I would like to address an strange issue I am having lately. At least strange for me.

I am not a proper server administrator, I am just looking after a really small network of 4 computers aside my duties in my work. So here is what's happening:

Lately we had a faulty network cable and upon slight movement, connection was lost and regained immediately. After this, the whole network was malfunctioning and the computers could not communicate with the server. I changed the cable and all was good. Today, I turned off one client, and I decided to turn it back on to do some more work. The network crashed again for all the computers.

After numerous tests, I recorded the following: 1) The problem is located at the server.

2) Everything gets back to normal if I flush the ARP cache.

3) At any type of computer disconnect-reconnect the problem occurs.

4) There is a time window that the ARP cache can be filled up without issues. A few minutes time. Any change after that, reproduces the problem. For instance if I open 2 clients and after half an hour I open the third and I ping the server, problem occurs. If I open them all at the same time there is no problem. Even when I connect my laptop to the Wifi Internet router, any message exchange with the server produces the problem. Laptop's IP is added in the ARP cache and after flushing problem is solved.

5) When the network is not functioning, ping of the server shows TTL=64 rather than 128 but tracert succeeds on the first try.

Server OS is W2K3 R2 SP2. Clients have static IP's. I have changed the switch and the problem still persists. If anyone has come across something like this, please help. Thanks.

  • 2
    Perform a packet capture on one of the affected systems and see what it shows. $50 says you're experiencing a broadcast storm of some type. – EEAA Oct 30 '15 at 21:14
  • isn't there any IP collision? Are you using dhcp or assing static ip to all devices? – Ondra Sniper Flidr Oct 30 '15 at 23:02
  • @EEAA I performed a packet capture with Wireshark. The server is not receiving any packet. When I ping the server there is no ICMP packet shown in Whireshark although, there is a reply to the client with TTL=64. After clearing ARP cache, the ICMP packets are shown in Wireshark and the reply has TTL=128. This seems very weird. Inserting a Wifi dongle and connecting through it, does not reproduce the situation. I also have Windows 2008 installed on another disk and when I reboot on that OS, the problem is not reproduced either. NIC or NIC/driver issue? – Saloom Nov 1 '15 at 13:03
  • @OndraSniperFlidr All devices have static IPs – Saloom Nov 1 '15 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.