LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 01-03-2011, 03:50 AM   #1
Little.Devil
LQ Newbie
 
Registered: Sep 2007
Posts: 1

Rep: Reputation: 0
Question RHEL Server is Broadcasting on LAN and Choking the Network


I have a RHEL 5 Server dedicated to web hosting. HTTPD 2.2.x.x is running on it with PHP and MySQL. The machine is not a server system (hardware wise, a C2D 2.66 with 2GB RAM and 2 x NICs).

I have a CIR Fiber link with a pool of live IPs. The machines including this web server is plugged into a switch which has all the live interfaces and is separate from the LAN switches.

The problem i am facing is that, when ever this web server is plugged in, the traffic on live switch is choked. Internet slows down to a halt (as live interface of proxy is plugged in this switch. DNS stops resolving name due to time outs. Mail delivery is slowed and the mail ques pile ups. The moment i get this machine of the switch, all the traffic becomes normal. Therefore i have deduced that this is the faulty server. I do not know if this server is hacked and working as a bot or it is a mere hardware problem(faulty LAN Card).

A guidance towards the identification and resolution of this problem is requested from all the members.

I have put my server offline. I can do that for long, or the management may want to shift to windows server. I hate windows, please tell me what to do.
 
Old 01-03-2011, 04:05 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,396

Rep: Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963
Well you need to see wht the traffic is, don't you? use a tool like tcpdump or wireshark to capture some of the traffic leaving its nic and see what it is.
 
Old 01-03-2011, 04:33 AM   #3
ilikejam
Senior Member
 
Registered: Aug 2003
Location: Glasgow
Distribution: Fedora / Solaris
Posts: 3,109

Rep: Reputation: 96
Sounds like a switching loop to me. I'd break out tcpdump/wireshark as above and look for lots of broadcast traffic.

Dave
 
Old 01-03-2011, 10:52 AM   #4
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 3,141
Blog Entries: 1

Rep: Reputation: 1001Reputation: 1001Reputation: 1001Reputation: 1001Reputation: 1001Reputation: 1001Reputation: 1001Reputation: 1001
Put it on a spare switch along with your laptop.

See if the problem persists (ie, bandwidth bottleneck)

Change the NIC in the machine, try again.

If it still persists, then you will have to look at the configuration of the machine. Make sure that IP6 is disabled (as long as you are not using it), then check the traffic again.

in short, With what little info you have given, I would guess that it is a bad NIC or a box that is configured with IP6 still.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Broadcasting Messages Across a Network Woodsman Slackware 21 03-25-2010 10:34 PM
Avoiding Cups from broadcasting outside the lan maginotjr Linux - Software 1 07-15-2008 12:51 PM
MP3 Format is NOT broadcasting on server evotux Fedora 1 02-03-2006 04:15 PM
Broadcasting Server Messages to the network. mikeyt_333 General 3 06-13-2002 07:55 AM


All times are GMT -5. The time now is 06:36 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration