Question

How do I determine what is causing network drops?

Asked by: fekdep

Every so often, all of my machines drop their connection to the server for an instant.  It isn't really noticeable in any program but the accounting package since it accesses the network so often.

The server (2003 Standard) has no errors in the logs, nor do the workstations.  When I do quick network tests, everything is fine.

However, the accounting package randomly reports problems connecting to its data.

It's not the accounting package.  The previous accounting package had the same problems.

How do i tell where the problem is? Is there a tool that will constantly send and receive files to and from the server and report dropped connections?


This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-01-18 at 21:27:02ID24062872
Tags

Server 2003

,

networking

,

diagnostics

,

test

Topics

Windows 2003 Server

,

Computer Servers

,

Networking Hardware

Participating Experts
4
Points
500
Comments
20

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. Workstations dropping off network
    I have several win95 & win98 workstations that are dropping off the network. The only apps they have open are either word or excel (97), possibly outlook, and or a telnet session. These are AMD k6-2 processors (newer machines). Checked the logs, etc.. but have not found a...
  2. MSN messenger constantly disconnects
    I work on a small workgroup-based-windows network with a simple linksys router that provides DHCP services and little firewall restrictions. Many in the office use MSN messenger by itself or in conjunction with trillian. The problem is that MSN messenger constantly disconne...
  3. Filtering instant messanger
    I have a lan with a firewall. I need to block all of the instant messengers from my lan. All of my computers are windows 98 and I have one Mac computer. Please advice
  4. AOL Instant Messenger
    Something horrible is happening! There is a link that's making its way into AOL Instant Messenger profiles that points to buddypicture.net! That's not a real site! It gives you a virus! You cannot erase it from your profile, nor can you change anything else that tells peo...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: johnb6767Posted on 2009-01-18 at 21:33:48ID: 23408348

Easiest thing to do, from an accounting machine....

ping -t server'sipaddress

And let it run...If the package drops, but the pings dont, then you might need to look at the app, or vice versa....

 

by: fekdepPosted on 2009-01-18 at 21:37:05ID: 23408358

I've done this, no problems.  Id like something that sends larger files and logs the results.

 

by: motley74Posted on 2009-01-18 at 21:39:00ID: 23408364

I agree with johnb6767.

If you run a constant ping test and every once in a while you see a ping not get a reply then you may have a switch that is resetting the connections in which case I would check logs from the switch if possible.

 

by: motley74Posted on 2009-01-18 at 21:44:24ID: 23408380

You could try to send a larger packet size with the ping command if the max (65500) is large enough

ping -t -l 65500 "serveraddress"

 

by: uetian1707Posted on 2009-01-19 at 01:47:26ID: 23409224

Hi,

Also you can sniff network traffic from your network and check for possible errors. Wireshark is handy utility for such purpose;

www.wireshark.org

Incase you are new to Wireshark;

wiki.wireshark.org

 

by: atrevidoPosted on 2009-01-19 at 07:51:04ID: 23411622

Try

ping -t -f -l 1472 <ipaddress>

Where -f is DO NOT Fragment

and -l is declaring the packet size.  

What time period are the drops?  Do they occur 24 hours a day, 7 days a week?  Or just during business hours.  Is the accounting app on its own server?  Is that on a gigabit port?  What do the switch logs have to say?

 

by: fekdepPosted on 2009-01-19 at 08:16:48ID: 23411886

I let a ping run overnight.
Sent = 34685, Received = 34651, Lost = 34

I can only say for certain that the drops occur during business hours as they are only reported by users of the accounting app.  That is why I would like to find an app that simulates that kind of usage and keeps a log.

The app is not on its own server.  This is a small network with only 8 clients.  The server runs AD, DNS, DHCP and File Sharing.  It is a GB network card, but the switch is 10/100

The switch isn't managed.

 

by: atrevidoPosted on 2009-01-19 at 08:28:26ID: 23411986

I would suggest Wireshark as per the above user or MRTG.  But if this is that small you might want to try just adding an additional network card to the server or upgrading the switch to a managed 8 port gig switch.  You can get the HP Procurve 1800-8G Switch for < $200 and it's web managed.  can't complain about that.  Seems like a cheap trial and will increase overall network communciations between your clients and the server(s)

 

by: fekdepPosted on 2009-01-19 at 08:39:48ID: 23412101

I installed wireshark, but it appears to just capture packets and not run any tests of its own.  I'm not sure what to do with information like that.  From boardroom to server, to wherever else...

 

by: atrevidoPosted on 2009-01-19 at 08:49:29ID: 23412185

Yes, wireshark will only capture packets. It will only capture what is being sent to your NIC, so if you cannot manage that switch and program a monitor port then I suggest switching to a managed switch per my comment above.  You are probably only capturing packets coming to your PC if you installed it on your PC. If you installed it on the main server then you would need to examine the packets around the time that there was a drop and see what was going on in your network.  You would need to do some packet diving, some real details detective work....

Again, for $200 bucks put a managed switch in there with gig ports

 

by: motley74Posted on 2009-01-19 at 09:35:02ID: 23412706

You clue is the 34 lost packets.  We need to find out why those packets are getting lost.

