I run a small network of about 30 machines. All are DHCP with the IPs assigned by the server. I am behind a wireless router with a modem in front. 2 24 port switches handle the wired connections.
With that being said, I have a few machines, that lose network connectivity around the same time each day and I am baffled about it. Nothing seems to have changed on the network. This began happening when we had to reset our server due to a power outage but I cannot see where any configuration is wrong. I am willing to answer all questions because I am just at the end of my rope.
Not all machines are losing this network connection. I have seen some posts in the past, however, I dont think any of the issues similar to mine have been resolved.
Any help is greatly appreciated.
No bandwidth monitor in place,,, actually, it is at the end of the day when the least processors are on their machines.
That doesnt necessarily mean anything. You could have a server downloading, or updating some type of application during the day when it should be doing that at night.
Any errors in the server logs or workstation logs that are losing connectivity?
I had a similar problem recently and it turned out to be a bad switch.
Do you have managed switches that you can look at port statistics?
Do you have a spare switch you can install? It is just a quick and dirty troubleshooting measure.
Ok. I will try to answer all these. It appears that only 2 stations are affected but it is difficult to troubleshoot since they are the only active machines. One goes down about 5 and the other one goes down about 6. Very strange. There is only one server and there is nothing on the logs. Also, there is no activity, ie downloads, updates, etc , happening at that time. I do not have a port monitoring system. These are basic switches, super basic. It is consistently the same machines. I thought there ma be switch problems so i moved the connections to another port in another switch -same result. Would bandwidth make the machines go down at the same time,,,exactly 24 hours from the last episode ? Also, could there be any configuration i can change on the server to keep this from happening ? If i do change switches,,,,is it better to buy a 48 port or 2 24- port switches ?
First thing to try is check each of the system logs from the machines to see if there are any kind of errors occurring during that time frame.
Second thing, take those two machines and about 30 minutes before the time that they normally go offline, boot them into Safe Mode with Networking and see if it still occurs.
Make sure that you also have all your A/V completely up to date and run a full scan while the machine is in Safe Mode.
Wonder what the heck it could be ? Anything i could check to see ? I know i dont have anything scheduled to run.
Just because you dont know about it, doesn't mean it isnt running somewhere.
I had this happen on my LEMSS Server which hands out my patches, it was downloading updates during the day so it could push it to clients at night. I noticed that it was happening the same time every day.
Do you have spanning tree enabled and have you checked the switch logs? Might have someone playing funny buggers with the network and intentionally creating a loop. Long shot but happened to us quite a bit before my time as predecessor wouldn't enable spanning tree.
Maybe try checking the network cables, if its wired. make sure the cables are good.
check the drivers for the network cards, they could be buggy and causing issues.
another thing would be to see if you can by two or three new managed switches that would allow you to manage the ports and see if that allows you to view things better.
1 up for TNM
I always start by looking at packets with Wireshark, it's free but has a huge learning curve but even when I was a newbie there was some tell tale signs. For example the first time I used it I could see a DHCP request went out and two responses came back on that vlan. After investigating someone decided to bring a home router and use just the "switch" side of it so they could plug their personal notebook in as well at work so they could play games or something on their night shift. It told me the mac address that was dealing the DHCP and my switches arp tables could tell me what port that Mac address was plugged into so I found the culprit with that information within minutes.
The packets never lie and always tell you what is happening so it takes all your guesswork away, the trick is learning how to use the tool.
if it happens at a common time my guess is it is someone doing something when they start or end a shift or it is an automated process slowing things down. However, I wouldn't eliminate the possibility of a dying switch or network card but again the packet sniffer will tell you what is happening to help you seriously narrow it down.
Users who spiced this post
It's FREE. Always will be.