One PC stops entire network

[time]

A client has a LAN with an NT 4 server and several workstations - one Win2k and the rest Win9x. When they come in most mornings, the LAN is off the air.

The first time this happened, we tried replacing the switching hub - to no avail. From memory, workstations couldn't ping each other or the server, but I think the server could ping them. We eventually worked out that turning off one of the workstations solved the problem.

The PC concerned is a P4 1.8 on an MSI i865G motherboard (with integrated Intel LAN adaptor) running Win98SE. The staff power cycle this PC first thing in the morning as required. :-?

The vendor has been out a couple of times. The last time, they did something that fixed the problem for some months. Unfortunately, as of this week, it's back.

Given that the site is 2500km away in a different country, my diagnostic capacity is kind of restricted. I'm thinking the vendor must have made a software change - but what sort of amazing Winblows glitch could bring down a network?

 

[P5-133XL]

One possibility would be a duplicate DHCP server renewing everything with the wrong IP addresses.

 

[Buck]

How about an issue with the Master Browser election?

 

[Mercutio]

I've seen bad NICs take down whole segments. But that's generally not something that's intermittant.

Browser election problems wouldn't cause ping to stop working.

Mark's DHCP server scenario sounds really good though. Maybe someone has an 802.11 AP plugged in someplace that had to be reset not too long ago, causing the problem to resurface.

 

[time]

It sounds good to me too - if only I could work out how it fits the situation.

AFAIK, there is a single NT server, several workstations, a 16-port switching hub, and a Nokia DSL modem-router.

How can you tell what devices are issuing DHCP leases?

 

[Mercutio]

The NT Server and the router, maybe?

 

[Grim]

A client has a LAN with an NT 4 server and several workstations - one Win2k and the rest Win9x. When they come in most mornings, the LAN is off the air.

...

Given that the site is 2500km away in a different country, my diagnostic capacity is kind of restricted. I'm thinking the vendor must have made a software change - but what sort of amazing Winblows glitch could bring down a network?

Claiming the primary server's IP address (so long as everyone saw access to that box as being 'the network'), or claiming its MAC address. I don't know why it would develop this spontaniously, however, <brainstorm>unless the primary server were manually addressed, and the DHCP server had that address in its range. It could be that other systems occasionally get that IP as well, but the system that causes the problem has a firewall, which causes it to short-circuit most of the IP stack, so that it responds quicker than the server, while the other computers always respond slower than the server, and so it only causes an outage for them. If the hub were a router instead of a switch, the effect of diverting traffic from the server could also be achieved by running some routing software (for example, RIP) that the router respects; this wouldn't require a race, as the rogue system would be informing the router in a language it trusted, "you don't have to ask where this is, it's me."</brainstorm>

If it acted as a rogue DHCP server, I'd think shutting it off wouldn't immediately fix the problem; you'd need to reboot the other clients as well.

I can think of a couple of low-level faults that could cause this behavior, but I cannot imagine Windows performing one in a way that would not survive a reboot, unless it were infected with a virus. Given that it's not spreading to other machines on the network, how's that system's patch level compared to other systems?

Disclaimer: I'm a unix guy who's also learned something about networks. My primary area of Windows expertise is how it acts while talking to other OSes.

 

[Howell]

How can you tell what devices are issuing DHCP leases?

ipconfig /all will tell you where a particular machine got its current IP address.