remsh hangs

[spearsy456]

Hi if anyone could help with the following issue i would be most greatful.

Background :
System OS
HP-UX11i
Hostname's
NLCREL03, NLCREL04, CHOMSL19
Network Interfaces
NLCREL03 multiple with dedicated production VLAN
NLCREL04 multiple with dedicated production VLAN
CHOMSL19 single lan in dedicated production VLAN

NLCREL03 & NLCREL04 are in the same VLAN and can talk to each other and CHOMSL19 using the regular services i.e ping/rcp/telnet etc
CHOMSL19 is on a seperate VLAN that can talk to NLCREL03 & NLCREL04

Issue when running the following command as user root & system user #remsh bdf

1)If i remsh from CHOMSL19 to either NLCREL03 or NLCREL04 the result is success.
2)If i remsh from NLCREL04 to CHOMSL19 the result is success.
3)If i remsh from NLCREL03 to CHOMSL19 the result is a timeout.

Evidence :

When option 3) fails i can see the following in the syslog on CHOMSL19 (the system the remsh is going to), it would appear the connection is being made as the following event is created :

"connection from NLCREL03 (IP) at "

when the remsh times out the following event appears in the syslog :

"connect second port : Connection timed out"

On all 3 systems the host.equiv and .rhosts contains entrys for the 3 systems, and the inetd.sec is empty allowing all.

I know its not a network issue as NLCREL04 is able to perform the remsh and its setup (apart from IP) is identical to NLCREL03 which is failing, as the syslog entry shows the connection being made, there is something taking place that stops the return journey from the failing system.


Any help would be great, im all out of ideas :)

Rgds
Steve

[Fabian Briseño]

Hello.

Can you try the command with the '-n' switch:

# remsh host -l user -n thecommand.


does it give the same error ???

[spearsy456]

Yep, tried with -n and the same issue occurs with the same updates to the syslog

[Fabian Briseño]

Hello Steve.
check your /etc/services file to what do the entry's for ports 512,513,514 show ?

[spearsy456]

Still need help on this, would appreciate any ideas

[Tingli]

Can you telnet there?

[spearsy456]

From my opening statement !

"NLCREL03 & NLCREL04 are in the same VLAN and can talk to each other and CHOMSL19 using the regular services i.e ping/rcp/telnet etc
CHOMSL19 is on a seperate VLAN that can talk to NLCREL03 & NLCREL04"

[Steven Schweda]

> I know its not a network issue [...]

I don't. (And that's "it's".)

If other services, like, say, Telnet, work in
both directions between the two problem
systems (CHOMSL19 and NLCREL03), then that
would seem to rule out any obvious routing
problems, but I know nothing about the
network hardware between these systems, and
I can imagine all sorts of (mal-configured)
firewall capability in there which might
cause a problem like this. Any description
which says "VLAN" sets me a-worrying.

Knowing nothing, I'd expect a more general
problem (routing, duplicate address, ...) to
affect all services more or less equally,
which, according to your description, is not
the case.

As always, I'd feel better if I could see
some actual commands with output, showing
things like actual IP addresses, route
tracing, Telnet sessions, and so on. (I
trust copy+paste more than I do anyone's
descriptions and interpretations.)

[spearsy456]

Steven apologies i thought this was a forum and not an English grammar class.
And from your comments below you've already proven you will not be able help with this issue.
Actual IP's would have no added benefit, i've told you both systems are in the same VLAN and can talk to CHOMSL19, i've also stated CHOMSL19 has a single interface, the fact they are in the same VLAN and can talk to CHOMSL19 shows the routing over the VLAN's is good as I have a successful round trip on NLCREL04 using remsh, route tracing would be no benefit as tracing doesn't use remsh and i've already said the system's can talk to each other. telnet session why ? the issue is with remsh and i've already explained telnet works and it should do, it's a separate service and flow to remsh anyway.
I know its not a network issue because on top of the evidence above, I have an entire network team
that have checked all flows and rules to be good, and we have monitored network failures/drops over checkpoint for two week's without any failure's prior/during/post the issue arising.
My hope with this thread was someone has experienced second port closure using remsh, if I cannot find someone that has then the thread can be closed.

[Tingli]

Although both of them in the same vlan, but if the firewall port is closed, they still can not talk to each other. Nowadays, the network is so fancy that it can open or close anything as it likes.

[spearsy456]

Tingli,

Very true, unfortunately our network monitoring would throw up some pretty big alarm bells if a port were to open or close.
This can only take place through very strict change control, during an even smaller application downtime window :(

[Shibin_2]

From the readings, I suspect it could be firewall issue.

You said, NLCREL03 to CHOMSL19 is timed out; but at the same time, CHOMSL19 can talk to NLCREL03.

It looks like only uni-directional connection. How about the ping response or traceroute output from both systems? Traceroute output would be the best option, you can find, where it is dropping.

[Steven Schweda]

> From the readings, I suspect it could be
> firewall issue.

Hmmm. You must be as foolish as I must be.

> [...] i thought this was a forum and not an
> English grammar class.

So, is your complaint that I provided no
useful information or too much? ("I", by the
way.)

I can hardly wait to learn what the real
problem (or "issue") was. Please be sure to
report back when it's discovered. Thanks.

[Gordon Sjodin]

Are the hosts files all current?

[spearsy456]

Shibin/Gordon

Thanks for your post's,

traceroute is successful on both system's from source to destination. we have dedicated security tools that run ICMP test request's so if a weekend change were to be implemented which stopped ICMP from source to destination we would be notifed immediately via ITO.

and obviously with a successful traceroute and the fact our firewall's allow ICMP, ping result's in a round trip completion on both NLCREL03 & NLCRLE04 to CHOMSL19.


Yep hosts,inted.sec,hosts.equiv & .rhosts are consistant and correct across all system's.
we use opsware to push the file pack's, once on they never get changed per location we build (plus im one of 3 people that has triple checked them to make sure all is well)

(due to the nature of our business i cannot post any iternal details, which i appreciate can make problem's harder to diagnose,)

But suggestions are very welcome

[Steven Schweda]

> But suggestions are very welcome

http://www.hopkinsandcompany.com/Books/Eats,%20Shoots%20and%20Leaves.htm

[spearsy456]

comment abuse from other member

[Steven Schweda]

More free advice:

Getting on the wrong side of spearsy456 may
lead to being awakened at home on an
otherwise pleasant Sunday morning by a
telephone call from an irate, vulgar
stranger.


These forums are _so_ educational.