That is just the weirdest situation - maybe someone who knows the AS/400
TCP/IP stack can shed some light on it.
In my experience, the host will build a routing table dynamically, and also
keep an ARP cache so that it knows how to direct packets to their correct
destination interface. As far as I know, those features are default ON when
a host interface is configured - in fact, it's a pain to turn them OFF if
you need to. It's also interesting how we'll give an emotionless CPU an
emotion (confused) when it doesn't do what we want/expect it to do. ;-)
(We also give them gender - no flames, puh-leeze...)
I would expect the "broadcasts" that were seen to be ARP requests (but you
saw them as retransmissions? going out a different interface than where the
packet was received?). I'd personally love to see a few of the Sniffer
traces to see if I could help pinpoint the cause of the problem. One of the
wonderful features of Sniffer Pro is the Expert Summary. Unfortunately, is
has also caused some of us (like me) to get lazy and not dig into the actual
traces to recreate the packet flow(s), preferring instead to accept the
Expert Summary of the conditions.
-e-
----- Original Message -----
From: Sites, Bob ;
To: ;
Sent: Tuesday, May 01, 2001 10:50 AM
Subject: RE: Excessive Retransmissions UPDATE [7:2553]
>
> Our AS400 does have multiple NIC's. Two ether and two token. The biggest
> problem we could see on our sniffer was that traffic from a workstation
> would come into the AS400 on one interface, say token2, and instead of
going
> out token2 back to the workstation originating the traffic, it would go
out
> an ether port, or the opposite token port? It didn't appear to have any
> rhyme or reason where it passed traffic without the static routes. This
was
> sending traffic everywhere. Throughout all our token rings and ether
> networks. All the retransmit traffic we seen on the sniffer seemed to be
> from workstations to the AS400. I know very little about the IBM world so
if
> you could enlighten me as to why the IBM box seemed to get confused, I
would
> love to pass it on to it's sysadmins? BobS
>
> -----Original Message-----
> From: EA Louie
> Sent: Tuesday, May 01, 2001 11:52 AM
> To: Sites, Bob; [EMAIL PROTECTED]
> Subject: Re: Excessive Retransmissions UPDATE [7:2553]
>
> thanks for sharing and updating us. Just a few questions if you'd
> indulge me, otherwise have a great day.
> I'm kind of curious and very clueless since I don't know your network
> architecture, but if you have a default gateway set on the AS/400 and IP
> routing protocol running in your routers (even if it's static routes),
then
> unless you're running multiple NICs with multiple paths to the outside,
why
> would you need so many static routes in the AS/400 IP stack? Why (for
> example) would you not have all your IP routing handled the the router
> level? I usually look at static routes on a host as a band-aid because I
> didn't configure my network (read routers) properly - makes it hard for me
> to point my finger at the clueless sysadmins for eliminting routes that
they
> really
> shouldn't need if I have a properly configured infrastructure.
> And at the broadcast storm level, do you know why your routers were not
> picking those up and routing them for the host? In other words, was ARP
> working at the host and router level?
>
> ----- Original Message -----
> From: "Sites, Bob"
> To:
> Sent: Monday, April 30, 2001 5:58 AM
> Subject: Excessive Retransmissions UPDATE [7:2553]
>
> Just wanted to update the list on this matter because I feel that it
> could very easily happen to anyone of you and it was very difficult to
> locate the problem. Got to blame this one on Big Blue hardware. Yes, the
> AS400 was the cause of all our problems here, once again. Apparently
several
> days prior to this problem, the AS400 was upgraded and a rollover software
> called Visions was added. This is similar in function to HSRP. A third
party
> software that allows rollover from one AS400 to another. Anyway, during
the
> setup for the rollover testing it was recommended that some static routes
in
> the AS400 be cleaned up and deleted. Way to go Visions! Our AS400 folks
> didn't know any better and just deleted static routes down from about a
> dozen to 4!!! Our
> symptoms were major broadcast storms of retransmissions. Got to keep a
> close eye on those big blue boys! Of course, as always, it was a "network"
> problem and the network team solved it!!! Is it at all possible that IBM
> could come up with a more worthless IP stack?
>
> Bob Sites, CCNA
> Winchester Medical Center
>
> Do you have a TACAC's, Syslog server, & or SNMP database server. Helps
> you find the who, what, where, & when things started. Sometimes you gotta
> dig backwards when the obvious just won't present itself. My guess is
that
> you have a link down, a flapping interface, or had bounce on a link that
the
> protocol wasn't configured to handle.
> Please keep us posted with your success or failures
> Phil
>
> Perhaps someone could steer me on this problem that I've been fighting
> for a day and half now. We are having a severe slowdown on our network and
> when looking at the IP traffic from just about anywhere to anywhere, about
> 1/3 of the packets are being retransmitted? Sniffer error is "excessive
> retransmissions." Spent about 3 hours on the phone this morning with the
> TAC and didn't really get anywhere. It appears that we are having a
> broadcast storm of the retransmissions. Any insight into what direction
to
> head would be greatly appreciated. Would like to isolate the problem by
> blades on the switches or routers, but being a hospital this is almost
> impossible. We have 2 core 6509's with duplicate sups and msfc's. Main
> router is a 7200.
>
> Bob Sites, CCNA
> Winchester Medical Center
>
>
>
> Bob Sites
> System Engineer
> Valley Health System, IS Dept.
> [EMAIL PROTECTED]
> 540-536-4766
>
>
> Confidentiality Notice:
>
> This e-mail message, including any attachments, is for the sole use of the
> intended recipients and may contain confidential and privileged
information.
> Any unauthorized review, use, disclosure or distribution is prohibited. If
> you are not the intended recipient, please contact the sender by reply
> e-mail and destroy all copies of the original message.
> FAQ, list archives, and subscription info:
http://www.groupstudy.com/list/cisco.html
> Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=2859&t=2553
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
