server 2k3 box, network connection issue

[xSauronx]

Im a work study student at a cc and while Im usually decent at troubleshooting...this one is driving me and the admin nuts.

we have a ~6 year old hp rackmount server that, a couple of weeks ago, lost its network connectivity. it has:
1 builtin Gig NIC
1 add-on dual Gig NIC
they see the physical gigabit connection but have very minor packet sent/rcvd counts and we cant make it communicate in any way with anything else.

the cables on campus are crap...so i started by testing each one with a laptop to see if I could connect and ping through the gateway and such. cables are fine, the NICs differentiate between a FasteEthernet connection and a Gigabit connection...still no traffic

power-cycled the box, still no good

i did a netsh int ip reset, reconfigured the interfaces, and still nada

i reinstalled the NIC drivers for both adapters...still wont work.

the admin is about ready to rebuild the box,as he didnt set it up and doesnt really like the way it is configured, but its our BackupExec box...we kinda wanna use it again before we nuke it.

what else can I be looking at?

 

[ViviTheMage]

So it shows up as connected (not limited/no connectivity)? Can you ping anything on the domain/local? Try manually changing the flow...10/100/1000, 10/100 full/half, AUTO, see if any of that helps.

I haven't had any issues with that specific box, but that's something I would try.

 

[xSauronx]

yeah, shows a good connection. i forgot to mention that i did previously try manually setting duplex and speeds on the NICs and on the switch and that made no difference.

im ready to set the box on fire.

 

[ViviTheMage]

Yup, light it up ... haha. Try changing physical ports I assume? Do either of the NICS get activity beyond the small amount of packets?

Try a netstat -a see what it's connected to...if anything.

 

[xSauronx]

Yup, light it up ... haha. Try changing physical ports I assume? Do either of the NICS get activity beyond the small amount of packets?

Try a netstat -a see what it's connected to...if anything.

yeah i tried swapping around between the 3 interfaces on the box, and at fisrt even moved it to different ports on the switch (a 4507 that we havent had issues with)

its rebooting now...i dont remember telling it to do that, and i was already starting to think it *could* be a malware issues (though pretty much nobody ever touches the box) because ive seen malware cause network problems like this on desktop machines before.

 

[ViviTheMage]

IF you think it's maleware, run malewarebytes/spybot S&D.

It is very common for maleware to disrupt LAN/INTERNET connectivity like this, but i'd be surprised if the server actually got infected..if it did, might be something floating around on your network.

 

[xSauronx]

IF you think it's maleware, run malewarebytes/spybot S&D.

It is very common for maleware to disrupt LAN/INTERNET connectivity like this, but i'd be surprised if the server actually got infected..if it did, might be something floating around on your network.

yeah thats kinda what im worried about, too. everything here runs sophos and im not aware of anything massive floating around on the network....for whatever reason, this box has nothing protecting it (this place is...horrible)

edit: fwiw, netstat -a just showed local services, thats all.

 

[seepy83]

but i'd be surprised if the server actually got infected..

If it's a 6 year old box, and isn't properly maintained, I wouldn't be surprised at all...

 

[seepy83]

for whatever reason, this box has nothing protecting it (this place is...horrible)

I would put my money on some Admin getting slow Job Rates in BackupExec when the AntiVirus was installed, so he uninstalled it to solve his problem. I've seen someone do this before...he was my former boss...he is no longer employed here...

 

[ViviTheMage]

Job security

Run those scans yet? Yeah, NOTHING in netstat, outside of local services...not getting anywhere at all.

 

[Emulex]

why don't you boot up a live cd and see if you can config the nic's. alot easier to see error counts that way

freenas
openbsd
*linux

 

[xSauronx]

why don't you boot up a live cd and see if you can config the nic's. alot easier to see error counts that way

freenas
openbsd
*linux

i forgot to mention that i tried that, as well
it freaked out at the drive controllers and stopped booting, just sticking me with the initramfs prompt. the only thing i had was a xubuntu 8.10....which im pretty sure is still a good bit newer than that box.

 

[xSauronx]

mini update:
the network works in safe mode only
again, weve run antivirus and anti-spyware programs and are coming up with nothing. reloaded drivers and rebuilt tcp/ip stack etc.

i guess ill look at making a backup of the box and then trying a repair install of server 2k3. any other thoughts?

 

[Emulex]

assign nic1 to static ip a
assign nic2 to static ip b
use crossover cable
ping a to b
ping b to a

will resolve if it is a switch problem. if no crossover try a generic switch.

make sure its not an AD server before mucking around with the nic's. you will open up a whole can of worms.

 

[seepy83]

xSauronx,
In your original post you said that there are some send/receive packets in the NIC status, right? I would be curious to put Wireshark on the server and capture what's actually happening on the wire.

You said you tried reinstalling drivers for the NICs...how about Firmware?

Something just isn't adding up here, and I would probably do everything possible to avoid rebuilding the OS.

Have you checked the Application/System Event Viewer logs on the server? I would try to look for applications or windows updates being installed around the same time that the NIC stopped working. I'd also check the Service Control Manager events in the System Logs to see what Services might have entered the Running state around the same time the NIC stopped working, then go back in the logs and see if any of those Services never ran in the past.