I have a strange behavior on one of my windows2003/IIS6 servers.

I have two network cards on it, let's call card A the card which connects the server with the internet, and let's call card B the card which connects the server with the intranet. The server is used by many users who connect to IIS with their netbooks.

The problem is that from time to time, the card A stops working.

I can reach the server in RDP through the card B, and I see that A is enabled but without any traffic. I can reset it, disable and re-enable it, but with no luck. The only thing that I can do is reboot the server, which is annoying. Nothing useful in the system logs.

Only once I've been able to reproduce this behavior, when calling a very simple aspx page which only streamed a file (using Response.WriteFile), and calling the page from a netbook. reinstalled windows on that netbook, and it started downloading the file without locking the server card.

I am out of answers, any help greatly appreciated.

  • 1
    so your server is multi-homed? maybe it would help if you showed us your routing table? are both NIC's connecting to the network at the same speed? – Nick Kavadias May 26 '09 at 11:31
  • I don't think it can be called multihomed, since web traffic can only get to the server through card A, correct me if I'm wrong. the A card is 10/Mbps, the B 100Mbps. – pomarc May 26 '09 at 12:32

Check your default gateways on the cards. Make sure that only card A has a gateway.

Also, if you haven't tried performing an issreset you should perhaps do that first before disabling an enabling the card, then if that doesn't fix it, after the card. If doing it first fixes it, you could be looking at an IIS problem.

| improve this answer | |
  • for the gateways: do you think that the B card does change its ip configuration? I don't think so, the B card keeps working just like before the outage happens. Anyway, I'll check that. I'll also try the iisreset as soon as the problem happens again, and will let you know – pomarc May 26 '09 at 12:24
  • Regarding the gatway, no, I don't think they change. I've seen setups where both NIC's had a gatway which would at times cause the OS to route the return traffic incorrectly making it appears as though the NIC was not working. Examination using tcpdump on the firewall (wireshark would also work on the server) finally pointed out the problem. Traffic would come in on one NIC but try to return on the other. – palehorse May 26 '09 at 12:53
  • OK palehorse. now I understand. anyway when I disable-reenable the NIC, the traffic counters stay at 0 both for incoming and outgoing traffic. – pomarc May 26 '09 at 13:08
  • Did you verify that only card A has a default gateway? I did not see any response to that specifically. – palehorse May 26 '09 at 17:07
  • AFAIK windows will pick the default route to be which ever NIC connects at a faster speed. In your case B will be your default gateway, but something may be messing this up. You might need to change your TCP/IP & put in some metric weights on your NIC, or as someone else suggested only give 1 NIC a gateway – Nick Kavadias May 27 '09 at 8:53

I think there is a very good possibility that you have a firewall or some other external device that is causing this behavior and not the server itself. This sounds like an attack script or rate limiting type behavior of a firewall protecting your server.

Do you have other devices in the same subnet as the 'A' card? If so, try connecting from that device to your 'A' card and see if it is successful.

| improve this answer | |
  • I agree that this could be a possibility, but int this case the weird thing would be the fact that rebooting the server fixes the problem... if it is an external device that cuts the connection (this would be ok with the fact that windows says that the NIC is healthy) why is the connection restored when the server reboots? I cannot reach the A card from the LAN, the servers are hosted and not in my datacenter. – pomarc May 26 '09 at 12:44
  • Rebooting the server will cause the interface to go up/down which may reset the attack script (if there is one). Cisco switches (and probably others) have rate limiting features that could also cause this -- if you can wait about 10 minutes does it unblock? cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/… – Peter May 26 '09 at 13:09
  • Thanks Peter. No, the NIC does not unblock after 10 mins: it stays "offline" until I reboot. For hours, if nobody reboots the servers. alas, it happened. – pomarc May 26 '09 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.