Comments on: network problem

By: Troy Tate

Troy Tate — Fri, 03 Apr 2009 13:13:43 +0000

The webserver could be dropping pings during times of high utilization due to a misconfigured NIC or switch port setting. Be sure to hard-set the speed and duplex on both the server and the switch. You might be surprised with how many problems this can fix. Autonegotiate should be disabled on all server NICs and switch ports. In the IT trenches? So am I - read my IT-Trenches blog

By: nb0x

nb0x — Fri, 03 Apr 2009 00:14:57 +0000

You can rule out the the web server since you are seeing missed ping packets, an overloaded web server will generally respond to pings even under high load. The increased ping times are indicative of an overloaded link.

To verify this pretty quickly you can use an snmp based monitoring tool like stg grapher for example. See link;

http://www.wtcs.org/informant/free_snmp_tools.htm

I would suggest you monitor the ethernet interface of the 2800 (the interface connected to your local switch). If the utilization rate of this interface is greater than the bandwidth of the circuit then this will confirm root cause. To point stg to the router you will need the local address of the router (def gw address), the snmp community string and the OIDs associated with the bits/second in and bits/second out of the interface.

The correct OIDs (I think) are;
locIfipInOctets 1.3.6.1.4.1.9.2.2.1.1.44
locIfipOutOctets 1.3.6.1.4.1.9.2.2.1.1.45

You will need the snmp index of the interface too which is appended to the OIDs above (if the ifindex is say 3 then you would use 1.3.6.1.4.1.9.2.2.1.1.44.3 for InOctets) An Octet is a byte by the way so multiply by 8 to convert to bits.

Hope this helps.

By: carlosdl

carlosdl — Thu, 02 Apr 2009 13:31:21 +0000

I agree with Labnuke99. It looks like an overloaded link. There are programs that will help you monitor your network, and determine which hosts are generating more traffic than expected. Network Probe is one of them.