HP Unix 6.0 blocks machine

[Nurudee Ibrahim]

Hi,

I am a network engineer on wireless equipment. I recently installed a radio (Speedlan)for a client to link the lan in his branch office to a HP Unix 6.0 in his head office. Everything works but once in a while (sometime 4 times a day) the HP Unix server will stop responding to request from a workstation they use most of the time, to resolve this problem, the IP address of the workstation is changed then the communication with that particular workstation is re-establish again. Seem like either the Unix server is seeing something like a syn flood from the workstation and temporarily blocks the IP or it see it as some form of attack.

Can someone please help with a workaround for this. The system can still communicate with other server weather its a windows or unix any time this happen but wont talk to the initial HP unix until the IP is changed.

Any help will be really apreciated.

Thanks in anticipation.

Nurudeen

[Steven E. Protter]

Shalom Nurudeen,

I think you need better information. I've worked over 11 years with hp-ux and never seen a version older than 9.x.

HP-UX is hp unix by the way.

You need to get the model numbers of the server and workstation and take a look at the /var/adm/syslog/syslog.log files during the problem to figure out if there is something wrong with the Unix systems.

Get the os version by logging on the system an running the uname -a command.

As a network engineer, I'm assuming you have already looked at the output from a packet sniffer. Now its time to have a Unix admin look at the involved systems.

SEP

[melvyn burnard]

Are you sure of your HP-UX version? HP-UX 6.x was back in the mid 80's on the old motorola 300 series workstations, and has been unsupported for almost 20 years

[Denver Osborn]

Maybe you meant MPE/iX 6.0 on an HP e3000 -vs- HPUX 6.0 on an HP 9000....

-denver

[Nurudee Ibrahim]

Thank you for your response, really apreaciated.

Problem is he is my client I dont know much about Unix operating systems, he recently lost his system admin that was looking after his network. The OS version is Realease B.10.20 and its a HP 9000 model k360. From what I can deduce with what is happening, the server for some reason blocks communication to a workstation either for security violation like syn flood or something and then deny access from the IP address for that workstation for a period (dont know how long). If this happen what we do is to change the IP address of the workstation, but sometimes we may not be lucky and the server blocks the new IP address almost immedietly. But you may use the IP that was initially block after a day and it work. Is there a configuration on the HP-UX that cause this behavious? How do I work around this. I know Cisco, Microsoft, but am not good with UNIX OS or any of its flavour.

Thanks againg for your help.

Nurudeen

[Steven E. Protter]

Okay,

Now we know what it is.

Now you need to get someone to log on or log in yourself and check out what I said above and:

lanscan

ifconfig lan0

for every lan interface on lanscan.

I'm not convinced the HP box is the problem, but there will be evidence in the logs if it is.

SEP

[Nurudee Ibrahim]

Thank you SEP,

I may be wrong but I think its the HP Box. Reason is, the client have both a SCO UNIX and Windows 2000 Server on the same LAN as that of the HP Box, anytime the issue I talked about happens and you ping all server they all returns a reply, at no time did we have any issue with the SCO UNIX or the Windows, even the Second off line HP box back when connected will reply if you ping it, but the First HP Box that denied access cannot be pinged until the IP address of the source IP that is blocked is changed.

Nurudeen.

[Patrick Wallek]

By default, HP-UX does not block IP addresses. It is possible that there is some additional software installed that would do something like this, but without more information it is very hard to tell.

At the least we really need to see the /var/adm/syslog/syslog.log to see if anything is logged there.

[melvyn burnard]

Well 10.20 is the HP-UX OS , but thios is no longer supported.
I would suggest you review the level of patching, check the network configuration of the server, and maybe use the network logs and nettl tool to try to spot what is happening.

[Adrian Horne]

I once had something similar with a 10.20 server that would stop replying. It turned out the server was adding incorrect routes.
Check using netstat -r to see if the route to the workstation is correct. I used route delete to remove incorrect info which would fix the problem. See man page for route for more info. I believe the underlying issue was a missing patch (can't give more info as the server has been retired)

[rick jones]

You might make sure that no other system(s) are trying to use the same IP as the workstation to which connectivity is lost. May want to watch the ARP cache on the server (arp -an) to see if the MAC address for that workstation's IP changes.

The suggestion to go and try to find up-to-date patches is a good one on general principles. however, keep in mind that 10.20 is officially obsolete... upgrading to a newer HP-UX rev might not be a bad idea.