topic Re: Procurve Switch Hanging in Switches, Hubs, and Modems

Procurve Switch Hanging

CHAD RENDELL — Sun, 31 Oct 2004 18:50:39 GMT

I have a Procurve 4000 Switch fully populated. For some reason all the lights were solid green both link and activity. After about 10 minutes the switch just fixed it self. What would cause this.

Thanks for the help

Re: Procurve Switch Hanging

CHAD RENDELL — Sun, 31 Oct 2004 18:55:26 GMT

Sorry some other information.
The switch is in a closed LAN and no outside links ie internet. It is brand new out of the box and has only been used for the past week with no issues unitl today.

Seems to be working fine and all the servers and workstations seem to be ok aswell. One of our admins were trying to view a SQL document at time it hung.

Re: Procurve Switch Hanging

Jorge Rodriquez — Sun, 31 Oct 2004 23:02:17 GMT

Sounds like a cabling issue.

Re: Procurve Switch Hanging

CHAD RENDELL — Mon, 01 Nov 2004 07:53:36 GMT

Well eveything was working fine then all of a sudden the switch hung. If it was a cabling issue then I would think it would have been apparent right away

Re: Procurve Switch Hanging

Les Ligetfalvy — Mon, 01 Nov 2004 08:48:02 GMT

What does the log show for that time period? Maybe someone created a loop causing a broadcast storm. Have you enabled STP to prevent loops? What version of firmware?

Re: Procurve Switch Hanging

Les Ligetfalvy — Mon, 01 Nov 2004 10:42:44 GMT

When you say "all the lights were solid green" do you mean ports that do not have anything connected? If that is the case, it sounds like the switch went into a reboot/POST but 10 minutes is way too long for a POST. Once again, the log may be able to shed some light on what happened.

Re: Procurve Switch Hanging

CHAD RENDELL — Mon, 01 Nov 2004 10:54:49 GMT

All ports are fully populated..
I am checking logs now.

Thanks

Re: Procurve Switch Hanging

Kell van Daal — Fri, 05 Nov 2004 04:13:09 GMT

I've seen this behaviour once.
The problem then was a virus.
SQL blaster had infected a few SQL servers, and they were scanning a lot.
One machine was even responsible for 90% of all traffic.

I found out by sniffing on a port.
If you see lots arp requests for different ip-addresses, than you probably have a "scanning" virus on the loose.