Solved

Packet sniffer sees ping, but machine does not reply.

Posted on 2011-02-19
11
559 Views
Last Modified: 2012-05-11
We have been having some crazy intermittent connection problems in a remote office for a few weeks now.  The internet connection will drop out for about 30 seconds about 3 times a day, more at night.  We have been trying 1000 different things, but the biggest result was from the packet sniffer.  During the ‘outage’ we would send pings to the machine in the office running a packet sniffer.  The sniffer will pick up the ping requests but the machine will not respond to the ping request during the outage.  All of the machines will not respond to pings during this time.  Once it’s over, everything is back to normal.  The sniffer appears to show normal activity.  The switch, ISP, router, VPN, etc all respond to pings during this ‘outage’.

Any help or direction would be greatly appreciated.

More info:
Problem is in remote office.  Network has about 7 pc’s on it, connected to an HP Procurve switch.  That goes through a Cisco Pix to an Adtran Integrated Phone/Internet router located in the remote office.  Hardware VPN to Cisco ASA in Main Office.   Cisco Pix in remote office passes out IP’s, DNS #1 is set to Main office, DNS #2 is set to ISP.  Pings are sent from Main office to remote office. Systems run XP.  Server 2003 and DNS are in main office.
0
Comment
Question by:gunkman
  • 7
  • 3
11 Comments
 
LVL 6

Expert Comment

by:Gugro
ID: 34934222
Have you looked at the logs of your router?
Maybe either the internet or the VPN connection is dropping and reconnecting for a short time.
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 34934232
What model PIX?
0
 

Author Comment

by:gunkman
ID: 34935141
It's a Cisco Pix 506e.  My guy that does all of the Cisco work says that he has turned up as much logging as he can and he does not see anything unusual.  He says the VPN stays up with no errors during the 'blips'.

The internet connection to the office is not dropping because I can get to the switch remotely during the blips.  Also, the packet sniffer sees the ping request during the blips, and it's running inside the office on the machine being pinged.
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 34935151
What is license type on 506E?  Unlimited or user license?  If user license, exceeding license count will cause issues like you are experiencing.
0
 

Author Comment

by:gunkman
ID: 34935158
I will find that out now.  Would it put an error into a log somewhere if it exceeded it?
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 
LVL 20

Expert Comment

by:RPPreacher
ID: 34935162
Not that I am aware of.
0
 

Author Comment

by:gunkman
ID: 34935170
My network guy says that it is user license, but not sure how many. He mentioned that we moved this Pix to the remote office when we put the ASA in the main office about a year ago. We had a lot more users in the main office than we do in the remote office now.  The only difference is that the Pix now has DHCP on it and it did not in the main office.
0
 

Author Comment

by:gunkman
ID: 34935182
Ok he logged on. It is unlimited.  Inside Hosts: Unlimited
0
 

Author Comment

by:gunkman
ID: 34935366
Here is a screen shot from the sniffer.  192.168.111.119 is the machine in the main office sending the ping.  192.168.211.104 is the machine in the remote office being pinged.  events 123-124 are normal.  event 142 and 164 are unanswered pings during the 'blip'.
Pings1.gif
0
 

Accepted Solution

by:
gunkman earned 0 total points
ID: 34987205
On the HP Procurve switch, we had 2 ports go bad (right next to each other) during this whole fiasco.  We were able to 100% determine that it was the port, not the cabling, cables, machine, etc.  We called HP, they shipped a new switch the next day.  Magically, all of the problems I discussed in this thread were gone. J  It’s been 3 days with the new switch and no problems, so I am pretty confident that the problem is now corrected.  It was a faulty switch that was causing the intermittent problems.  
0
 

Author Closing Comment

by:gunkman
ID: 35034620
I thought the problem would be network or configuration related, and it was just faulty hardware.  I don't think anyone could have really figured it out without actually being in the office.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
Resolve DNS query failed errors for Exchange
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now