Case Analysis and Experience Sharing of LAN Failures

Case 1

Symptom ● Colleagues call me to say that the machine is not on the network, the system is windows98. Put down the phone to the colleague's computer and start checking. First of all, use the Ping command and find the ping. There is no problem for yourself, the ping gateway is also open, indicating that the network is physically connected. And ping some websites is also open, indicating that the network settings are no problem. Look at the settings and versions of IE, there is no problem, the local web page can Open! But it can't get on the network.

Fault Analysis ● This problem definitely has nothing to do with network lines and network card switches. It is definitely a problem with the system, and this is a typical problem, which is the 98 system. The file is corrupted, that is, the scoket file is out of order. There may be some files that are destroyed at the same time.

Solution ● This is simple, enter SFC in the run, check the integrity of the file. As expected, there are problems with some files. Follow these prompts to restore these files and restart them. Open IE and everything is fine. Case 2 Failure phenomenon ● Colleagues from another department play I can tell you that the machine is not on the network. The system is also for Windows98. Put down the phone and go to his office to start checking his computer. This time I found that there is no problem with pinging myself, but the ping gateway will not work, let alone the Internet. Maybe physics There is no access on it, but the NIC light is on. Check the system and network protocol and found no problems. Fault analysis ● It seems that there is a problem with the line or network card. Hurry up the tester to test the network card to the wall module. The line found no problem, and then the module to switch line is normal. Is it a problem with the network card. Then the line is connected to another machine and found that the machine can go online. It seems that the network card has a problem. I immediately took a few NICs and started testing. I found that I couldn’t get it anymore. It’s strange. The NIC test is normal. No way, I can only take the machine to my office and start testing. Connect the Internet cable and set it up. IP, ping the gateway here, strangely passed, and the original network card is normal. It seems to be the performance problem of the line and network card! Solution ● find the original one Regardless of the workmanship and performance, the card is still an unknown small brand. Then look at the network card of the machine that can use the original line to connect to the Internet is 3COM, not to say it. Don’t give it a network card, Set the working mode of the network card to 10M full-duplex and 10M half-duplex, respectively, or try it, but there is no 3COM card at hand, and it is not possible to change a few other cards. It seems that the line has to be changed. The method has re-made a new line, which is shorter than the original one, and the quality is better than the original one. Trying the original card with a meticulous attitude, it still doesn't work. It is OK to change the other cards. It seems that the performance of the line is not very good! The final is to change the network card and network cable to solve this fault, it is really exhausted! Comments ● There should be someone who may be the problem of the switch port. In this case, the corresponding Switch port test is no problem, I think the CISCO3550 machine is not so easy to break it! In fact, it can be seen from this case that the quality of the network cable and network card is very important for the performance of the network. Not to mention The quality of the switch, below The case will also encounter the failure caused by the quality of the network equipment. Case 3 Failure phenomenon ● The customer calls to say that a machine is slow and often unreasonable. Put down the phone and prepare for it, go to the customer. Look at the machine is windows2000 System, network card, protocol and system have no problem. Ping the gateway and found that the packet loss is very serious. Fault analysis ● Asked the customer's network cabling situation, found that the line was recently re-routed, and then checked the switch, is A mid-range switch, the quality is not bad, and found no problems. It seems to be a problem with this line. First check the line sequence of the RJ45 interface at both ends, and found that it is not the line order of 568B/A standard. It seems The problem is here. Solution ● Don't say anything, re-do the two crystal heads according to the standard of 568B, measure it with a line gauge, and find that the lights are red, green, green, and messy, and the other lines are unreasonable. Is it that my line technology has dropped, it is possible. Then I re-do it or not, depressed and dead. Is it a problem in the middle of the line, there is no way to check the line, move the partition, turn Hang When I saw it, I found that this line was actually connected by two lines. The eight lines were still connected in a mess, and the line order was not right. I suddenly thought that the line order of the original two crystal heads was not the standard. It’s really exhausting the wiring of the big brother, and even the same can be adjusted (it is estimated to cost N crystal heads)! Although it was originally passed, it did not meet the requirements of 10M/100M. Old lost bag, the next thing is not my, the big brother is busy! Suggestion ● When you are building the network, be sure to find a slightly more regular wiring company, at least understand the wiring knowledge, or It is definitely not worth the candle! In this case, the wiring big brother