Network management experience: instantaneous off the net from the Crystal Head damage

Almost instantaneous time, all workstations in the local area network are almost synchronous off the network, data traffic immediately dropped to zero, the use of ping command to test the IP address of important network devices, without exception found that there are very serious data packet loss phenomenon. Before we trace the cause of the phenomenon, I would like to tell you a little bit about the network of the Unit LAN. The

Unit has a total of six weak rooms in the building. Distributed in each floor, the ordinary two-layer switch between the weak electricity is connected to the core switch in the main room through the broadband fiber line, and when the instantaneous disconnect fault occurs, the author happens to have a routine equipment check in one of the weak electricity. After receiving the trouble to call for help, the author immediately checked the normal two-level switch between the weak current working state, the result shows that the data signal lamp in the control panel of the device is blinking wildly, the instantaneous flow reaches eight plus, and its limit value is only 10 plus; When the author tries to unplug the broadband fiber interface from it, The corresponding signal light immediately stopped beating, its speed naturally also followed down. Later, the author attached to check a few other weak, found that these ordinary two-tier switch working status is almost the same.

Trace the cause of the failure

from the two-tier switch can not find clues, the author immediately rushed to the host room, ready to the core switch work status of the careful inspection. The author first remote login to telnet command to the core switch background management interface, check its peak speed, found that the parameters of all normal, also did not find broadcast data or large packet data attack Local intranet, for this I infer that the local intranet virus attack is not very likely.

Will it be the local intranet, some other computers or network devices to modify the IP address of the core switch as the IP address, resulting in the LAN IP address conflict phenomenon? In order to eliminate this possible factor, the author of the core switch in the background to modify its IP address, Then reboot the core switch system, and found that all the above symptoms are still.

Considering that ARP spoofing often occurs in the local area network, in order to test whether this phenomenon is an instantaneous phenomenon of "sin Huai", the author opened the installation in several server system ARP firewall, and let it continue to run about one hours, the result did not find ARP deception phenomenon; In order to check the MAC address of each work subnet, the author makes use of professional tools to scan several important optical ports of switch, which proves that there is no illegal address intrusion phenomenon in local area network.

Because the core switch supports dual master unit, the author intends to replace one of the main control unit to see, so cut off the core switch connection power, replace another main control unit, and then restart the switch system, at the beginning of the start, the author found that the network communication seems to restore the positiveOften, but not a long time the same fault phenomenon appears again, this shows that the instantaneous network failure and the main control unit of the switch. The

is here, the author of the core switch to do the inspection has been done, it is certain that the core switch itself does not exist any problems, local LAN also does not exist in the contract virus, ARP fraud has also been confirmed not exist, so that can be a problem where it seems only the communication line.

Troubleshoot symptoms

to find out exactly which communication line is out of order, the author first unplug all the fiber interfaces connected to the core switch device, leaving only a few server systems in the host room connected directly to the core switch, At this time the author uses ping command to carry out a large package test, found that ping command test operation of all normal, several server systems can also normal access to the network, which shows that the core switch working state is indeed normal.

Then, in turn, the author will each fiber interface correctly connected to the core switch, and each connection to a fiber interface, a large packet ping command test, when the test to connect to the four-floor light power between the interface, the author found that the phenomenon of failure again appeared, It seems that the whole LAN network phenomenon of instant off, is due to the problem caused by this place. Consult the optical fiber interface data, the author quickly found this line is connected to the four floors, dedicated to the use of foreign training of the Internet, the author of the track, I did not spend much time to find a connection to the fiber cable two-layer switch; First to observe the switch signal state, found that there is a problem, so with the help of professional cable testing tools , the connectivity of network circuit is tested, it is found that there is a short-circuit phenomenon in this circuit, it seems that this phenomenon is caused by the instantaneous network failure of the "sin Huai culprit."

After further investigation, the author finds that a common twisted-pair interface of the switch has a crystal head deformation phenomenon, which directly leads to a short circuit of the physical connection line, it seems that the crystal head has become worse than other network administrators usually plug improperly caused by the replacement of new Crystal Head, The symptom was immediately gone.

Here, the instantaneous removal of the phenomenon of the network has finally been resolved, but to summarize the above troubleshooting process, the author found himself guilty of an empirical error, encountered in the local area network failure phenomenon, always subconsciously think that there is network virus or other unsafe attacks in the local networks, Or that some of the important settings in the network have been modified, ignoring some of the physical factors, and in fact, some physical factors at ordinary times difficult to arouse the attention of our network administrators.