got a really strange one for you all.

I have a network setup using a linux machine as a gateway between various network segments (on seperate nic's) and virtual machines (one of which is a mail server) all managed by shorewall and bind9.

This has all been running happily for ages, but on the weekend the servers went down and were rebooted. Since then, the windows machine (ONLY) are having problems opening anything of any size on the network. For example, email has a web page that will open to the point of login, and then hang. The mail clients can download the headers of messages, but not the body of the messages. Opening shared documents is no issue, but saving them is VERY VERY slow and usually times out. However, Mac and Linux machines have no issues at all. This is windows only, and only on the internal network. Access to all of this from outside, on any platform, is no problem.

I see this same behaviour from a windows machine running as a virtual box client on a linux host that has no issues.

I'm out of ideas. I've done packet sniffing, and apart from a bunch of retries from the windows machines that I don't see on Linux, no issues that jump out at me.

How would you suggest I try and fault find this? What does the windows stack do differently to the linux/mac stack?

  • Do you have IP address conflicts? In your sniffing, can you see if all ARP traffic is good? I've had situations where IP conflicts went undetected because multiple devices responded to ARP who has requests, but that's all they did. This caused some traffic to partly fail, depending on who answered the ARP sooner. – Halfgaar Jul 8 '14 at 9:18
  • I have some pcap files now from a pop exchange on both windows (not working) and mac (is working). The only real difference is that the windows captures have a lot of retry packets in them (and dup acks) whereas the mac transaction is pretty straight forward. Not sure how best to get them to someone to take a look at. I think we have determined that this is not ip address clashes (although that was a really good suggestion). – Peter NUnn Jul 9 '14 at 14:17
  • By your description, I don't think I'll find anything in your captures that you didn't find. Currently, I'm at a loss for suggestions. – Halfgaar Jul 9 '14 at 15:04

Are the slow connections through your firewall or also on local segments? Are the non-Windows machines connecting the same way to the same services from the same ports on the firewall? That is, you have a mac and a windows machine plugged into the same switch in the closet, they both try to open the same email in the same web page. With that kind of comparison, what do you see?

Is it possible an interface on the router/firewall is set to the wrong speed after the reboot (this has happened to me)?

When in doubt, I blame the Windows "tuning" settings for TCP/IP: http://www.speedguide.net/articles/windows-7-vista-2008-tweaks-2574 and http://www.riccardoriva.info/blog/?p=1286 for information on the subject. And yes, this can cause issues even in a LAN setting, but generally only in the presence of a speed change for a connection somewhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.