FTP failure

[Ron Kinner]

We have two 10.20 HP UX machines. A Windows NT PC FTPs a file first to one then the other. This is an automated process which works well most of the time. However, one machine sometimes fails. Finally captured the failure with my
trusty sniffer. On the good trace we see the FTP data session on port 20 closed with the usual 4 step FIN ACK FIN ACK then the Control session on port 21 closes. On the bad trace we see FIN ACK then a 58 second pause followed by an ARP by both target machines asking for the MAC of the sending machine. (No idea why the first machine is doing an ARP. He has nothing to say.)The bad machine actually ARPs a second time then immediately replies to a second FIN from the sender before receiving the reply from the second ARP.

Have tried using the port where the sniffer is and a nice clean cable but no effect.

A ping sweep (size from 32 bytes to about 7500 byte) of both targets and the sender shows some some random failures on both targets but none on the sender. The sniffer seems to think it may be a buffer issue. Is there a way to increase the TCP/IP buffers?

Is there a known issue with the ARP tables flushing for no reason. What is the ARP timeout anyway? Surely it is longer than 56 seconds?

Any ideas on what to try next? Any chance that going to 11.0 would fix the problem?

Thanks

Ron

[harry d brown jr]

You should have absolutely no ping errors unless you have a network issue. You might need to replace your network cars, cables, routers, etc...

Packet size is not an issue, unless you modified the original (should be around 1500). "lanscan" and "lanadmin" are good tools to start with.

live free or die
harry

[Ron Kinner]

Thanks for the detailed info. I'm optimistic that when I give it to our HP admin folk (I'm the network engineer whose network is always guilty until proven innocent) they will be able to improve their machines' performance.

I should clarify for Harry that the failing ftp transfer occurs on the same subnet and no routers are involved. Just a simple little 3Com hub. I only used the router which has a port on the same subnet to stress test the PCs involved. It's a Cisco 4500 and one of it's ping modes is a sweep from 32 up to 18000 bytes. Obviously the ping gets broken into Ethernet MTU sized packets when it leaves the router and has to be reassembled by the receiving device and a reply sent back. This appears to cause the HP machines some difficulty probably just because they are very heavily loaded and ICMP is not a high priority task but it could also be caused by a poorly tuned TCP/IP process hence my question.

I will post again when I get some feedback from my HP folk.

Ron Kinner

[Ron Kinner]

The problem still exists. FTP sessions from one machine to another on the same LAN (10BaseT Hub) fail. I have a sniffer trace of a failed session where the HP 10.20 PC sent an ack for a packet that was received 4 hours ago. Even have one where the ack was 24 hours old. The NT guy who owns the sending machine tells me everything used to work just fine until the HP folk upgraded to 10.20 back in August. Ever since there have been problems with this transfer. (Knowing NT I'm sure there have been several patches added to the NT so that is not real hard evidence.) The NT guy wants the HP folk to back out the upgrade and revert back to their old version. No idea what that was.

From a network point of view the circuit is clean. I can ping each machine all day with a 1500 byte ping without errors. Lanadmin also shows no errors. However, if I start using a larger size ping that has to be reassembled I do get a few ping failures when I beat on the HP machines. The NT box is a relatively new Pentium III with multiple processors and it's clean regardless of what I hit it with.

They gave me a root password on one of the HP machines for a while and I played with nettune parameters and increased the FTP buffer but none of that helped. TOP shows it's a dual processor machine which is not heavily loaded and has lots of free memory so I'm beginning to think there is probably a patch missing. Appreciate any recommendations.

Ron

[Uday_S_Ankolekar]

Hi,

The following threads might helpful..

http://us-support2.external.hp.com/iv/bin/doc.pl/sid=2fd8aa5c041ce88264/screen=ivHome/?NODEID=English_SHW::WW_SW_NW_RCFAQ_EN_E/Q1.4.2&WARP=1
http://us-support2.external.hp.com/iv/bin/doc.pl/sid=45a792690bac010d91/screen=ivHome/?NODEID=English_SW_NWIS::WW_SW_NW_HPUX_EN_E/Q1.4.3&FROMID=English_SHW::WW_SW_NW_HPUX_EN_E/Q1.4&ANSWER=FTP

Goodluck,
-USA..

[Ron Kinner]

Thanks but it says I'm not authorized to see those two pages.

Ron