Spanning-Tree Packets where there should be none
Posted on 2008-10-02
I am troubleshooting some strange network problems on a very small network. We have one LOB application (Eclipse from Galactek) that intermittently locks up. It is the only application on the network that is experiencing any problem.
The network consists of a WatchGuard firewall / router, a single Netgear unmanaged switch, a Dell PowerEdge 2900 running SBS2003 (from an original shrink wrap), and about 6 desktops and laptops (one of which is, for troubleshooting purposes, currently hosting the problem application).
Troubleshooting has been long and complicated. We have replaced the Sentinel dongle, moved the software offsite, moved it to another machine on the network, temporarily removed anti-virus, and even temporarily removed the entire server. Taking the software offsite or removing the entire server are the only two resolutions that seem to make a difference. We have now reached the point where we are now running Wireshark to look at the actual data on the wire.
We notice the following strange behavior that seems to occur whenever we have the lockup problems. The host machine sends a large stream of data (spanning multiple packets). During that stream of packets we get a series of Spanning-Tree packets.
Info: MAC PAUSE: Quanta 65535
Since the application seems to consistently crash at the same time when this behavior occurs we strongly suspect they are related. There is only one switch on the network. Why are there Spanning-Tree packets on the network at all?
As mentioned earlier, troubleshooting seems to indicate that when we remove the Dell server from the network the problem does not occur. This may be coincidence or it may be part of the problem. If it is part of the problem...WHY? We have replaced the Broadcom NIC in the server with Intel. Teaming is NOT nor was it ever enabled.
I love a challenge, but I'm banging my head against the wall on this one. Any ideas people?