Nic loses connection everyday , same time.
Results 1 to 7 of 7

Thread: Nic loses connection everyday , same time.

  1. #1
    Only african to own a PC! Cider's Avatar
    Join Date
    Jun 2003
    Location
    Israel
    Posts
    1,683

    Nic loses connection everyday , same time.

    Hi guys.

    W2k 2003 server x 2.

    At around the same time everyday it loses connectivity for the same period of time at the exact same time everyday.

    For example, it will lose connection from 10.00 am to 10.15 am everyday without a doubt. I was called in to check the status of the server as we are the av provider.

    I cannot find anything malicious on the network but what i can see is extremely bad admin and maintenance on there. No policies, no wsus, no audits, no restrictions etc etc.

    Any idea what can cause this? Any app on the network? Hardware issue?

    Any thoughts appreciated.
    The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
    Albert Einstein

  2. #2
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,192
    Hi Cider,

    Is it the server that is having the problem, or the clients, and is it wired, wireless or both?

    At this point, and from a range of 4,600 miles I will go for EMP, EMF, RFI That's electro-magnetic pulses, fields and radio frequency interference.

    Basically, it sounds like someone is turning something on at that time that the NIC doesn't like. This is creating some sort of interference or just "dirtying" the power supply.

    Now, it could be that the NIC card is on the way out and that has made it hypersensitive, or some other bit of nearby electrical equipment that is dying and spewing out interference in the process. Given the precision of the timing there is definately a trigger mechanism?

    I guess the first question is: "what happens between 10.00 and 10.15"........... a tea break perhaps?

    Does the server have a dedicated, clean power supply, or does it share with other devices?

    Depending on the setup, the device having the problem might be a hub, switch or router rather than the NIC.
    Last edited by nihil; January 16th, 2012 at 09:31 AM.
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  3. #3
    Only african to own a PC! Cider's Avatar
    Join Date
    Jun 2003
    Location
    Israel
    Posts
    1,683
    Hi Nihil,

    Thanks for the reply I am also pretty sure its not av related as the client is pointing too.

    To answer your questions.

    1. Server issue - wired.
    2. Dedicated power supply

    I'm not sure what goes at at those times but the server is sitting in a rack in a dedicated server room so by someone turning on the kettle or microwave is a somewhat longshot.

    What I can do is ask the guy there to change the port on the switch to an unused one.

    I was going for a failing NIC but the timing is so odd.

    During a ping -t while this is happening it will resolve maybe 1 out of 4 times.

    Ill try get some more insight.
    The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
    Albert Einstein

  4. #4
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,192
    Hi Cider,

    I am almost certain that this is an electro-mechanical problem as opposed to software.

    I would say that the NIC card is on the way out and something is triggering this behaviour. Sure replacing the NIC will cure the symptoms but the problem (the trigger) will still be there lurking in the background

    Cat5/6 connections and a clean power supply? yeah I have seen that before

    #1 The clean power supply to the computer room ran up a wall 2 inches away from a three phase HT supply going into E6 machine shop. At 16:30hrs every Friday they would power down the banks of automatics to clean them................ that produced an EMP that the AS/400 didn't like at all

    #2 Brother-in-law's pig farm. The mainframe that operated the care systems and food mill was controlled by an app called "The Big Dutchman" that ran on 2 PCs in a control room about 30 feet away. The Cat5 cables were running on top of an HT cable that fed the milling machines. Whenever they started up the EMP killed the PCs.

    #3 Insurance Clerk's dumb terminal wouldn't work; neither did two replacements............... I turned off her desk fan and everything worked normally. The motor was dying and generating an EMF.

    So, your customer needs to check all computer cables (Cat5 and power) and see they are not in proximity to other cabling and electrical devices.

    They need to think about what happens at that time of day. Does someone turn on some neon lights somewhere? does someone test an alarm system? does the time recording system report in?

    I have seen "clean" power supplies and have absolute faith in industrial electricians Get them to check that there is absolutely nothing else attached to it. And "there shouldn't be" just isn't good enough.............. physically check it.

    Also check the server logs for ANY messages (including information) at or just before 10:00, there might be a clue there?

    I suppose there is the off chance that some software updates itself at that time, but I feel that is a bit of a long shot............... worth asking the question though?

    EDIT:

    Whilst you are looking at that, you might as well ask if there are any jobs scheduled for that time of day, and if the problem also happens at the weekend?
    Last edited by nihil; January 16th, 2012 at 01:55 PM.
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  5. #5
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    Yes, look at Scheduled Tasks.......
    "It is a shame that stupidity is not painful" - Anton LaVey

  6. #6
    Senior Member
    Join Date
    Mar 2008
    Posts
    262
    da di da dah ... da di da dah
    We have control.

    FWIW the usual culprit is RFI that can infect power and signal lines between the filtered power and the box. BTDT

  7. #7
    Senior Member Zorolord's Avatar
    Join Date
    Sep 2001
    Posts
    107
    ua549 did you sort this issue, I had exactly the same issue on a XP Client.

    It was down to the half of the DHCP lease it was only set to a day, we increased to 5 days and problem solved

Similar Threads

  1. Windows Error Messages
    By cheyenne1212 in forum Miscellaneous Security Discussions
    Replies: 7
    Last Post: February 1st, 2012, 01:51 PM
  2. Autopsy of a successful intrusion
    By gore in forum Miscellaneous Security Discussions
    Replies: 11
    Last Post: June 13th, 2006, 04:06 AM
  3. Strange UDP(137) connection attempts
    By KissCool in forum Newbie Security Questions
    Replies: 10
    Last Post: December 23rd, 2002, 09:29 PM
  4. IP Spoofing?
    By mdzw in forum Miscellaneous Security Discussions
    Replies: 9
    Last Post: April 5th, 2002, 06:53 AM
  5. The Worlds Longest Thread!
    By Noble Hamlet in forum AntiOnline's General Chit Chat
    Replies: 1100
    Last Post: March 17th, 2002, 08:38 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides