Router problems with linksys switch

[Sophism]

  sc302 said:

from that picture i would look at x.200. I would recommend getting a $10 hub and put it in between. it seems that you are getting a lot of data to that modem in a short amount of time, overloading it.

save a log, zip it, post it and lets see what we can help with.

Just a note, this capture will include all traffic including ANY unencrypted passwords etc that your machine sends/receives. (unless you filter this out)

Edited June 9, 2009 by Sophism

[AOXOMOXOA]

LOL yes ip 200 is my machine and the bittorrent traffic is mine. it is all legal. anyways i shut it down.

[+BudMan MVC]

Ok seems neowin is having a few issues -- taking forever for threads to come up, etc.. So I have not read in detail all of the posts since my last one, etc.

Lets cover a few things. "Normally" on a switch, be it un-managed (dumb) or a managed (smart) switch running wireshark or any other sniffer on your machine - you should ONLY see traffic to and from your machine and broadcast type traffic and sure multicast, etc.

So if as mentioned if you wanted to view all the traffic from your network to the gateway (router) you would need to put a hub in between the switch and the router - and then connect your box running your sniffer to the hub.. Now you will see all traffic moving between all users on the switch and the router. Or on a managed switch as I mentioned before you could setup a monitor/span port -- this can be set to have multiple ports send copies of the traffic they are seeing to this monitor port - so your sniffer can see all the traffic.

Only when a switch has failed open will you see traffic destined for other machines on the port your box is connected too. Yes there are ways of forcing this, flood its arp table, etc. But that is way beyond the scope of this thread. But yes a switch normally will prevent someone from sniffing your traffic, etc.

If wireshark ran into a memory issue -- either your box is a real piece of crap ;) Or you got some major traffic on your network?? I didn't see from that limited screen shot any IPs on your network other 192.168.1.200 -- I would assume this was your machines IP, and so your switch is doing what its suppose to be doing.. Only sending traffic to the port the traffic is destined for, etc. To see all the traffic you need to put in a hub like suggested or setup a span/monitor port -- to copy the traffic being seen on the port connect to your router to the port you connect your sniffer too.

So your running bit torrent on the machine?? And ftp at the same time your trying to sniff traffic for an issue? I would shutdown everything your machine might be doing on the network before trying to sniff, ie ftp, p2p, etc.

Also -- if p2p is open on your network, yeah that could really bring that router to its knees very very quickly and would explain why its having memory issues. Multiple users running p2p all at the same time is going to cause issues on even a real router. From the data sheet on that router it does not list how much memory it has, etc. But sure looks like a simple little soho router to me, even though they might call it a BIZ model.. Can it really handle the traffic 20 to 30 uses can create? I would guess its maybe 32 or 64MB tops.. With the number of connections even 1 user running p2p can create you can have problems with the soho routers. Multiply that by a few users and yeah your going to have problems.

The problem is the router is hanging on to all the connections.. The default on a tcp connection can be days if not terminated correctly, etc. So yeah they can run out of memory really really quickly when p2p is running. What you can do is turn this down - for example 3rd party firmware has put in adjustments to lower the amount of time the router will hang on to the connection info, etc.

Which is why lots of soho routers off the shelf have issues with torrents.

Example here is the settings on dd-wrt

I also notice some IPX traffic -- yeah thats going to flood out all ports, unless you configure it on your managed switch ;) I would suggest you turn off anything running IPX unless you have some NEED for it? Which most likely is a NO ;)

I would be happy to look over a capture for you -- just post it up, but setup it so your seeing all the traffic going to the router. But just from that small screen shot -- if you have torrent traffic, that is more than likely your problem!! If you want to run that - your most likely going to need to get a "real" router ;) Can be done on a shoestring budget with some old pc hardware and router distro like pfsense or ipcop, smoothwall, m0n0wall, etc. etc.

Or get a router designed for the number of users you have, and the kind of traffic your going to be doing. But p2p can be a killer for sure!! I would suggest you prevent that - and your router will most likely be able to handle normal surfing, email, etc.

[AOXOMOXOA]

The hub idea i will do in the morning. as far as ipx traffic goes. that is a network protocol on my machine. should i remove it? is that what you are saying?

no one on the network runs any P2P programs. i run FTP and bittorrent at times but this problem happens if they are running or not running.

i have looked around the net for related problems to this SMC POS router and a ton of people have the same issues. and they have tried a bunch of stuff i would never even think of to resolve the issues without any success.

but i will keep playing around with it. it gives me something to do at work.

as far as getting a router that will handle the traffic goes. Comcast tells me that this is the only choice for business internet that they supply. i would love to get a regular cable modem and a stand alone router.

but that's not in the cards.

oh well. I'm off of work in 10 minutes. so i will continue this adventure in the morning.

[sc302 Veteran]

turn off all ipx/spx traffic on all computers, uninstall that protocol. your best bet is to sniff traffic and see wtf is going on on your network.

[agreenbhm]

I don't know why people are saying that switches will allow you to see all traffic... Basically, that's the difference between a hub and a switch, if you want to look at it in those terms. A hub will give you access to all traffic; a switch is only traffic meant for you.

It is definitely the router. Since you're in a business environment and cannot control what's going on with all of the workstations, you'll need to upgrade to a higher quality router. Screw what Comcast says. I had a problem with my home internet not too long ago (I have Time Warner) and they tried to convince me that the problem was with my router and not with their modem. I had the guy replace the modem anyway, and what do you know? Problem solved! (I should know what I'm doing, I'm a Sys Admin).

It seems like these ISPs will do whatever they can to convince you it's not their problem. From just googling the model # of the router, it looks like a $20 POS. Of course that's what the ISP provides... I would research and purchase a quality router/modem to replace it with and stop messing with Comcast because "you don't get no satisfaction" with them.

[Sophism]

  agreenbhm said:

I don't know why people are saying that switches will allow you to see all traffic... Basically, that's the difference between a hub and a switch, if you want to look at it in those terms. A hub will give you access to all traffic; a switch is only traffic meant for you.

It is definitely the router. Since you're in a business environment and cannot control what's going on with all of the workstations, you'll need to upgrade to a higher quality router. Screw what Comcast says. I had a problem with my home internet not too long ago (I have Time Warner) and they tried to convince me that the problem was with my router and not with their modem. I had the guy replace the modem anyway, and what do you know? Problem solved! (I should know what I'm doing, I'm a Sys Admin).

It seems like these ISPs will do whatever they can to convince you it's not their problem. From just googling the model # of the router, it looks like a $20 POS. Of course that's what the ISP provides... I would research and purchase a quality router/modem to replace it with and stop messing with Comcast because "you don't get no satisfaction" with them.

Only one person said that and thats been cleared up now, A switch can do it to if a switchport is configured in monitor mode or it has failed open. (arp flooding, and a few other methods)

I agree with the router assessment though, its a POS and I dont see why you cannot get a Modem and your own router. You can get a decent Small Business router from cisco. We can better advise you on a new router with some more information about your work, number of users, types of traffic, future expansion etc.

Edited June 10, 2009 by Sophism

[agreenbhm]

  Sophism said:

Only one person said that and thats been cleared up now, A switch can do it to if a switchport is configured in monitor mode or it has failed open. (arp flooding, and a few other methods)

I know you can configure a managed switch for that, but I was referring to his (managed) switch, as it currently is. I assumed he probably isn't too keen on configuring it if it hasn't been touched thus far.

I didn't realize it was only one guy arguing about the switch capability to forward all traffic. He seemed pretty persistent, standing his ground.

[sc302 Veteran]

I never said anything about the switch capablitiy to forward all traffic, I just said it could be done without. and as stated it can, more easily than you think

Edited June 10, 2009 by sc302

[AOXOMOXOA]

some interesting screen shots. i turned off ipx on my computer. is there a way to save a log file of this readout? i can save a txt file of the log but it is very lodge.

any thoughts on these images??

[Trivious]

The only issue I saw from your most recent screen shot was that there is a bad network name between .200 and .61

Check that the computer or device names match up with what is in DNS. I find it a good idea to check logs on routers and switches for strange activity. This is very important. If you got smurfed or BFd, then your router or switch may choose to temporarily lock up to prevent that attacks too

[AOXOMOXOA]

  Trivious said:

The only issue I saw from your most recent screen shot was that there is a bad network name between .200 and .61

Check that the computer or device names match up with what is in DNS. I find it a good idea to check logs on routers and switches for strange activity. This is very important. If you got smurfed or BFd, then your router or switch may choose to temporarily lock up to prevent that attacks too

yah i saw that. i dont even know what .61 is. .200 is my computer.

i guess i can go around and look for ir but that would suck. and what if i find it? just make sure the dns is correct?

[+BudMan MVC]

Well you still have IPX traffic showing up.. Unless you are USING IT?? Then there is no reason to run that protocol on any machine or device (printer) etc.

[AOXOMOXOA]

well i did not reboot my computer after i uninstalled the protocol. it did not ask me to.

and other machines may be running it in the building. our big network printers are contracted by minolta and i am not going to mess with there protocols.

[AOXOMOXOA]

After looking around on the internet with the help of google. the smc8014 is a POS. most people that have them it would seem are having problems, I don't know why Comcrap would continue using them.

[+BudMan MVC]

Because its cheap for them ;) And prob works fine for very small soho.. Say 2 or 5 users that do some minor surfing, etc.

As to the IPX on printers, if they have an IP address, and the other machines are all using TCP/IP -- then you have no need for it on your network.. And its going to continue to broadcast all the time, etc. Its pretty easy to tell how your users are connecting to the printers ;) Are they using IPX or TCP/IP? ;) If using TCP/IP -- then there is no need for IPX to be enabled on the printers, etc.

Its RARE that you would find anywhere still using IPX -- RARE!!!!!

its not that big a deal, but any decent admin would want their network to be clean of crap like that, etc.

[sc302 Veteran]

in wireshark, click on statistics, conversations, ipv4 and see which comps are chattering the most to the router. scan for a couple of minutes and lets see what you get, then you can narrow it down that way to 1 or 2 pcs and see what kind of traffic that is being pushed out by those machines.

Edited June 10, 2009 by sc302

[Trivious]

You shouldn't have to go find the .61 necessarily. I would just check the DNS first. After that, if there are no duplicate records and the .200 is correct in DNS by name and ip, run an nslookup on .61 to get the name of it. Match that against the DNS record. If it matches, then check the lmhost files on both to make sure there are no rogue entries in them that would take precedence over your DNS server.

[+BudMan MVC]

He needs to hook up wireshark to the hub between his router and switch or setup a span or monitor port for wireshark to show him the top talkers.. So far the stuff he has posted up is only his machine talking and broadcast traffic.

He can also just look on the switch -- its a managed switch for the traffic per port, etc. If he is looking for the top talkers.

[AOXOMOXOA]

  BudMan said:

He needs to hook up wireshark to the hub between his router and switch or setup a span or monitor port for wireshark to show him the top talkers.. So far the stuff he has posted up is only his machine talking and broadcast traffic.

He can also just look on the switch -- its a managed switch for the traffic per port, etc. If he is looking for the top talkers.

cool, tell me how to look at that through the switch. that would rock..

anyways i have made some changes and so fa it is working but we will see for just how long.

i went through the smc router and turned pretty much everything off. the only thing it is doing is doing port forwarding and url blocking. i then have it going through a Linksys Router, and then in to the switch.

what the hell right? i just wanted to see how it would work.

[AOXOMOXOA]

well no... that didn't work..

same issue, i am locked out of the smc router untill i reboot it. but of course i can log into the linksys no problem..

but i am downloading about 10 gig through an ftp site. work related.. we build airplane parts.

[AOXOMOXOA]

so i just got off the phone with Comcrap.

they are coming out here today to get rid of this SMC8014 POS and replace it with a Netgear.

we will see how that goes. and if all else fails i will have to go out and buy us a IP Gateway of some sort.

if i have to buy hardware, what should i get? does anybody know of a kickass IP gateway for comcast internet?

[gloryforixseal]

It is remarkable, the valuable information

[+BudMan MVC]

"i then have it going through a Linksys Router"

:blink: What did you think that was going to do?? So you double natted, or did you setup actual routing?

As to how to setup a mirror port in your switch. Did you think to RTFM?? ;)

http://www.cisco.com/en/US/docs/switches/l...10_UG_A-Web.pdf