RE: network selective packet loss

[Burke, Thomas G.]

I find it interesting that the echo time grows by 80000 ms on each return...  I'll ask what may be a dumb question:  Have you checked the cable?  Maybe it's been damaged and is introducing a noise error of some sort?  That's my 1st WAG...

-----Original Message-----
From: Aaron M Daley [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, March 05, 2002 4:56 PM
To: [EMAIL PROTECTED]
Subject: network selective packet loss

I get the following ping info on my mail server and now one of our file servers as well indicating that we may have been hacked or there's a virus spreading. Here are two ping results from the same machine. Ping results from the file server are identical.

PING 192.168.10.5 (192.168.10.5) from 192.168.10.60 : 56(84) bytes of data.
64 bytes from 192.168.10.5: icmp_seq=0 ttl=128 time=0.8 ms
64 bytes from 192.168.10.5: icmp_seq=1 ttl=128 time=80000.6 ms
64 bytes from 192.168.10.5: icmp_seq=2 ttl=128 time=160000.3 ms
64 bytes from 192.168.10.5: icmp_seq=3 ttl=128 time=240000.3 ms
64 bytes from 192.168.10.5: icmp_seq=4 ttl=128 time=320000.3 ms
64 bytes from 192.168.10.5: icmp_seq=5 ttl=128 time=400000.3 ms
64 bytes from 192.168.10.5: icmp_seq=6 ttl=128 time=480000.3 ms
64 bytes from 192.168.10.5: icmp_seq=7 ttl=128 time=560000.3 ms
64 bytes from 192.168.10.5: icmp_seq=8 ttl=128 time=640000.3 ms
64 bytes from 192.168.10.5: icmp_seq=9 ttl=128 time=720000.3 ms
64 bytes from 192.168.10.5: icmp_seq=10 ttl=128 time=800000.3 ms
64 bytes from 192.168.10.5: icmp_seq=11 ttl=128 time=880000.3 ms
64 bytes from 192.168.10.5: icmp_seq=12 ttl=128 time=960000.3 ms
64 bytes from 192.168.10.5: icmp_seq=13 ttl=128 time=1040000.3 ms
64 bytes from 192.168.10.5: icmp_seq=14 ttl=128 time=1120000.4 ms
64 bytes from 192.168.10.5: icmp_seq=15 ttl=128 time=1200000.3 ms
64 bytes from 192.168.10.5: icmp_seq=16 ttl=128 time=1280000.3 ms
64 bytes from 192.168.10.5: icmp_seq=17 ttl=128 time=1360000.4 ms
64 bytes from 192.168.10.5: icmp_seq=18 ttl=128 time=1440000.3 ms
64 bytes from 192.168.10.5: icmp_seq=19 ttl=128 time=1520000.3 ms
64 bytes from 192.168.10.5: icmp_seq=20 ttl=128 time=1600000.4 ms
64 bytes from 192.168.10.5: icmp_seq=21 ttl=128 time=1680000.3 ms
64 bytes from 192.168.10.5: icmp_seq=22 ttl=128 time=1760000.3 ms
64 bytes from 192.168.10.5: icmp_seq=23 ttl=128 time=1840000.3 ms
64 bytes from 192.168.10.5: icmp_seq=24 ttl=128 time=1920000.4 ms
64 bytes from 192.168.10.5: icmp_seq=25 ttl=128 time=2000000.3 ms
64 bytes from 192.168.10.5: icmp_seq=26 ttl=128 time=2080000.4 ms
64 bytes from 192.168.10.5: icmp_seq=27 ttl=128 time=2160000.3 ms
64 bytes from 192.168.10.5: icmp_seq=28 ttl=128 time=2240000.3 ms
64 bytes from 192.168.10.5: icmp_seq=29 ttl=128 time=2320000.3 ms
64 bytes from 192.168.10.5: icmp_seq=30 ttl=128 time=2400000.3 ms
64 bytes from 192.168.10.5: icmp_seq=31 ttl=128 time=2480000.3 ms
64 bytes from 192.168.10.5: icmp_seq=32 ttl=128 time=2560000.3 ms
