Sniffer's "excessive retransmissions" Expert symptom is for TCP traffic (in
an IP environment.) So they probably weren't ARPs or broadcasts. I find the
story intriguing but confusing also. But it sounds like the AS/400 was
sending responses out the wrong port, so the client kept retransmitting. It
also sounds like the AS/400 does its own routing and its static routes were
hosed. Sure would make a good case study!?!
Priscilla
At 03:09 AM 5/2/01, EA Louie wrote:
>That is just the weirdest situation - maybe someone who knows the AS/400
>TCP/IP stack can shed some light on it.
>
>In my experience, the host will build a routing table dynamically, and also
>keep an ARP cache so that it knows how to direct packets to their correct
>destination interface. As far as I know, those features are default ON when
>a host interface is configured - in fact, it's a pain to turn them OFF if
>you need to. It's also interesting how we'll give an emotionless CPU an
>emotion (confused) when it doesn't do what we want/expect it to do. ;-)
>(We also give them gender - no flames, puh-leeze...)
>
>I would expect the "broadcasts" that were seen to be ARP requests (but you
>saw them as retransmissions? going out a different interface than where the
>packet was received?). I'd personally love to see a few of the Sniffer
>traces to see if I could help pinpoint the cause of the problem. One of the
>wonderful features of Sniffer Pro is the Expert Summary. Unfortunately, is
>has also caused some of us (like me) to get lazy and not dig into the actual
>traces to recreate the packet flow(s), preferring instead to accept the
>Expert Summary of the conditions.
>
>-e-
>
>----- Original Message -----
>From: Sites, Bob ;
>To: ;
>Sent: Tuesday, May 01, 2001 10:50 AM
>Subject: RE: Excessive Retransmissions UPDATE [7:2553]
>
>
> >
> > Our AS400 does have multiple NIC's. Two ether and two token. The biggest
> > problem we could see on our sniffer was that traffic from a workstation
> > would come into the AS400 on one interface, say token2, and instead of
>going
> > out token2 back to the workstation originating the traffic, it would go
>out
> > an ether port, or the opposite token port? It didn't appear to have any
> > rhyme or reason where it passed traffic without the static routes. This
>was
> > sending traffic everywhere. Throughout all our token rings and ether
> > networks. All the retransmit traffic we seen on the sniffer seemed to be
> > from workstations to the AS400. I know very little about the IBM world so
>if
> > you could enlighten me as to why the IBM box seemed to get confused, I
>would
> > love to pass it on to it's sysadmins? BobS
> >
> > -----Original Message-----
> > From: EA Louie
> > Sent: Tuesday, May 01, 2001 11:52 AM
> > To: Sites, Bob; [EMAIL PROTECTED]
> > Subject: Re: Excessive Retransmissions UPDATE [7:2553]
> >
> > thanks for sharing and updating us. Just a few questions if you'd
> > indulge me, otherwise have a great day.
> > I'm kind of curious and very clueless since I don't know your network
> > architecture, but if you have a default gateway set on the AS/400 and IP
> > routing protocol running in your routers (even if it's static routes),
>then
> > unless you're running multiple NICs with multiple paths to the outside,
>why
> > would you need so many static routes in the AS/400 IP stack? Why (for
> > example) would you not have all your IP routing handled the the router
> > level? I usually look at static routes on a host as a band-aid because I
> > didn't configure my network (read routers) properly - makes it hard for
me
> > to point my finger at the clueless sysadmins for eliminting routes that
>they
> > really
> > shouldn't need if I have a properly configured infrastructure.
> > And at the broadcast storm level, do you know why your routers were not
> > picking those up and routing them for the host? In other words, was ARP
> > working at the host and router level?
> >
> > ----- Original Message -----
> > From: "Sites, Bob"
> > To:
> > Sent: Monday, April 30, 2001 5:58 AM
> > Subject: Excessive Retransmissions UPDATE [7:2553]
> >
> > Just wanted to update the list on this matter because I feel that it
> > could very easily happen to anyone of you and it was very difficult to
> > locate the problem. Got to blame this one on Big Blue hardware. Yes, the
> > AS400 was the cause of all our problems here, once again. Apparently
>several
> > days prior to this problem, the AS400 was upgraded and a rollover
software
> > called Visions was added. This is similar in function to HSRP. A third
>party
> > software that allows rollover from one AS400 to another. Anyway, during
>the
> > setup for the rollover testing it was recommended that some static routes
>in
> > the AS400 be cleaned up and deleted. Way to go Visions! Our AS400 folks
> > didn't know any better and just deleted static routes down from about a
> > dozen to 4!!! Our
> > symptoms were major broadcast storms of retransmissions. Got to keep a
> > close eye on those big blue boys! Of course, as always, it was a
"network"
> > problem and the network team solved it!!! Is it at all possible that IBM
> > could come up with a more worthless IP stack?
> >
> > Bob Sites, CCNA
> > Winchester Medical Center
> >
> > Do you have a TACAC's, Syslog server, & or SNMP database server. Helps
> > you find the who, what, where, & when things started. Sometimes you
gotta
> > dig backwards when the obvious just won't present itself. My guess is
>that
> > you have a link down, a flapping interface, or had bounce on a link that
>the
> > protocol wasn't configured to handle.
> > Please keep us posted with your success or failures
> > Phil
> >
> > Perhaps someone could steer me on this problem that I've been fighting
> > for a day and half now. We are having a severe slowdown on our network
and
> > when looking at the IP traffic from just about anywhere to anywhere,
about
> > 1/3 of the packets are being retransmitted? Sniffer error is "excessive
> > retransmissions." Spent about 3 hours on the phone this morning with the
> > TAC and didn't really get anywhere. It appears that we are having a
> > broadcast storm of the retransmissions. Any insight into what direction
>to
> > head would be greatly appreciated. Would like to isolate the problem by
> > blades on the switches or routers, but being a hospital this is almost
> > impossible. We have 2 core 6509's with duplicate sups and msfc's. Main
> > router is a 7200.
> >
> > Bob Sites, CCNA
> > Winchester Medical Center
> >
> >
> >
> > Bob Sites
> > System Engineer
> > Valley Health System, IS Dept.
> > [EMAIL PROTECTED]
> > 540-536-4766
> >
> >
> > Confidentiality Notice:
> >
> > This e-mail message, including any attachments, is for the sole use of
the
> > intended recipients and may contain confidential and privileged
>information.
> > Any unauthorized review, use, disclosure or distribution is prohibited.
If
> > you are not the intended recipient, please contact the sender by reply
> > e-mail and destroy all copies of the original message.
> > FAQ, list archives, and subscription info:
>http://www.groupstudy.com/list/cisco.html
> > Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
>FAQ, list archives, and subscription info:
>http://www.groupstudy.com/list/cisco.html
>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
________________________
Priscilla Oppenheimer
http://www.priscilla.com
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=2916&t=2553
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
