Hey Mark, First thing to do is use filters. Personally I use NAI's Sniffer Pro, which quickly allows you to select a session based on IP addresses and/or protocol. Ethereal should have this functionality as well.
First create a filter based on the server's IP address, and look for any broadcast-traffic. This should quickly let you determine wether it's keepalives are send as broadcast or unicast. If you can't find any broadcast keep-alives (i.e. this is not the problem), enhance your filter to show you one specific session. Check the entire packetflow step-by-step and determine the set-up of the connection, data transfer and finally the termination of the connection. This should give you a better idea of what's going on. I'd recommend taking traces on both sides of the connection (so both server and client side) and compare them. Personally I don't think broadcast keep-alives are the problem, since keep-alives imply terminating a connection after a certain amount of missed keep-alives. And you already stated your server does not terminate the session. Anyway, hope this helps. Rgds, Crestion Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=44814&t=44793 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
