Network interface (NIC) going down for few minuts / hours..

Hello,      -- I am using Red Hat 5.0  --

(continuation on my problems..)
background: The network had security issues that scripts were installed and everything went down hill. I am slowly getting things together.. Read my previous questions to refer, but now this.)

********
Now the Network Interface (NIC) is going down and the internet connection is down at times for few minutes, or few hours even longer, than restores it self. Network is accessable and Internet is up again.

* This is my report when I run "ip a s"

[.. ~]$ ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:23:7d:5b:04:fa brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.4/24 brd 192.168.10.255 scope global eth0
    inet6 fe80::223:7dff:fe5b:4fa/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:23:7d:5b:04:f8 brd ff:ff:ff:ff:ff:ff
4: sit0: <NOARP> mtu 1480 qdisc noop
    link/sit 0.0.0.0 brd 0.0.0.0
7: vmnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:50:56:c0:00:01 brd ff:ff:ff:ff:ff:ff
    inet 192.168.216.1/24 brd 192.168.216.255 scope global vmnet1
    inet6 fe80::250:56ff:fec0:1/64 scope link
       valid_lft forever preferred_lft forever
8: vmnet8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:50:56:c0:00:08 brd ff:ff:ff:ff:ff:ff
    inet 172.16.135.1/24 brd 172.16.135.255 scope global vmnet8
    inet6 fe80::250:56ff:fec0:8/64 scope link
       valid_lft forever preferred_lft forever


*****   But in my 'var/log/mesages", it show this :  where is shows "(my site)" - I removed to hide the name. - sorry *****


May 20 15:31:54 localhost spiderd7: http://(my site)|1432128714|page not found|62.210.215.112|http://(my site)/calendar/rss.xml/2013-09-04?quicktabs_knowledge_base=0&quicktabs_news_and_updates=0||0||calendar/rss.xml/2013-09-04

May 20 15:32:19 localhost spiderd7: http://(my site)|1432128739|page not found|62.210.215.112|http://(my site)/calendar/rss.xml/2013-02-20?quicktabs_knowledge_base=0&quicktabs_events=2&quicktabs_news_and_updates=1||0||calendar/rss.xml/2013-02-20

May 20 15:32:21 localhost spiderd7: http://www.un-spider.org|1432128741|mollom|91.200.12.33|http://(my site)/fr/comment/reply/9686|http://(my site)/fr/comment/reply/9686|0||Error 900: Network error. (rest.mollom.com)  Error 900: Network error. (rest.mollom.com) Request: POST http://rest.mollom.com/v1/content   postTitle = 'nfl clear tote bag'   postBody = 'http://www.paskola-kreditas.com/jscripts/nfl-jerseys-dallas-NFLDTxFQT.html
 nfl clear tote bag http://www.nareboagro.se/Scripts/nfl-clear-tote-bag-T8zp.html'   authorName = 'nfl clear tote bag'   authorIp = '91.200.12.33'   honeypot = 'miwhyhcaxmg@gmail.com'   contextCreated = '1424186905'   checks =     0 = 'spam'   strictness = 'normal'  Request headers:   Accept = 'application/xml, application/json;q=0.8, */*;q=0.5'   Content-Type = 'application/x-www-form-urlencoded'   Authorization = 'OAuth oauth_consumer_key="cf07ab1e0cf9e3ce257f561ab67712f9", oauth_version="1.0", oauth_nonce="e618ae2c62328b606b749f1fe8d877d3", oauth_timestamp="1432128740