64 bytes from 192.168.10.5: icmp_seq=33 ttl=128 time=2640000.3 ms
64 bytes from 192.168.10.5: icmp_seq=34 ttl=128 time=2720000.3 ms
64 bytes from 192.168.10.5: icmp_seq=35 ttl=128 time=2800000.3 ms
64 bytes from 192.168.10.5: icmp_seq=36 ttl=128 time=2880000.3 ms
64 bytes from 192.168.10.5: icmp_seq=37 ttl=128 time=2960000.3 ms
64 bytes from 192.168.10.5: icmp_seq=38 ttl=128 time=3040000.3 ms
64 bytes from 192.168.10.5: icmp_seq=39 ttl=128 time=3120000.3 ms
64 bytes from 192.168.10.5: icmp_seq=40 ttl=128 time=3200000.3 ms
64 bytes from 192.168.10.5: icmp_seq=41 ttl=128 time=3280000.3 ms
64 bytes from 192.168.10.5: icmp_seq=42 ttl=128 time=3360000.3 ms
64 bytes from 192.168.10.5: icmp_seq=43 ttl=128 time=3440000.3 ms
64 bytes from 192.168.10.5: icmp_seq=44 ttl=128 time=3520000.2 ms
64 bytes from 192.168.10.5: icmp_seq=45 ttl=128 time=3600000.3 ms
64 bytes from 192.168.10.5: icmp_seq=46 ttl=128 time=3680000.3 ms
64 bytes from 192.168.10.5: icmp_seq=47 ttl=128 time=3760000.3 ms
64 bytes from 192.168.10.5: icmp_seq=48 ttl=128 time=3840000.4 ms
64 bytes from 192.168.10.5: icmp_seq=49 ttl=128 time=3920000.3 ms
64 bytes from 192.168.10.5: icmp_seq=50 ttl=128 time=4000000.4 ms
64 bytes from 192.168.10.5: icmp_seq=51 ttl=128 time=4080000.3 ms
64 bytes from 192.168.10.5: icmp_seq=52 ttl=128 time=4160000.3 ms
64 bytes from 192.168.10.5: icmp_seq=53 ttl=128 time=4240000.3 ms
64 bytes from 192.168.10.5: icmp_seq=54 ttl=128 time=4320000.3 ms
64 bytes from 192.168.10.5: icmp_seq=55 ttl=128 time=4400000.3 ms
64 bytes from 192.168.10.5: icmp_seq=56 ttl=128 time=4480000.3 ms
64 bytes from 192.168.10.5: icmp_seq=57 ttl=128 time=4560000.3 ms
64 bytes from 192.168.10.5: icmp_seq=58 ttl=128 time=4640000.3 ms
64 bytes from 192.168.10.5: icmp_seq=59 ttl=128 time=4720000.3 ms
64 bytes from 192.168.10.5: icmp_seq=60 ttl=128 time=4800000.2 ms
64 bytes from 192.168.10.5: icmp_seq=61 ttl=128 time=4880000.3 ms
64 bytes from 192.168.10.5: icmp_seq=62 ttl=128 time=4960000.2 ms
64 bytes from 192.168.10.5: icmp_seq=63 ttl=128 time=5040000.3 ms
64 bytes from 192.168.10.5: icmp_seq=64 ttl=128 time=5120000.3 ms
64 bytes from 192.168.10.5: icmp_seq=65 ttl=128 time=5200000.3 ms
64 bytes from 192.168.10.5: icmp_seq=66 ttl=128 time=5280000.2 ms
64 bytes from 192.168.10.5: icmp_seq=67 ttl=128 time=5360000.3 ms
64 bytes from 192.168.10.5: icmp_seq=68 ttl=128 time=5440000.3 ms
64 bytes from 192.168.10.5: icmp_seq=69 ttl=128 time=5520000.3 ms
64 bytes from 192.168.10.5: icmp_seq=70 ttl=128 time=5600000.3 ms
64 bytes from 192.168.10.5: icmp_seq=71 ttl=128 time=5680000.2 ms
64 bytes from 192.168.10.5: icmp_seq=72 ttl=128 time=5760000.3 ms
64 bytes from 192.168.10.5: icmp_seq=73 ttl=128 time=5840000.3 ms
64 bytes from 192.168.10.5: icmp_seq=74 ttl=128 time=5920000.3 ms
64 bytes from 192.168.10.5: icmp_seq=75 ttl=128 time=6000000.3 ms
64 bytes from 192.168.10.5: icmp_seq=76 ttl=128 time=6080000.3 ms
64 bytes from 192.168.10.5: icmp_seq=77 ttl=128 time=6160000.3 ms

