Network problem need help

This isn't really a linux problem, but I thought that some of the
admins on this group might be able to help me.
We have recently begun experiencing network problems, Communications
between computers appear to be failing at indiscriminate times.
Specifically to internal web servers and printers. Samba systems to
not appear to be effected. Printers you can basically stop and
restart(soft sometimes works but hard reboot sometimes required) and
you will get one print out of them, then they stop. We have tried 2
different print servers. The newest print server we tried couldn't
even establish a connection until we rebooted the system.

Internal web server appears to be working intermittently. Users report
that they have to shut down there browsers sometimes before they can
access the system again.

In one area they reported that they had to reboot all the computers
before they got access and then after 20 minutes the problem recurred.

All of this started yesterday and I have not been able to find
anything in the logs or seen any thing in packet captures that appear
out of the ordinary. (But there is the strong possibility that I
don't know what to look for) if anyone has any ideas, I'm all ears.

(E-Mail Removed) wrote:
> We have recently begun experiencing network problems, Communications
> between computers appear to be failing at indiscriminate times.
> Specifically to internal web servers and printers. Samba systems to
> not appear to be effected. Printers you can basically stop and
> restart(soft sometimes works but hard reboot sometimes required) and
> you will get one print out of them, then they stop. We have tried 2
> different print servers. The newest print server we tried couldn't
> even establish a connection until we rebooted the system.

So, what do these printers and web servers have in common? Are they
connected to the same switch or router, perhaps? And are the samba
servers on a different switch or behind a different router?

When a services becomes unavailable, can you reach the IP address of the
box at all? Does ping work? arp?

Start at the lower layers and work your way up.

On Aug 24, 9:25 am, KR <kristian.rasmus...@broadpark.no.spam.com>
wrote:
> phwashing...@comcast.net wrote:
> > We have recently begun experiencing network problems, Communications
> > between computers appear to be failing at indiscriminate times.
> > Specifically to internal web servers and printers. Samba systems to
> > not appear to be effected. Printers you can basically stop and
> > restart(soft sometimes works but hard reboot sometimes required) and
> > you will get one print out of them, then they stop. We have tried 2
> > different print servers. The newest print server we tried couldn't
> > even establish a connection until we rebooted the system.
>
> So, what do these printers and web servers have in common? Are they
> connected to the same switch or router, perhaps? And are the samba
> servers on a different switch or behind a different router?
>
> When a services becomes unavailable, can you reach the IP address of the
> box at all? Does ping work? arp?
>
> Start at the lower layers and work your way up.

Yes, you can ping the ip address of the internal web servers and the
printers and everything appears to work. Systems which are behind a
router appear to have fewer problems (They can print to printers that
no other system can).
Users in one area primarily use Internet Explorer( using the internal
web site). They appear to be having a worse time of it. I have no
clue why right now.

One computer was having a problem and I looked at it's DNS cache and I
didn't see our internal web server. After retrying a couple of times
I was able to get the web page and the entry was in the DNS cache
(This has not been repeated).

There are multiple switches in the building and am replacing and
isolating sections at a time. (What exactly should I see if a switch
is causing this problem?

On Aug 24, 11:02 am, "phwashing...@comcast.net"
<phwashing...@comcast.net> wrote:
> On Aug 24, 9:25 am, KR <kristian.rasmus...@broadpark.no.spam.com>
> wrote:
>
>
>
>
>
> > phwashing...@comcast.net wrote:
> > > We have recently begun experiencing network problems, Communications
> > > between computers appear to be failing at indiscriminate times.
> > > Specifically to internal web servers and printers. Samba systems to
> > > not appear to be effected. Printers you can basically stop and
> > > restart(soft sometimes works but hard reboot sometimes required) and
> > > you will get one print out of them, then they stop. We have tried 2
> > > different print servers. The newest print server we tried couldn't
> > > even establish a connection until we rebooted the system.
>
> > So, what do these printers and web servers have in common? Are they
> > connected to the same switch or router, perhaps? And are the samba
> > servers on a different switch or behind a different router?
>
> > When a services becomes unavailable, can you reach the IP address of the
> > box at all? Does ping work? arp?
>
> > Start at the lower layers and work your way up.
>
> Yes, you can ping the ip address of the internal web servers and the
> printers and everything appears to work. Systems which are behind a
> router appear to have fewer problems (They can print to printers that
> no other system can).
> Users in one area primarily use Internet Explorer( using the internal
> web site). They appear to be having a worse time of it. I have no
> clue why right now.
>
> One computer was having a problem and I looked at it's DNS cache and I
> didn't see our internal web server. After retrying a couple of times
> I was able to get the web page and the entry was in the DNS cache
> (This has not been repeated).
>
> There are multiple switches in the building and am replacing and
> isolating sections at a time. (What exactly should I see if a switch
> is causing this problem?- Hide quoted text -
>
> - Show quoted text -

This was found to be caused by arp poisoning. At this time we have
taken the system off line and will try to determine if it is infected
or defective.