May 20 15:32:22 localhost spiderd7: http://(my site)|1432128742|mollom|91.200.12.33|http://(my site)/fr/comment/reply/9686|http://www.un-spider.org/fr/comment/reply/9686|0||Error 900: Network error. (rest.mollom.com)  Error 900: Network error. (rest.mollom.com) Request: POST http://rest.mollom.com/v1/content   postTitle = 'nfl clear tote bag'   postBody = 'http://www.paskola-kreditas.com/jscripts/nfl-jerseys-dallas-NFLDTxFQT.html
 nfl clear tote bag http://www.nareboagro.se/Scripts/nfl-clear-tote-bag-T8zp.html'   authorName = 'nfl clear tote bag'   authorIp = '91.200.12.33'   honeypot = 'miwhyhcaxmg@gmail.com'   contextCreated = '1424186905'   checks =     0 = 'spam'   strictness = 'normal'  Request headers:   Accept = 'application/xml, application/json;q=0.8, */*;q=0.5'   Content-Type = 'application/x-www-form-urlencoded'   Authorization = 'OAuth oauth_consumer_key="cf07ab1e0cf9e3ce257f561ab67712f9", oauth_version="1.0", oauth_nonce="61f0dcf9ba9a7f2c26c33266d0428ecf", oauth_timestamp="1432128742

May 20 15:32:26 localhost gpm[4769]: *** info [client.c(275)]:

May 20 15:32:26 localhost gpm[4769]: Request on 6 (console 1)

May 20 15:32:26 localhost gpm[4769]: *** info [client.c(284)]:

May 20 15:32:26 localhost gpm[4769]: Closing

May 20 15:33:01 localhost spiderd7: http://( my site )|1432128781|page not found|62.210.215.112|http://(my site) /calendar/rss.xml/2012-11-02?quicktabs_events=1&quicktabs_publications=0&quicktabs_news_and_updates=1&quicktabs_knowledge_base=2||0||calendar/rss.xml/2012-11-02

May 20 15:33:19 localhost spiderd7: http:// (my site) |1432128799|page not found|62.210.215.112|(my site) /calendar/rss.xml/2012-11-04uicktabs_knowledge_base=1&quicktabs_events=2&quicktabs_news_and_updates=0&quicktabs_publications=1||0||calendar/rss.xml/2012-11-04

****************

Thank you for your help..
poposkiAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

matrix8086Commented:
It seems to me the follwing possibilities:

Cable fault
Switch port fault
Nic server fault it seems improbably to me
Check with the ISP if is no other client who use your public IP, when your Internet is down
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
poposkiAuthor Commented:
Take a look at these errors on the screen.

2 Pictures
20150512-090437.jpg
20150517-100703.jpg
0
matrix8086Commented:
Do you monitor that NiC? If yes, stop monitoring the network traffic. If no monitoring software is running, you are under a DoS attack or you have a problem on physical layer: port of the switch, network cable fault, NIC needs replacement.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

JAN PAKULAICT Infranstructure ManagerCommented:
can you switch off promiscuous mode?
Seems that something on the network finds out that you have promiscous mode on the nic and blocks/error disables your switchport (looks like switch port security - check logs on the switch)
0
poposkiAuthor Commented:
Last weak we were heavily bombarded with security problems and 3rd party scripts implemented under the root. Those scripts are stopped and nothing is showing in my processes (as far as I can tell). So for the DoS attack maybe, but I don't see anything in the memory or in my logs.

Also I don't have any promiscuous mode switched on. The firewall/router has no changes for almost 2 years.

Now the other suggestions, bad wiring or bad switch, that I need to do stress test or maybe you guys can suggest something else..?
0
matrix8086Commented:
change the port in switch

To verify the wire, you should have a switch with management
0
JAN PAKULAICT Infranstructure ManagerCommented:
well it look like you have promiscuous mode on
on your second image

bridge-eth0:enabled promiscuous mode

do you have access to switch/router?
can you check logs for this switchport?
0
poposkiAuthor Commented:
I will check logs on both on switch and firewall/router. I think you guys are right, bad switch/port of could be cabling... I will look into this when I am back in the office.

But any other ideas, please share them with me.

thank you
0
poposkiAuthor Commented:
Thank you.. Hopefully it will remain stable until new equipment arises.  Thank you
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.