I would agree that upgrading the switch is not a bad idea since you have GB NIC but I would check the settings on the server and the switch (if the switch is managed) , specifically I would make sure the duplex settings are correct (both should be full-deplex connections.

If the duplex settings are both set to auto or full-duplex then we should look into what wireshark is finding when the packets are getting lost.  Also record the times when you get a lost packet and look in the Windows System log to see if there were any issues during that time, you may find that the system is logging some information entries (you are looking for the source to be "Tcpip" and possibly event id's of 4201 and 4202) that show the network card disconnecting and reconnecting which could be a network card going bad.

 

by: johnb6767Posted on 2009-01-19 at 11:42:40ID: 23413760

Dont forget to disable all power management on the NIC in the device manager.....

 

by: fekdepPosted on 2009-01-19 at 11:45:04ID: 23413785

None of the machines are reporting any erros in the logs.  I ran the ping -f today on my test machine.  There were 0 drops, but one user on the network reported two issues with the accounting package in that time.

I'll run wireshark on an active machine and get a managed switch.  

 

by: fekdepPosted on 2009-01-19 at 12:00:01ID: 23413940

hmmm... 8ports isn't enough.  The next is a 24 port at $500.

Does anyone know of a 16 port managed switch? I can't seem to find one.

 

by: motley74Posted on 2009-01-19 at 13:32:36ID: 23414762

Linksys (Cisco) makes one, the model is SRW2016 and it costs around $320.

 

by: fekdepPosted on 2009-01-20 at 20:40:57ID: 23426901

I ran wireshark all day today, I'm getting a lot of this:

"281864","35897.095884","192.168.4.200","192.168.4.105","DNS","Standard query response, Server failure"
"281865","35897.095955","192.168.4.200","192.168.4.105","DNS","Standard query response, Server failure"
"281866","35897.095991","192.168.4.105","192.168.4.200","ICMP","Destination unreachable (Port unreachable)"

"185788","32164.014982","192.168.4.200","192.168.4.105","SMB","Trans2 Response, QUERY_PATH_INFO, Error: STATUS_OBJECT_NAME_NOT_FOUND"

"571025","51520.910126","192.168.4.105","192.168.4.200","SMB","NT Create AndX Request, Path: \D:Docf_\005QebiesnrMkudrfcoIaamtykdDa:$DATA"
"571026","51520.910474","192.168.4.200","192.168.4.105","SMB","NT Create AndX Response, FID: 0x0000, Error: STATUS_OBJECT_NAME_NOT_FOUND"

"744145","53983.909503","192.168.4.200","192.168.4.105","SMB","Read AndX Response, FID: 0x4068, Error: STATUS_FILE_LOCK_CONFLICT"
"744146","53983.909614","192.168.4.105","192.168.4.200","SMB","Read AndX Request, FID: 0x4068, 4096 bytes at offset 0"

"195956","32484.026545","192.168.4.105","192.168.4.200","SMB","Trans2 Request, GET_DFS_REFERRAL, File: \ifl-server\file"
"195957","32484.048277","192.168.4.200","192.168.4.105","SMB","Trans2 Response, GET_DFS_REFERRAL, Error: STATUS_NOT_FOUND"

 

by: motley74Posted on 2009-02-08 at 16:16:14ID: 23586480

It looks to me like your problem could be DNS related by looking at the first couple of packets which are DNS failures.  I would check your DNS server for any issues and maybe set one of the clients that is having a problem to access the server using the IP address rather than a name and see if the problem goes away on that machine.

The third packet looks like a ping failure due to a firewall blocking the port.

The rest of the trace looks like Samba server errors which could also be the problem if the server/clients are using Samba shares.

 

by: fekdepPosted on 2009-04-02 at 22:31:42ID: 24056888

I'm still working on this problem....

No DNS errors with DCDIAG.
I've replaced the Server's: NIC, CABLE, SWITCH, ROUTER.
When I move the accounting application to a workstaton, everything is fine.
There is no firewall on the server at this time.  I am using McAfee on the workstations though.  McAfee has a firewall portion that is dissabled.  


The advise to access the server via IP is interesting.  Is there a way that I can test server-workstation connection to a shared folder without using IP?  I don't want to put the accounting package back on the server until I have this sorted out.

 

by: motley74Posted on 2009-04-03 at 15:04:11ID: 24064727

If you want to test that a share is accessible all you need to do is map a network drive or use Windows Explorer to see if you can view the share.  To map a network drive using the command line you can issue the following command...

net use X: \\SERVERNAME\SHARENAME

Just replace X with the drive letter you want to assign to the mapped share and replace SERVERNAME and SHARENAME with the appropriate information.  If it is working you will get a "Command Completed Successfully" message and you will see the share in Windows Explorer

You can also just type \\SERVERNAME\SHARENAME into a Windows Explorer window and it should either show up or ask for the username/password if the share is protected.

 

by: fekdepPosted on 2009-05-08 at 07:39:21ID: 24336475

After replacing the switch, network card, cable, and reinstalling the OS with no luck I've dropped a new server in.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...