Suspicious network behaviour

[zyke]

A couple of days ago my unRAID server started to behave strange.

First I could not access it through hostname nor IP-address, neither via gui or SSH/telnet.

I logged on to the console of the machine and it had an IP address set, the hostname was fine, everything was fine.. I checked the router and everything was fine there as well.

I did general network troubleshooting as reseating the cable, change cable, change port on the switch, etc.

Also did troubleshooting at the machine, changing the config, ifconfig ups and downs, /etc/rc.d/rc.inetd and inet1 restarts. Nothing worked.

Finally I rebooted the server after stopping all services and unmounting the disks. Then everything worked as it should.

The following day I experienced the exact same behaviour. This time I just restarted the machine. It worked for a while.

Now looking at the ifconfig I can see a significant amount of dropped packages. However It has only transferred 20Mb, but I saw a significant amount of dropped packages earlier as well, but didn't thought much of it.

 

So the question is, is this normal behaviour?

Should I invest in a new NIC, instead of using the one attached to the mother board?

 

Version of unRAID: 5.0-rc5

Hardware:

Mobo - Asus M5A78L-M LE

CPU - AMD Sempron 145 2,8GHz

RAM - Kingston ValueRAM DDR3 PC8500/1066MHz CL7 4GB

 

Settings for eth0:
Supported ports: [ TP MII ]
Supported link modes:   10baseT/Half 10baseT/Full
                        100baseT/Half 100baseT/Full
                        1000baseT/Half 1000baseT/Full
Supports auto-negotiation: Yes
Advertised link modes:  10baseT/Half 10baseT/Full
                        100baseT/Half 100baseT/Full
                        1000baseT/Half 1000baseT/Full
Advertised pause frame use: Symmetric Receive-only
Advertised auto-negotiation: Yes
Link partner advertised link modes:  10baseT/Half 10baseT/Full
                                     100baseT/Half 100baseT/Full
                                     1000baseT/Half 1000baseT/Full
Link partner advertised pause frame use: Symmetric Receive-only
Link partner advertised auto-negotiation: Yes
Speed: 1000Mb/s
Duplex: Full
Port: MII
PHYAD: 0
Transceiver: internal
Auto-negotiation: on
Supports Wake-on: pumbg
Wake-on: g
Current message level: 0x00000033 (51)
Link detected: yes

driver: r8169
version: 2.3LK-NAPI
firmware-version: N/A
bus-info: 0000:02:00.0

Module                  Size  Used by
md_mod                 45765  3
xor                    13949  1 md_mod
sg                     13023  0
asus_atk0110            6597  0
r8169                  30022  0
atiixp                  1792  0
k10temp                 1911  0
hwmon                    945  2 asus_atk0110,k10temp
ahci                   17441  4
libahci                13678  1 ahci

NIC statistics:
     tx_packets: 6802
     rx_packets: 112474
     tx_errors: 0
     rx_errors: 0
     rx_missed: 0
     align_errors: 0
     tx_single_collisions: 0
     tx_multi_collisions: 0
     unicast: 5067
     broadcast: 94174
     multicast: 13233
     tx_aborted: 0
     tx_underrun: 0

eth0      Link encap:Ethernet  HWaddr 54:04:a6:xx:zz:yy
          inet addr:10.0.10.22  Bcast:10.0.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:111911 errors:0 dropped:32055 overruns:0 frame:0
          TX packets:6667 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:21577471 (20.5 MiB)  TX bytes:1800384 (1.7 MiB)
          Interrupt:41 Base address:0xa000

[Frank1940]

Try rebooting both the switch and the router.  Try replacing all of the cat 5 cables between your computer and the server. 

 

These are things that I would try first.  It is best to begin by trying all of the cheap, simple, and quick items before jumping into those areas where it is not simple or cheap.

 

 

[zyke]

Thanks for the tips, but I don't think the router nor the switch is the issue.

Here's a netstat from a different machine sitting on the same switch.

It shows that no packets were dropped.

 

Name    Ipkts       Ierrs     Ibytes          Opkts        Oerrs     Obytes          Coll Drop
en0     263087024   -         139483937107    436095233    -         452422310635    -     -

 

The cable have already been replaced with a new cable.

I do have some network cards laying around at home so the cost wouldn't be that big.

I was more concerned about drivers and installation.

 

Cheers

[doorunrun]

Since you're running 5.0-rc5, my advice is to update to 5.0 final and go from there. I hope is this will be the "magic bullet" and your issue will be resolved.  Problems that just sort of show up can difficult to pin down especially when nothing seems to have changed; but you have to start somewhere.

 

Over the course of getting from rc5 to final there have been issues with RealTek NICs and I believe now most of the problems have been resolved. (fingers crossed!)

 

You've done a lot to provide information on your network troubleshooting, it can also be helpful to provide a full syslog.

[zyke]

Yeah, I an considering that, just haven't taken myself time to do that yet. But it's on my to-do list.

I'll keep my fingers crossed for the RT card fixes as well.

As of right now everything seems to be running smoothly though (Y)

 

Yeah, I would have attached the syslogs.. however, I had about 30Mb of syslogs, when the machine were rebooted.... they disappeared.. I don't know why, maybe the /var/log path is just virtual and not on the USB-memory!?

But when I checked the syslogs after that, it was only a couple of Kb. And they were not rotated.

[dgaschk]

Thanks for the tips, but I don't think the router nor the switch is the issue.

Here's a netstat from a different machine sitting on the same switch.

It shows that no packets were dropped.

 

Name    Ipkts       Ierrs     Ibytes          Opkts        Oerrs     Obytes          Coll Drop
en0     263087024   -         139483937107    436095233    -         452422310635    -     -

 

The cable have already been replaced with a new cable.

I do have some network cards laying around at home so the cost wouldn't be that big.

I was more concerned about drivers and installation.

 

Cheers

 

One router or switch port can be bad. Try using swapping ports and test.

[zyke]

Here's a clip from the syslog.

http://pastebin.com/NmeDsCdt

 

I came across exact the same problem again.

I was watching films on my XBMC through unRAID, everything worked fine.

When I woke up this morning I could not access the unRAID server...

[dgaschk]

Looks like a cable, host port, switch or switch port issue. There also seems to be an incompatible or misconfigured add-on causing crond to crash every hour. 

[zyke]

The cron.hourly script is called "smtp_status.sh" It seems to be some sort of status mailing script that mails the status of the unRAID-server every hour to a set email address. It's a part of unraid-unmenu, probably I havent set it up correctly.

[Traxxus]

I had network issues that cropped up out of nowhere as well, didn't do a whole lot of troubleshooting, just enough to rule out everything besides the server itself. After checking here I decided to just upgrade from the older RC I was using, and the problem went away, so far at least.