does not even know what 10/100 Ethernet is, let alone what standards. The direct result of non-standard wiring is that the network performance is degraded a lot, and problems often occur. Four failure phenomenon ● The customer came to the phone to inform these days that the machine is very slow, and the mail can not be received. Restart the router can be normal for a while. Think about it, it should be caused by a virus. This customer's network structure is relatively simple and most Common .ADSL- By-switch-N PC, the entire network has a server as a domain controller and file server. The installed anti-virus software is Norton Enterprise Edition. The Norton client of the desktop is managed, and the notebook is not managed. Because it is common, it is listed as a case. It can be used as a reference for the maintenance of the network. Fault analysis ● The most recent virus is very embarrassing, the customer's fault is likely to be the network in the network poisoning after the non-stop to the network The device in the middle sends the data packet and causes the router to block. Solution ● After arriving at the customer, I found that the network has not been checked. I immediately log in to the router to see if there is any traffic, etc. The router is not bad. It can count the traffic and total traffic in each IP 10S. It is found that several machines are constantly sending large data packets, and the router has been blocked. It is necessary to record these IPs in turn, and then verify the specifics. The machine in the network should have Norton anti-virus software installed, but found that the C drive of several machines is full, resulting in Norton's virus database has not been upgraded for a long time, poisoning Deep! Quickly disconnect the network, then clean up the registry, junk files, start a full anti-virus! Other machines are security updates are not installed in time, although the virus database is the latest, but the anti-virus software is not cleaned up, of course, hurry to Update Then, by the way, I cleaned the switch and cleaned up the switch. I tossed it for an afternoon and finally got it. It was all tiring (no technical content ^_^ I am the most annoying)! Suggestion ● In such a small network In the environment, the most important job is nothing more than virus protection and system update. Be sure to keep the latest virus database and the latest security updates. This is generally not easy to go wrong. Usually you can also observe the router traffic monitoring, or install Sniffer to monitor traffic, you can also make certain restrictions on the router. If there is a problem in time, there will be no network failures! Case 5 Fault phenomenon ● Several colleagues report the network when the time is unreasonable, they are dying Try it quickly, ping your own gateway and start to lose packets. It seems that the machine is still sending packets in the network. This package is powerful enough, the network is not good. It is awkward. Fault analysis ● It seems that the main routing module is overwhelmed, but it still works, so the backup routing module can not take over, so the network is almost blocked. Because the entire network is divided into multiple VLANs, all VLANs The gateways are all on this routing module. It seems that the machines in a certain VLAN are constantly sending packets to the gateway, which causes the normal data of other VLANs to fail to receive the normal response of the routing module. Solution ● It seems to be checked first. Check which VLAN machine has a problem. There is no good way, sniffer can not boast VLAN (I still can not let him cross VLAN, which big brother knows how sniffer cross-VLAN detection, trouble tell me, thank you first!), Only one VLAN can be captured, this is really a tiring job. After checking N VLANs, I finally found that the data volume of two VLANs is particularly large, and most of them are broadcast packets, strange. Yes, after the test notebook receives one of the VLANs, the CPU utilization becomes 100%, and then the machine becomes slow and dead, like a crash, but once the network cable is unplugged, it returns to normal. The problem is out In this VLAN. Then check which port has the largest amount of port data in these two VLANs. Immediately turn off these ports and see that the network has started to work normally. Then of course, confirm these ports. Why is there such a large amount of data. Finding the corresponding room number and machine, several colleagues started to check these machines separately. There are several machines because they just reinstalled the system and have not updated the security patch, so it is Poisoned. When there is a port out is a small switch, and then received 10 machines, these 10 machines are the same phenomenon is cpu usage is 100%. Safe mode check the anti-virus software and The security update is normal, but it will not work in the normal mode, the slow can not move! There is no help, in the special network to post a message for help, some brothers said that there may be a loop in the network. Immediately check the small switch, It’s really a line with both ends connected, which led to the famous broadcast storm (I was the first to truly appreciate the power of the broadcast storm). After unplugging the line, the network recovered. Often. It was really killed by the brother who was plugged in! It is recommended ● Try not to let the end user touch the network equipment. In order to avoid the user's messy wiring and cause network failure! Postscript ● The fault occurred one month later. Failure, or a brother's messy wiring caused a broadcast storm, it is really depressed, it seems to strictly enforce the management system of computer equipment!