Strange Network issues

[Jenny C]

My server is a D-class with HP-UX 11i. I have a static IP address and it's registered with my company's DNS.

The strange thing is, I have to reboot the server every week or less than 5 days in order to be telnet into it. Otherwise, I can't even ping the IP. But when I use the console, I could see that the IP was fine with my lan0. However, I can't ping from the console to another machine on the same subnet until I reboot it. After reboot, the IP and the DNS name both works and lasts about 5 days on the network. It's very annoying but I don't know how to troubleshoot this?

[Todd McDaniel_1 · Accepted solution]

Have you added a new server recently? How open is your network?

It sounds like me that you could have 2 boxes with the same IP...

Have you done traceroute? to and from the host? Does your output of nslookup look correct for both the IP and DNS?

Do you use tcp wrappers on this box?

I might also look at your /usr/sbin/inetd daemon going down...

[A. Clay Stephenson]

Next time this happens, do a ps -ef | grep inetd. This has the earmarks of a dead inetd. I would look for and apply all Network/inetd related patches.

Even with up-to-date patches, it's a good idea to have a cronjob that runs every 10 minutes or so that checks to see if inetd is running and if not then restart it.

[Steven E. Protter]

If inetd -c doesn't fix it.

It could be another box on your network, perhaps a test box or a DHCP list is being set up on the same IP address.

There should be evidence of this in the /var/adm/syslog/syslog.log file.

SEP

[Jeff Schussele]

Hi Jenny,

Couple other posibilities are:

You're losing your default route. Next time it happens do a
netstat -rvn
And verify the route remains. Then try to ping the router IP

Your ARP entry for your NIC is disappearing from the next-hop router. Check the ARP table on the router next time. It could be timing your entry out.

Could also be dead-gateway detection. HP-UX coanstantly checks for it's routers & if they disappear (Maintenance?) they will be dropped from the routing table. Again check for the default route & this "feature" can be disabled in the /etc/rc.config.d/nddconf file.

HTH,
Jeff

[SS_6]

Could be problem in the lan card. Try resetting it through lanadmin or commandline.

[Jenny C]

Thanks for all the ideas. I am grateful for your help!

nslookup resolved fine both ways with DNS server and returned correct info. syslog.log did not show any duplicate IP error.

I did a netstat and UG listed the correct gateway. This is the same gateway used by lots of people in the same subnet, including myself, so I don't suspect that it would be a dead gateway.

I did a reset on the LAN card as well. Currently inetd is running. I will apply the inetd related patches and cross my fingers.

[KapilRaj]

It could be a hardware problem as well . Try switching over to a diff Ethernet switch / hub also replace cables !

Also check for any cron scripts which adds or removes the routes ( In my training days , somebody did something similier).

Regds,

Kaps

[Gerhard Roets]

Hi

Verify that you do not have dhcp enabled on that interface. That is if you do not use dhcp.

Regards
Gerhard

[Hein van den Heuvel]

[off topic]

Jenny,

Could you please consider NOT assigning 10 points to answer that do not solve your problem? It's confusing!

I'm sure you appreciate all attempts to help and want to recognize that, but it is also nice to be able to tell how useful a reply was in addressing the problem itself.
If it helped solve it, by all means assign 8, 9 or 10. If the problem is still not solved all the way, pick 7 or less.

Cheers,
Hein.

[Jenny C]

I am happy to report that everything works now! My server haven't disappeared for 11 days now! All I did was using lanadmin and reset the NIC card. Thanks all for your good ideas!

[Printaporn_1]

Hi,
It may happen again if your problem is IP address conflict.
check log with
netfmt -t 50 -f /var/adm/nettl.LOG00

[Jenny C]

The saga goes on...The server did disappear about 16 days. Thanks printapron for teaching me to look into the /var/adm/netll.LOG000 file. There was no message for IP address conflict, but it was full of messages saying that there were faulty cable connection between the network adapter and the switch:
btlan [0] [HPC HSC J3516A #001 10/100 BasetTX D-class 2 port ] going Offline @ 8/8/1/0] [Cable Disconnected].

So I changed the cable, and bound the IP address to a different port 8/8/2/0. Let's see what happens.