Hey there, I am rather new to Wireshark and we are currently experiencing a problem where one of our HP Pro Curve 48 port switches is showing all solid lights. We have a rather large network over a small city and I'm having to find myself power cycle a firewall in order to have full connectivity for only 3-4 hours until the problem persists. The funny part is when we go to run a capture while the switch is solid lights, I get a huge blast of [TCP Port numbers reused] packet errors to a point where Wireshark barely has time to keep up. I had the capture running for about 3-4 seconds and got 800,000 packets of this nature. Can anyone help me out to lead me in the right direction to fixing this? asked 18 Oct '13, 05:04  Ineedamedic edited 18 Oct '13, 05:06 |
2 Answers:
I don't think that the reused TCP ports are your problem, it's probably a result of a much bigger issue. The scenario you describe sounds more like a layer 2 loop, where packets get duplicated while circling the net. Can you post a reasonable big sample capture on Cloudshark (if not containing sensitive data)? If you can't post a capture maybe you can do a screen shot of a section that contains these reused port numbers? answered 18 Oct '13, 06:55  Jasper ♦♦ |
Sounds like a routing loop to me.
O.K. if it is a routing loop, it could be like this: Firewall: host or subnet route for that 'dead' IP address (or subnet) to internal router R1 The whole packet looping will start as soon as the first system tries to access the 'dead' IP address.
Please check if the IP TTL of those packets gets decreased constantly. If so, there is a route loop and then you need to check the routes on all involved systems. Start with the Firewall and work yourself further into the network. Regards answered 18 Oct '13, 09:57  Kurt Knochner ♦ |
Unfortunately I can't post much. I'm seeing a certain subnet of our network hitting one particular IP address as the destination and this does not change. The interesting thing is that the IP Address is "as we know" turned off so it shouldn't be broadcasting anything at all. Essentially I have connectivity for all my users, they are just sending back high ping times... So I'm not totally disconnected from my network. I don't know if that helps or not.