random bursts of dropped packets
Posted on 2009-04-30
My network is a Sonicwall TZ 210 UTM which is connected to a Dell 48 port unmanaged switch. A server running Windows SBS 2003 which does DHCP DNS hosts the exchange server and is my print server, 2 network copier/printers, 1 NAS device, and 20 or so workstations running XP Pro. There is one domain on a with class c private address on a /24 subnet. I use a DHCP scope of 192.168.1.30-192.168.1.100. Subnet is 255.255.255.0. The Sonicwall has a static IP and is the gateway. The printers have static IP outside the distributed range. Basically, everything is configured correctly.
Approx. 3-4 of the workstations run some billing software which access the SQL server. Lately, these workstations have been getting popup errors pertaining to a loss of connection with the sql server. The configuration of these workstations and the sql server itself was checked over by the company that handles this billing software and they assure me it is a problem with my network.
I was running ping-t and watching constantly on both servers, the 2 printers, (just because I remembered their IP addresses off the top of my head,) and a few random workstations. Once every so often, (with no discernable pattern,) every computer I was watching the ping -t on would drop a packet or 2 at exactly the same time. Right after that, one of the printers will then drop all packets for 30 sec until a min. The other computers I'm watching resume normal ping responses. I watched this happen 7-8 times over the period of an afternoon and thought I had it narrowed down, (after testing the cat5 to the printer,) to be the printers NIC. Also, its important to note that when this happens is when the workstations running the billing software that access the sql server throw their errors about connection loss.
The strange thing is the last time it happen, it was not the same printer that dropped all packets from the ping -t for 30 sec to a min but rather the OTHER printer. That blew my bad NIC idea out of the water. I tested the cable to the other printer and it checked out fine. I'm back at square I trying to figure out whats going on.
I did monitor network traffic with a laptop connected to my switch and running wireshark but I"m not an expert and really didn't see anything jump out at me when these events happen.
I had a problem with a bad cable before and used a similar method to track it down but I really have no clue how to track this problem down or even remotely might be causing it.
Any additional suggestions would be greatly appreciated.