Copy a File, Crash a Network

[Segnosaur]

We've been having some rather strange network problems where I work.

Its a small IT company (about a dozen users). We've got one main file server and authentication server.

For some reason, when one particular user copies files to the file server, it brings down the entire network. (Seems to be a problem with authentication.) If the user copies files to another machine, there's no problem. If other people copy files to the same server, there is no problem.

When we start to get problems, it can get very messy. At the bare minimum the file server has to be rebooted, although there have been times that it has messed up the network to such a degree that everything (all servers, network switches, etc.) had to be rebooted. I know there are a lot of things he could try (another user copies files with the same machine, the problem user copies files with another computer, etc.) However, given the problems that can result, our admin guy doesn't want to run too many tests.

I'm not the network administrator, so I'm only hearing about some of these problems second hand. Its not my job to fix it, but I thought it was a curious problem. Anyone ever encounter anything similar? (We're primarily a WindowsXP shop.)

 

[GreNME]

I've never heard of it, but I'm not convinced it's an authentication issue (yet), not without knowing more about the nature of the conditions. What OS are the user's computer and the file server? What type of authentication is being used-- bind, Active Directory, something else? How many hops between this user and the server in question? Do other users share the same switching as the problem user?

I'm sure I have more questions, but those came to me right off the bat. The problem could be anything from some software tied into Explorer being a problem to some switch with a bad port that ARP floods the network under certain conditions, or even a bad NIC on the user's computer.

 

[deep]

Make sure this person doesn't have a router/switch stashed somewhere, bridged to the corporate network.

 

[Ducky]

Spanning tree issue related to Deep's suggestion is my thought.

 

[rjh01]

What I would do is map the boundaries of the problem. Is it the way he copies the file? Or is it the userid that has an issue. Tests to perform to test these things.
1. Get him to do the copy using someone else's logon.
2. Someone else does the copy from his logon. (I assume everyone has their own userid?)

Results.
a. It does not matter who does it as long as it is from the logon then it is a problem with that logon. - Delete the logon and get the person a new one. Or find what is unique about that logon (like the profile).
b. The person does something slightly different. Find that out. Could be something as subtle as an irrelevant default setting.

Background logic.
Most problems can be solved by defining exactly what the problem is. You do that by simplifying the problem until all irrelevant information has been removed. For example in the above case you find out if it is the user or the logon that is the problem. Once this is done the solution is very simple. Like telling the user that he does not need to issue the command "Close network" as part of a copy.

 

[Segnosaur]

I've never heard of it, but I'm not convinced it's an authentication issue (yet)

Well, our network admin said it probably wasn't an authentication issue, its just the type of error that's being generated.

What OS are the user's computer and the file server? What type of authentication is being used-- bind, Active Directory, something else?

Computer is Windows XP. I think the sever is running Server 2003.

Not sure of the authentication used. (Like I said, its not something I'm directly involved in. Just thought it was a curious problem.)

How many hops between this user and the server in question? Do other users share the same switching as the problem user?

I think there's one router between the server and user computer, and it is shared.

I'm sure I have more questions, but those came to me right off the bat. The problem could be anything from some software tied into Explorer being a problem to some switch with a bad port that ARP floods the network under certain conditions, or even a bad NIC on the user's computer.

All of which are possible. (They will be doing a test with a different machine on the same segment tomorrow, which might shed a little more light on the problem. But like I said, they don't want to do too much testing because it can be a real hassle to reboot the network after. Probably just end up re-installing WinXP on the computer.

 

[Segnosaur]

What I would do is map the boundaries of the problem. Is it the way he copies the file? Or is it the userid that has an issue. Tests to perform to test these things.
1. Get him to do the copy using someone else's logon.
2. Someone else does the copy from his logon. (I assume everyone has their own userid?)

Yeah I had already suggested having someone do a copy from the same computer under a different user ID. Like I said though, when problems happen, it can wipe out the whole network, so our admin doesn't want to do too much testing.

Like I said, it was just a strange, curious problem.

 

[Ducky]

Once I was part of recovery for a 2 day network outage because someone plugged two ends of the same cable into ports on the same router.

Functionally, copying network traffic over with any number of network issues (most likely, however, someone with their own router or bad nic settings/router misconfiguration) can cause the same outage you describe.

Read up on:

http://en.wikipedia.org/wiki/Spanning_tree_protocol

http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00800951ac.shtml

 

[Dancing David]

Woosh, sounds frustrating.

Should be interesting to isolate.

Could they run a mock up that wouldn't crash the whole system, I know this is silly but say isolate the file server on the network? And then test it?

I know what our techs would do, throw it to the IT director and see what he says.

 

[Wudang]

Nothing in Event Viewer?

 

[GreNME]

Yeah I had already suggested having someone do a copy from the same computer under a different user ID. Like I said though, when problems happen, it can wipe out the whole network, so our admin doesn't want to do too much testing.

Like I said, it was just a strange, curious problem.

Whether your admin wants to do the testing or not, troubleshooting is troubleshooting. Unless there's an open port on the router that he can do a packet sniff on while testing the problem to see what's going on, then he's going to have to break it down to the most likely suspects and isolate them.

That said, I agree with Ducky (and deep).