Re: Cisco 6509 Issues - Page 2

tmelino01 · ‎10-04-2013

I have a quick question or not so quick. We have been having network issues for the past week or so. This all started around the time we had an attack from a hacker which overwhelmed our catylist ( Cisco 6509 ) with a suprevisor 720. We have one IT person on the staff and we subcontract through another IT company. Neither of them seem to be able to figure it out. We have ~75 machines that can download data from the outside ( ~3 Mb/s ). Then we have ~50 machines that start to download OK ( ~3 Mb/s ) but then drop to speeds of 10 kb/s then just hang at that speed forever. Both sets of machines also have the same external IP address. This problem seems to only occur when connecting with one or two servers on the outside (http://nomads.ncep.noaa.gov). It seems to be that they are being throttled in some way but the provider insists that they are not throttling us and have checked. I believe them since some internal machines work. Does it make sense for the issue to be with the server that we are connecting to since some machines work and others don't? I have also contacted the ISP (TW Telecom) who checked the paths and said everything seemed to be ok on their end. Do you have any ideas what could cause something like this? It really doesn't make much sense at this point. Is it possible some unseen switch got thrown on the Catalyst that we can't see when it is being overwhelmed to save the network? and how would we correct it if it did?

Thanks in Advance!!!

Tim

james.doukas · ‎10-07-2013

Ok. So the issue seems to be with certain servers using wget to a specific web site only on your internal network. Do you have logging enabled for wget? Are you doing recursive type gets? I'm not a wget expert but perhaps the issue lies in wget itself. Since you switched the process from the original servers to a temporary server to keep the jobs going, the issue really appears to be server or server app related.

One easy test to eliminate the network would be to do the http job on the problem server to the problem destination and at the same time do an http download from another site that doesn't cause you issues. This is more "eliminating" what it isn't versus tackling the actual problem. However, it can help narrow your focus down.

tmelino01 · ‎10-07-2013

I tested the same machine with the usuall results the test file is ok while the real file slows down to 5k.

# Test File Works Fine

wget http://ipv4.download.thinkbroadband.com/20MB.zip

--2013-10-07 13:38:46-- http://ipv4.download.thinkbroadband.com/20MB.zip

Resolving ipv4.download.thinkbroadband.com (ipv4.download.thinkbroadband.com)... 80.249.99.148

Connecting to ipv4.download.thinkbroadband.com (ipv4.download.thinkbroadband.com)|80.249.99.148|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 20971520 (20M) [application/zip]

Saving to: ‘20MB.zip’

100%[==========================================================================================================================================================================>] 20,971,520 2.74MB/s in 13s

2013-10-07 13:38:59 (1.59 MB/s) - ‘20MB.zip’ saved [20971520/20971520]

# Real File Broken

wget --timeout=60 "http://140.90.101.6/cgi-bin/filter_nam.pl?file=nam.t00z.awphys00.grb2.tm00&all_lev=on&leftlon=0&rightlon=360&toplat=90&bottomlat=-90&dir=%2Fnam.20130930"

--2013-10-07 13:39:42-- http://140.90.101.6/cgi-bin/filter_nam.pl?file=nam.t00z.awphys00.grb2.tm00&all_lev=on&leftlon=0&rightlon=360&toplat=90&bottomlat=-90&dir=%2Fnam.20130930

Connecting to 140.90.101.6:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: unspecified [application/octet-stream]

Saving to: ‘filter_nam.pl?file=nam.t00z.awphys00.grb2.tm00&all_lev=on&leftlon=0&rightlon=360&toplat=90&bottomlat=-90&dir=%2Fnam.20130930.1’

[ <=> ] 5,647,087 5.64KB/s

james.doukas · ‎10-07-2013

Regardless of the fact that it worked in the past, I would Google wget and cgi-bin. I saw some info on wget and having issues with cgi-bin. I'm not saying this is the issue, but you might want to check it out.