Server NIC issue

Uberwilhelm · Post by **Uberwilhelm** » Tue May 19, 2009 10:52 am

Howdy everyone.

I have a very odd issue with one of my servers that is making me want to bang my head on a wall. I installed a brand new Intel Pro 100 PT and the most current drivers. What is happening is that every three days, almost like clockwork, the NIC starts dropping packets and connection and response times go to almost 1000 MSs. I reboot the server and it is fine for another three days or so. Now here is the odd part. I was having the exact same issue with one of the on board Broadcom BCM5708C NetXtreme II (Dell 2950 server) so I installed the new NIC. What is happening?! Many thanks for any help.

Post by **YeOldeStonecat** » Tue May 19, 2009 11:03 am

Yeah most servers that come with those Broadcom integrated NICs...I also option for a real Intel NIC, and disable the Broadcom. Can't stand 'em. Lotta issues with Windows server.

First...uninstall drivers for the Broadcom, and then disable it in the BIOS.

Is this server a DC?

If it's still having issues with the Intel....what is it plugged into? Check the patch cable(s)..and whatever else is along the line leading to a switch/router or whatever.

Might be some autonegotiation issues between the NIC and the switch it's plugged into, have you tried hard locking the speed?

I have had a similar issue with a PowerEdge that had a gigabit NIC..and an SMC switch that the client had, also some Linksys SRW switches with gigaports. Simlar to you, it would flake out if left at auto detect and it settled at a gig. Had to leave it at hard locking the NIC at 100. Problem went away when I put some nice HP ProCurves at that clients site....they sing happily at auto 1 gig all day long.

Uberwilhelm · Post by **Uberwilhelm** » Tue May 19, 2009 1:15 pm

Hiya Cat.

I have tried all of the basics. Cable change, port change, ect. but same issue. Server isn't a DC and I haven't uninstalled the broadcom so I will try that. The server goes into our HP Procurve 5406zl core switch and it currently set to auto, so maybe I will try and hard code it to 1000/full. Thanks for the hints. I will post the results.

Post by **YeOldeStonecat** » Tue May 19, 2009 2:21 pm

Well I'd probably rule out the switch....that Procurve isn't some el cheapo!...nice switch.

Does that cable happen to run across anything? Flourescent lighting? Anything?

Scratching my head here...
Antivirus on the server? What does this server do? Any part of it sticking out from behind the protection of a firewall? Or a history of having been outside a firewall?

Uberwilhelm · Post by **Uberwilhelm** » Tue May 19, 2009 3:39 pm

YeOldeStonecat wrote:Well I'd probably rule out the switch....that Procurve isn't some el cheapo!...nice switch.

Does that cable happen to run across anything? Flourescent lighting? Anything?

Scratching my head here...
Antivirus on the server? What does this server do? Any part of it sticking out from behind the protection of a firewall? Or a history of having been outside a firewall?

I tell ya, it's really a mystery. It's a Lotus Notes (yeah yeah I know) server and has been trouble free for years. Now all of a sudden this problem pops up. That's why I thought it might be just a bad NIC and replaced it. The cable is clean, just goes right from one rack to another next to each other. I have a second NIC on the DMZ, but that one is working fine. My gut is telling me it's the switch, but I just don't know.

Uberwilhelm · Post by **Uberwilhelm** » Mon Jun 01, 2009 12:04 pm

Some updates:

Set core and NIC to 1000-auto (full isn't an option) and still happening. I did notice something in the system log though that is very odd and seems to get worse as the NIC gets worse. I see an information entry of "The PsExec service was successfully sent a stop control." Event 7035 and the User is our Domain Admin account that no one has the pwrd to except me and one other person and it is a very complex one. I see hundreds of these entries. I will admit I don't know much about this tool at all and when I did some research on it, I can't find anything that would indicate why it is being accessed at all. Any ideas?

twwabw · Post by **twwabw** » Mon Jun 01, 2009 5:49 pm

Have you tried disabling the TCP/IP offload engine (TOE)? I've had toe cause some real issues, with things like 100baseT client crawling, etc. It's a simple command to turn it on and off. From a command line:

Turn TOE Off-

netsh int ip set chimney DISABLED

Turn TOE back on-

netsh int ip set chimney ENABLED

Uberwilhelm · Post by **Uberwilhelm** » Tue Jun 02, 2009 10:08 am

twwabw wrote:Have you tried disabling the TCP/IP offload engine (TOE)? I've had toe cause some real issues, with things like 100baseT client crawling, etc. It's a simple command to turn it on and off. From a command line:

Turn TOE Off-

netsh int ip set chimney DISABLED

Turn TOE back on-

netsh int ip set chimney ENABLED

Disabled it and pulled the little dongle on the motherboard a while ago.