--- 192.168.10.5 ping statistics ---
6328 packets transmitted, 79 packets received, 98% packet loss
round-trip min/avg/max = 0.8/3120000.3/6240000.3 ms

-----------------------------------------------------------------------------------------------------------------------------------------------------
PING 192.168.10.5 (192.168.10.5) from 192.168.10.60 : 56(84) bytes of data.
64 bytes from 192.168.10.5: icmp_seq=0 ttl=128 time=0.9 ms
64 bytes from 192.168.10.5: icmp_seq=1 ttl=128 time=80000.5 ms
64 bytes from 192.168.10.5: icmp_seq=2 ttl=128 time=160000.4 ms
64 bytes from 192.168.10.5: icmp_seq=3 ttl=128 time=240000.3 ms
64 bytes from 192.168.10.5: icmp_seq=4 ttl=128 time=320000.4 ms
64 bytes from 192.168.10.5: icmp_seq=5 ttl=128 time=400000.5 ms
64 bytes from 192.168.10.5: icmp_seq=6 ttl=128 time=480000.3 ms
64 bytes from 192.168.10.5: icmp_seq=7 ttl=128 time=560000.3 ms
64 bytes from 192.168.10.5: icmp_seq=8 ttl=128 time=640000.4 ms
64 bytes from 192.168.10.5: icmp_seq=9 ttl=128 time=720090.3 ms
64 bytes from 192.168.10.5: icmp_seq=10 ttl=128 time=800090.3 ms
64 bytes from 192.168.10.5: icmp_seq=11 ttl=128 time=880090.3 ms
64 bytes from 192.168.10.5: icmp_seq=12 ttl=128 time=960090.3 ms
64 bytes from 192.168.10.5: icmp_seq=13 ttl=128 time=1040090.3 ms
64 bytes from 192.168.10.5: icmp_seq=14 ttl=128 time=1120090.3 ms

--- 192.168.10.5 ping statistics ---
1239 packets transmitted, 16 packets received, 98% packet loss
round-trip min/avg/max = 0.9/600039.7/1200090.4 ms


No the interesting parts.

1. This only happens when I ping from the problem server to another server or workstation on our private network. If I ping anything else, it comes back fine.

2. If I ping either of these machines from any other computer on our private or public network the results are perfect.

3. I've tried using different NIC's and also different switches. I've taken down the firewall on both machines as well as verified there was nothing in hosts deny or allow that might be blocking traffic.

4. The problem was intermitent until a few days ago

5. On the mail server mail con still be retrieved fro, anywhere except the private side network. If you're on our private side network then you can still receive mail  but it takes about 3 minutes to make the connection, once the connection is made the mail comes through just fine, as if there was no packet loss what so ever.

6. The file server can no longer be connected too from a PC on the private side network. We're using samba on the file server. If you're using a mac on our private side network it can still connect just fine as if there was no packet loss what so ever.


OK so anyone ever seen anything like this before?

Aaron

Aaron M Daley
Free Speech TV
Systems Administrator
[EMAIL PROTECTED]
_______________________________________________ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list