So in other words even if the problem is not that the server just can't
respond in time because it's too busy (as evidenced by the <10 ms pings
in between the dropped packets), the problem can still only appear when
there's a lot of traffic on the network?   Like, the switch freaks out when
it gets too busy or
something?    Do switches have fans?  Could it be that it gets too hot?

Naturally now all the additional tests are behaving, the only one dropping
stuff this afternoon is my desktop to my #2 server, which by the way is
where I am working.

I would be completely unsurprised to learn we have worms.  They have STILL
never put the laptops in their own DMZ as I recommended (with your
guidance) after we got hit by welchia last September.

Even the new IT director doesn't understand the difference between a worm
and a virus.  He was talking about making a DMZ for the box that's going to
be the IIS server for an intranet app we're implementing, and I asked if we
can put the laptops in a DMZ also and he said we have an antivirus server
and when I started explaining his eyes glazed over.  And this is a former
unix sysadmin. 


Actually I also shouldn't have been so flip about TJ before, 171 of my 453
users are there.

Tomorrow is gonna be interesting...  the first batch of employees start
logging on around 7, then it keeps building, maximum usage is between 12
and 4.

Well, left foot, right foot I guess.

> From: "Geo." 
> "Ellen K"  wrote in message
> news:909721.c696d0{at}harborwebs.com...
>> So hopefully this should isolate which thing is having the problem.  I hope
> it
>> shows up in the next couple of hours so we at least have a shot at a
>> replacement before tomorrow.  Today, just to be contrary, there haven't been
>> any dropped packets since 8:44 this morning.
> Sounds like a plan, but if it's something to do with traffic levels or
> broadcast traffic then you probably won't see it until some of the employees
> come in and start logging on.
>Another possibility that I haven't mentioned, one of the things that can cause
>a switch to reboot is spoofed traffic like what slammer worm generates. If you
> have an infected laptop or something with a bug that pings first
>(blaster/welchia) it could generate an arp flood, that might cause a switch to
> reboot as well.
> What I'm trying to say is if you find one of the 3548's is rebooting, that
>doesn't mean the switch is bad, it just means that's where you want to look fo
> the cause of the reboots.
> Geo.

--- BBBS/NT v4.01 Flag-5