Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my machines has started to get serious networking issues. This all started to happen suddenly although I am not aware of any specific changes made to the machine. It is running Windows 7.

Some of the symptoms that was not a problem before:

  • ssh into the machine rarely works and when it does it might stop after some minute
  • rdesktop to this machine shows similar symptoms as ssh, if you manage to get in it freezes after a short time, but usually you do not get in at all.
  • nmap shows: Note: Host seems down. If it is really up, but blocking our ping probes, try -PN. This worked fine before.

However connecting with vnc has no problems at all.

Googling around I have tried some tips, none working so far such as turning off RDC (remote differential compression), turning off firewall, turning off antivirus, turning off network auto tuning.

How can I find out what the problem is ?

share|improve this question
    
How about mentioning that it is a virtual machine somewhere above this line? –  MattBianco Dec 1 '10 at 10:13

6 Answers 6

up vote 2 down vote accepted
+50

Before you say "network" let's understand what LAYER you're talking about here.

If it's truly a "networking" problem its going to be layer 3 and below.

So... check the following:

Layer 1: Frayed or kinked cable? If you have a managed switch can you see any physical errors on the port utilized by the client? Is the NIC linking at half or full duplex, 10 or 100 or 1000?

Layer 2: Thrown on Wireshark and lookout for any duplicate MAC addresses jibber jabbering back and forth.

Layer 3: Is it receiving a valid address not shared by any other peer on the network?

As for the OS itself... check the usual culprits:

  1. 3rd party and OS firewalls fighting each other.
  2. Protocols you're not using yet, like IPv6, uncheck it.
  3. bad DNS configuration
  4. Did you set the connected "network" as Work/Home or Public?

Troubleshoot some more.

share|improve this answer
    
1. I don't have physical access to the machine, but I have no reports of problems from there. 2. I have tried wireshark a bit, but I would need some advice about exactly what to test. Jibber jabbering does not tell me much. 3. I don't see any DNS issues. 4. It is set to work, but changing it to Home or Public did not make any difference. –  Zitrax Nov 30 '10 at 11:34
    
The problem is solved :) In the end it turned out that there were two machines on the network with the same MAC which obviously caused trouble. After fixing this the machine had no problems. –  Zitrax Dec 1 '10 at 12:19
    
How is it posible to have 2 machines with the same mac other than hacking the NIC and changing the MAC, what are the odds :) –  Hugo Garcia Oct 13 '12 at 14:16
    
@HugoGarcia It was a virtual machine that had been configured incorrectly. –  Zitrax May 30 '13 at 8:56

Using IPv6? Many of the problems I have seen with Win7 networking revolve arround IPv6 and the hosts file.

But rather than guessing, I would collect data first. Start with the System event log. Research any warnings and errors in the relevant time frame.

Next try something like:

netstat -noab >%userprofile%\Desktop\out.txt

Use the output to audit connections on a given machine. Pay close attention to records with a state other than Listening or Established. If you find something odd, try to isolate it and take a closer look.

Another thing is to verify the ping response. Try pinging both the IP Address and the Machine name. Make sure that the response is from the host you expect it to be from.

Is Network Discovery enabled?

http://windows.microsoft.com/en-US/windows7/Enable-or-disable-network-discovery

share|improve this answer

What is your ethernet adapter's chipset? I have seen this with particularily horrible ethernet chipsets that do crappy TCP Offloading and fail miserably at it.

Solution in my case was to disable TCP Offloading in the driver options pane, and bumping MTU back to 1500.

This could be a multitude of things, but in this particular case, that was my issue, and it took forever to figure out, so i thought I would mention it.

share|improve this answer
    
It is virtualized under Xen, but the network adapter is reported as "Realtek RTL8139C+ Fast Ethernet NIC". I did not see the TCP Offloading settings there. But I tried to change some of the other settings and when I changed the 'Receive buffer size' from 64K to 8K it suddenly worked, I'll have to check for a while though if it's just temporary (it has briefly worked before right after a reboot too). –  Zitrax Dec 1 '10 at 0:15
    
Ah! That makes a world of difference! The fact that it shows up as a 8139 means it's not paravirtualized, and instead doing the full PIO. You are bound to experience horrible, horrible performance with that. What version of Xen are you running? 3.0? 3.0.X? 3.5? 4? What is the distribution on the Dom0? Citrix or something else? RHEL? (this is what I run, with a custom Xen tacked on). –  mr_daemon Dec 1 '10 at 1:02
    
I see you solved the problem but you should still know that you're not getting the full performance you should be getting out of IO and Network transactions by not having the Xen PV Drivers installed. I thus point you here: wiki.xensource.com/xenwiki/XenWindowsGplPv –  mr_daemon Dec 6 '10 at 16:42

You may want to try this as a test:

netsh interface tcp set global autotuninglevel=disabled  

or

netsh interface tcp set global autotuninglevel=highlyrestricted  
share|improve this answer
    
Tried it earlier, but it had not effect. –  Zitrax Nov 30 '10 at 23:30

Log onto the machine and see how it performs over the network. e.g. Browse the web, download a file. Is it snappy or really slow? Or, does the machine feel really slow overall?

If you bring up the CPU monitor, is it idling or sitting at 100%? seen that before, well it's really common with windows PC's to sit at 100% for no apparent reason.

This is just to confirm that it is a networking issue and not a general machine issue.

If you're certain it's a network issue try this.

  1. Check the windows event log for errors related to the network.
  2. Swap the network cable. Plug the machine into a different port on the network switch.
  3. If that doesn't resolve it, try running netstat and have a look at all the services that are running. Turn off anything that isn't required.
  4. Right click on the task bar and bring up the task manager, order by CPU usage. Anything in there that doesn't look right or is consuming lots of CPU usage?
  5. Check the routes and DNS settings in the network.
  6. Disable the windows firewall temporarily and see if that helps.

As Greg has suggested, the following can sometimes help. It certainly can make a difference in some instances.

netsh interface tcp set global autotuninglevel=highlyrestricted 

EDIT Just read a comment that you don't have physical access to the machine. Suggest you log in with VNC and check the event log and also check that something isn't taking up 100% CPU or more than it's fair share.

share|improve this answer
    
There is no high cpu load, I did not see any suspicious entries in the event log. Disabling the firewall has not helped either. –  Zitrax Nov 30 '10 at 23:49

Take a look at

http://support.microsoft.com/kb/951037

I disabled Receive-Side Scaling, Chimney Offload and NetDMA and it solved some of my network issues.

(granted, this will slightly affect performance)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.