Hi, So this is an interesting problem...with lots of different variables.
If you are able to, I would recommend recording lots of information as the system marches along...so what's required here... record "netstat -s" every 30 or 60 seconds and maybe also record "ndd /dev/pfil qif_status" You mention that "no incoming traffic" is seen. I don't quite understand what you mean by this as it isn't precise enough. Are packets not being transmitted by some box? if so, which box? on which box are you running the snoop when you observe this? are you filtering what snoops sees or does it show all traffic? ideally there is some sort of statistic that ticks over only when the problem happens and that'll help narrow down the problem. <rant> With the rate of change (and quantity of change) going into the Solaris TCP/IP stack (and knowing the current bugcount), I can only say that the Solaris 10 TCP/IP stack feels like "beta code" that doesn't get really well tested :-( Update 4 is going to change TCP/IP code in a very significant way (IP Instances), so unless you really have to, it might be worth avoiding Updates 4 and 5 and go straight from 3 to 6 (there will be an Update 5 but it will be not far behind U4).. or perhaps even 2 to 6, if 3 is causing you problems where 2 wasnt'. I would recommend people download 125014-02 while you can and keep it somewhere safe because 125014-03 (and others) will not be able to be applied to anything prior to Update 4. If you still have problems and have support contracts, ring up Sun and hassle them and tell them you want a patch for that release of Solaris10 (with Solaris's IPFilter) and dont want to upgrade to update 4. </rant> Darren
