Hi Darren, Thanks for the reply :)
First of all, what am I looking after I record the netstat and qif_status info?? When I say 'no incoming traffic' meaning I only see outgoing traffic on the outgoing interface when the problem happens. All two way traffic seems to halt, since there is nothing coming back. Traffic is not being transmitted by all boxes via the firewall outgoing interface. I am running snoop on the ipfilter firewall gateway. And I am snooping by interfaces and has no filter in place. Talking about network change problem. The tcp_fusion code change bite us hard on Netbackup :*(~ Thanks, -- Sum > > Hi, > > So this is an interesting problem...with lots of different variables. > > If you are able to, I would recommend recording lots of information > as the system marches along...so what's required here... > > record "netstat -s" every 30 or 60 seconds and maybe also > record "ndd /dev/pfil qif_status" > > You mention that "no incoming traffic" is seen. I don't quite > understand what you mean by this as it isn't precise enough. > Are packets not being transmitted by some box? > if so, which box? > on which box are you running the snoop when you observe this? > are you filtering what snoops sees or does it show all traffic? > > ideally there is some sort of statistic that ticks over only when > the problem happens and that'll help narrow down the problem. > > <rant> > With the rate of change (and quantity of change) going into the > Solaris TCP/IP stack (and knowing the current bugcount), I can > only say that the Solaris 10 TCP/IP stack feels like "beta code" > that doesn't get really well tested :-( Update 4 is going to change > TCP/IP code in a very significant way (IP Instances), so unless > you really have to, it might be worth avoiding Updates 4 and 5 > and go straight from 3 to 6 (there will be an Update 5 but it will > be not far behind U4).. or perhaps even 2 to 6, if 3 is causing > you problems where 2 wasnt'. > > I would recommend people download 125014-02 while you > can and keep it somewhere safe because 125014-03 (and others) > will not be able to be applied to anything prior to Update 4. > If you still have problems and have support contracts, ring up > Sun and hassle them and tell them you want a patch for that > release of Solaris10 (with Solaris's IPFilter) and dont want > to upgrade to update 4. > </rant> > > Darren >
