Member Avatar for ayush1440

Hello friends,

I am system admin in small company with 7 desktops and 4 laptops. All systems are working perfect.

Sometime i can ping our ISP dns but cannot connect internet at same time other systems are using internet, than I have to restart PIX firewall and than works perfect. After 2nd day another system has same problem.


Now I removed PIX, but I want to know what is this problem? Is it Network Flooding? IF yes, how can i idenitify and prevent it?

Please help me,

Help would be really appreciated.

Thanks a lot..

  • 7 Contributors
  • 6 Replies
  • 4K Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by Hilary H

Dani AI

Generated

Given your symptoms (one PC at a time cannot browse while others work, and a reboot of the PIX fixes it), this is far more consistent with a PIX 501 “inside host” license limit than with true network flooding. The 10‑user license counts unique internal IPs that build translations through the firewall; once the limit is reached, additional hosts cannot create new flows until entries age out or the PIX is reset. On the PIX console, check your license and limits with show version (look for Licensed Features / Inside Hosts). This command is documented in Cisco’s PIX command reference. See Cisco PIX Command Reference (show version).

To confirm in real time and apply a surgical fix, list counted hosts with show local-host and clear a stale entry with clear local-host <ip> (drops that host’s flows but avoids rebooting). You can also review/clear translations with show xlate count and clear xlate (clears all NAT/PAT entries; active sessions will reset). Cisco engineers and users describe these checks for the PIX 501 here: Pix 501 license limits and how to tell.

If licensing is not the issue, rule out DNS handling quirks on older PIX code. Adjusting DNS fixup has resolved “ping works, browsing fails” cases: fixup protocol dns maximum-length 2048 (or disable the length limit). Reference: PIX 501 Basic Config (DNS fixup guidance). A true L2 broadcast storm would impact all stations simultaneously, not rotate between them.

Recommended Answers

All 6 Replies

Member Avatar for sknake

Install Wireshark on one of the machines behind your PIX. During a period of network outage fire up Wireshark and monitor your traffic for about 3 minutes. While you're capturing the data with wireshark open 2 browser windows and try to hit 2 different websites. Don't go crazy and try to connect everywhere because it makes reading the log files a mess.

After you have logged a few minutes of traffic then upload the PCAP files here.
WARNING: You could accidently pick up passwords being broadcast over the network. DO NOT login to any system during the period where you are capturing traffic. Also double check the captured packets to ensure you're not about to upload any sensitive information.

Member Avatar for gelgin2k

Lets start with some questions;

Did removing the PIX solve the connectivity problem?
If so the problem is likely associated with the PIX configuration in some way

If not did the nature of the problem change?

You can take a trace as suggested, but if done as requested you will provide data on the system running wireshark, and not necessarily any of the other systems.

It may however confirm that you are experiencing a problem, but may not provide the data necessary to say why...

Some architectural questions;

Can you describe your network in detail?

Specifically;

How are the stations connected to one another?
What are the device make models and versions if you know them?

How big is your internet pipe?

What kind of internet access do you have?

Who is the provider?


Some questions surrounding the problem;

Is there consistency in the time of day the problem occurs?

Is there any consistency with which stations are effected?

Are there any stations that seem to never present the problem?

Are local resources accessible during these events?

Network Flooding could mean a couple of things;

The local network is experiencing a broadcast storm of some sort and this is causing issues with all access to all resources

The internet link is "flooded" and as such is not allowing access due to line saturation but local resources seem to be working.

Some other event (worm virus) is generating significant traffic and creating resource issues on various parts of the network...

With what you have provided so far it is difficult to determine whether this is an issue of flooding or not...

Answer the above questions and we'll see if we can't help you ID the problem.

Good luck in any case :)

Member Avatar for geoffairey

The obvious thing that occurs to me is that maybe the PIX is limited to a 10 Client license for accessing the internet.

But if removing the PIX removes the issue, it suggests that the Pix is the Cause and you should start by looking through its logs.

Member Avatar for lsjames

You can use the traffic monitoring software (example: active wall) to identify the computer which in trouble.

Member Avatar for wildsniper

When there is network flooding in your network, all the computers should receive those packets which are not destined to them.You can install a packet sniffing tools on any computer of your network and check it.

Member Avatar for Hilary H

There are many kinds of flooding in network, each has its different features. As a network admin, I think you'd better search some good tools to help you manage the network. Here is a list:
1. Network sniffer: wireshark, Capsa, Comview.
2. Colasoft Mac Scanner, List MAC addresses and IP addresses in your local subnet in seconds.
3, Ping tool, to ping multiple IP addresses simultaneously and comparing response time in a graphic chart.
......

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.