This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What could cause multiple ephemeral ports open to SYN back to a switch ?

0

Situation: I have two identical Netgear GS748Tv3 switches in the same location connected to each other through one port. As of three days both stopped allowing management though the HTTP interface. After pulling the power and restarting I have access to the HTTP interface. One of the switches is behaving slugglishly at responding to HTTP to manage it through its interface. This has been occuring to three additional switches of the same type in our domain within the last month. I know it is possible for switches to go bad, and capcitors to fail, but for all five to go bad within a month of each other and three within a week seems unlikely.

So I began a capture of what was occuring from my management station to the switch and of the backbone traffic to the switches. The only thing that seems to be out of the ordinary on the one sluggish switch is that when I open the HTTP management page it is opening additional ephemeral ports in sequence to send SYN messages and getting no response before finally cycling back to the orginal ephemeral port that began opening the page and finally sending an ACK message. This has been checked from multiple PCs.

Questions: Has anyone experience this before? If they have what is/was the common cause? Could this be an electrical issue causing a bit shift? Or could there be something else at play like HTTP pipelining gone arry or TCP SYN attack? or are we most likely experiencing devices failing around the same time?

asked 17 Apr '14, 11:51

cptamericajd's gravatar image

cptamericajd
26115
accept rate: 0%

edited 17 Apr '14, 12:04

Anyone know if there is CLI for these switches that can be accessed to poke around for issues? I found nothing in the manual.

(30 Apr '14, 19:45) cptamericajd

One Answer:

1

Could this be an electrical issue causing a bit shift?

rather unlikely on all 5 switches, as you mentioned yourself in the capacitor example.

or are we most likely experiencing devices failing around the same time?

a fimware bug. Did you try to upgrade?

Regards
Kurt

answered 19 Apr '14, 14:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thanks Kurt, I agree the bit shift was unlikely. Firmware already has been at latest version for about a year with no problems. We have reset all settings back to default on two of our switches at a primary site to see if they go down again, not like this determines what is wrong, but maybe a feature that was set was buggy. So far so good. If it occurs again we are planing to reflash the firmware. Luckily we have an order for some enterprise switches on the way as a replacement, but I am still bothered that there may be something on the network causing the failure.

(30 Apr '14, 19:45) cptamericajd

but I am still bothered that there may be something on the network causing the failure.

did you consider (or check) an IP address conflict? Again: Unlikely on 5 different switches, but you'll never know...

(01 May '14, 16:21) Kurt Knochner ♦