a
> Netgear switch which then connects to a firewall. When I plug Computer
> One to switch B or switch A directly, the computer works but unreliably.
> Occasionally incoming packets are getting dropped (maybe one in six).
> Computer One has a single Netgear 10/100 ethernet card in it.
>
> If I take the same Computer One and plug it to a Netgear hub, and then
> uplink that hub to either switch A or switch B, now the Computer One works
> very reliably, both fast and no dropped packets at all.
>
> Does anyone have an explanation as to why such a behavior would happen?
> The sniffer trace when run from the Computer One clearly shows missing
> packets, as compared to the sniffer trace taken from the firewall on the
> subnet outbound from the firewall to the switch A / B complex. I assume
> the problem is at the ethernet level, which unfortunately the trace doesn't
> show, except for layer 2 / ARP. I suppose there could be another computer
> doing man-in-the-middle attacks and stealing packets using Computer One's
> ethernet address, but I'm hoping to find a simpler explanation before going
> off on a wild goose chase for a hacker.

There are a few possibilities, but I'm going to go with
autonegotiation failure. The device is probably choosing half-duplex
even though the switch is choosing full-duplex.

If the switches are configurable:

1) If they have an 'auto' setting, try that first.

2) DO NOT set the switches duplex (and especially do not set full-
duplex) unless you can also set the devices the same! It is a serious
mistake to hard-set the duplex on only one end of an Ethernet link
(except in *very* limited circumstances).

3) If the switches have no 'auto' setting, either set them to 'half-
duplex' or set both the switch and the device to 'full-duplex'. (Most
likely, your device will choose half-duplex if it cannot negotiation.)

4) If possible, manually confirm that both ends have the same duplex
setting.

DS


Posted by Will on July 11, 2007, 2:24 am
If you were  Registered and logged in, you could reply and use other advanced thread options


This was a good guess, but it didn't solve the problem. I can configure
the ethernet adapter on the host computer as any of:

10BT Half
10BT Full
100BT Half
100BT Full
Autosense

and I get more or less equally unreliable effects, packets getting dropped.

As soon as I connect the host to a hub the problem goes away.

I tried to use an aggregating tap to look at the traffic, but sure enough
you connect the host to the aggregating tap and the problem goes away again.

So definitely it looks like some kind of compatibility issue between the
adapter and the switch, but very strange that I cannot get it to work at any
fixed configuration.

--
Will

>
>> I have a strange situation that I think others in this group could
>> probably
>> clarify for me. I have two old Bay Networks / Nortel Accelar 1200
>> switches, A and B. Switch B uplinks to A, which uplinks in turn to a
>> Netgear switch which then connects to a firewall. When I plug
>> Computer
>> One to switch B or switch A directly, the computer works but unreliably.
>> Occasionally incoming packets are getting dropped (maybe one in six).
>> Computer One has a single Netgear 10/100 ethernet card in it.
>>
>> If I take the same Computer One and plug it to a Netgear hub, and then
>> uplink that hub to either switch A or switch B, now the Computer One
>> works
>> very reliably, both fast and no dropped packets at all.
>>
>> Does anyone have an explanation as to why such a behavior would happen?
>> The sniffer trace when run from the Computer One clearly shows missing
>> packets, as compared to the sniffer trace taken from the firewall on the
>> subnet outbound from the firewall to the switch A / B complex. I assume
>> the problem is at the ethernet level, which unfortunately the trace
>> doesn't
>> show, except for layer 2 / ARP. I suppose there could be another
>> computer
>> doing man-in-the-middle attacks and stealing packets using Computer One's
>> ethernet address, but I'm hoping to find a simpler explanation before
>> going
>> off on a wild goose chase for a hacker.
>
> There are a few possibilities, but I'm going to go with
> autonegotiation failure. The device is probably choosing half-duplex
> even though the switch is choosing full-duplex.
>
> If the switches are configurable:
>
> 1) If they have an 'auto' setting, try that first.
>
> 2) DO NOT set the switches duplex (and especially do not set full-
> duplex) unless you can also set the devices the same! It is a serious
> mistake to hard-set the duplex on only one end of an Ethernet link
> (except in *very* limited circumstances).
>
> 3) If the switches have no 'auto' setting, either set them to 'half-
> duplex' or set both the switch and the device to 'full-duplex'. (Most
> likely, your device will choose half-duplex if it cannot negotiation.)
>
> 4) If possible, manually confirm that both ends have the same duplex
> setting.
>
> DS
>



Posted by Robert Redelmeier on July 11, 2007, 9:15 am
If you were  Registered and logged in, you could reply and use other advanced thread options


Please don't top-post. Quote & respond preserves context
and facilitates editing to avoid excessive length.

> 10BT Half 10BT Full 100BT Half 100BT Full Autosense

> and I get more or less equally unreliable effects, packets
> getting dropped.

> As soon as I connect the host to a hub the problem goes away.

Same cabling? A real hub? Must be old. 10 or 100?

> So definitely it looks like some kind of compatibility issue
> between the adapter and the switch, but very strange that
> I cannot get it to work at any fixed configuration.

Some old switches were only designed for input from hubs.
Not that that _should_ make any difference. I would
suggest a fried port, but I think you've tried two switches.

-- Robert


Posted by Will on July 11, 2007, 1:54 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


> Please don't top-post. Quote & respond preserves context
> and facilitates editing to avoid excessive length.

My own rule and tastes are to post inline when there are multiple points to
respond to which each require a separate context to be established. When
you are making a single reply to the entire thread, I don't see how it helps
anyone to force them to read a very long thread that precedes the response
unless they choose to do so.

In keeping with the above rule, this post keeps responses inline.


> > 10BT Half 10BT Full 100BT Half 100BT Full Autosense
>
> > and I get more or less equally unreliable effects, packets
> > getting dropped.
>
> > As soon as I connect the host to a hub the problem goes away.
>
> Same cabling? A real hub? Must be old. 10 or 100?

Same cabling.

Hub is a Netgear 8 port autosensing 10/100 hub. Nice little boxes for what
you pay for them. It's maybe seven years old?


> > So definitely it looks like some kind of compatibility issue
> > between the adapter and the switch, but very strange that
> > I cannot get it to work at any fixed configuration.
>
> Some old switches were only designed for input from hubs.
> Not that that _should_ make any difference. I would
> suggest a fried port, but I think you've tried two switches.

We tried two different adapters on the affected host with the same result on
each. What is interesting is that the problem follows the specific host.

There are maybe 15 other computers on the same switches, and those don't
appear to have this issue.

The computer is old, and the configuration on it is well worn (and we
suspect possibly infected by Trojan), so probably it would be best to
rebuild to newer hardware.

--
Will



Similar ThreadsPosted
Promiscuous Mode on Sun BGE Network Driver Drops VLAN-tagged Packets April 20, 2005, 11:02 am
FS/FA: $160.00 Extreme Networks Summit48 Switch w/basic layer 3 (works great) 2944 August 9, 2005, 10:31 am
Uplink drops intermittently... April 20, 2006, 3:46 am
Problem: UTP only works at 10 MHz July 27, 2007, 8:02 pm
Internet works but computers don't see each other - "MSHOME is not available..." September 18, 2008, 5:11 am
ping corrupted packets February 21, 2005, 9:19 am
DVMRP report packets September 24, 2006, 10:25 pm
Seeing Packets on an Ethernet Port That Should Not Be There October 4, 2007, 11:54 pm
Dropped packets/broken TCP connections August 23, 2006, 9:48 am
arbitrary packets on an ethernet network January 19, 2007, 5:11 am

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map