Common Issues

Layer 2 Issues

First up, broadcast storms. On an Ethernet network, the messages will get sent out to devices based off of the MAC address, but there is that broadcast MAC address. The reason is because there are several messages that we want broadcasted out to all machines. For instance, ARP requests. If this machine is looking to communicate with a specific IP address, it needs to know the MAC address of that IP address, so what it will do is send out an ARP request. But it doesn't know specifically where to send it, so it will send it out as a broadcast and it will get broadcasted out to all devices.

However, what happens is that the more and more devices you have on the network, the more and more broadcasts that will happen at any given time, and this can be problematic. You can get to a point where you have an excessive amount of broadcasts that are happening on your network, and when that happens we could create a broadcast storm, which is when there are so many broadcasts happening on your network that the switch really doesn't have time to reply to anything else. It floods all of the ports out with these broadcasts and there isn't any room to be sending anything else out. So that's what a broadcast storm is.

Similar to broadcast storms, we could have multicast flooding. When we set up multicast, we want to have certain devices on the network respond to certain MAC addresses, and so what we do is configure the switch in order to set up multicasting to send specific traffic to these specific devices. But what happens is if you don't set this up correctly, then the messages that come to this group will be sent out to every device on the network. And if that's the case, then we have multicast flooding and we will unnecessarily flood multicast out to all of these devices.

Then we have frame errors and collisions. What happens with frame errors and collisions is if we have a hub here in the middle, or what's a little more applicable in today's time frame, an access point. Two devices can talk at the same time, causing a collision. If the amount of collisions becomes excessive, then it will overrun your network and you'll have some significant issues, and it'll bring most of your communication to just a stop almost. That's one reason why access points and wireless is not always the great method to use.

Another thing that can happen as well is maybe some of these connections have too long of wires, and so you've got attenuation that happens with this. Also, there might be some sort of power or something else that runs by these network cords that will cause interference. What will happen is that over time the signaling that happens on those lines will degrade to the point where the devices can't tell if it's a one or a zero. And then you'll have frame errors, and they'll have to be retransmitted. So that can cause problems on your network also if you have an excessive amount of frame errors or an excessive amount of collisions.

Next up we have loops and STP errors. What happens with this is sometimes we have a switch, maybe at a workstation or maybe as a workgroup somewhere out there, and we've got it plugged into a jack that goes back to your switch. And then what I've had is a janitor then plug in another port into the same switch. The problem that this causes is that when there is a broadcast that happens, it will be sent out this port, because it's sent out all ports. It'll get to this switch, and this switch will then resend it back to this switch right here, and then this switch will then forward it out once again because it's a broadcast, and it will just continue to do that. Just a few broadcasts will cause so much traffic on this switch that no other traffic will be able to start communicating on this network. So these loops can be really devastating on your layer 2 networks.

The thing that stops this is STP. We turn on spanning tree protocol, and spanning tree protocol is a way for this switch to identify when it's connected into another switch and shut off any redundant lines. Another thing is that sometimes you'll purposely set up maybe multiple equipment and you'll have all these connections, so that if one connection dies then it can still communicate. But the problem is the same thing: we can get these loops where things get broadcasted out. So we'll actually use STP to manage our networks, and so we can create these redundant links on our network. But the problem is that sometimes, if this is incorrectly configured or if there's some sort of errors with STP, then these issues can crop up again where you have these loops.

Then we can have an issue with duplicate MAC addresses. When a machine is sending to another machine, it's going to need to do it via MAC address. What happens is that this switch will learn what this machine's MAC address is by information that it sends out, and it'll put it into its MAC address table. And so it'll keep track of what port that's on. But if you have another machine, when it communicates it will toggle between these two ports that these two machines, these two interfaces, are on, and cause a problem. So sometimes you'll get packets to this machine and sometimes you'll get packets to this machine. So that's obviously a problem that can happen here with duplicate MAC addresses. And duplicate MAC addresses can happen because maybe it's cheap equipment that you're using and the manufacturer of that was just cranking out machines with the same MAC addresses. Or perhaps somebody went on to these machines and manually set up MAC addresses to respond to these Ethernet packets, and that can cause a problem as well.

Then you can also have incorrect VLAN settings. What VLANs do is segregate your switch into different sections. It almost makes this one single physical switch into multiple virtual switches. What can happen, though, is let's say these devices right here are all in the network, but this is plugged into maybe VLAN 10 here and these are both on VLAN 20. So even though you wanted these to be on the same network, they're actually on different networks, and so this can cause problems with devices not being able to communicate. So make sure that you program your VLANs correctly. I'll have a future course that will actually go over VLANs and how to program VLANs.

Layer 3 Settings

Now let's get into some layer 3 settings, some network settings. We know we need an IP address and a mask on this machine in order for this machine to communicate out to other devices, so these need to be configured, and we need to configure them correctly. If we configure these incorrectly, then they may not communicate as they should be communicating.

Another thing that can happen would be an incorrect gateway configured. If we can reach local resources but we can't reach other resources, and it's just this one machine and not other machines, then perhaps we've configured the gateway wrong on this machine. So that's another thing that we would look at.

Another thing that we could look at is the DNS settings. If we find that we can access any kind of resources, even out on the internet, from IP address, but when we try to access it via some sort of domain name we have issues with the domain name, then perhaps we have not configured DNS correctly or the DNS server is down. So that's another thing that we need to check to see and verify.

Another thing that I've had experience with problems with in the past is duplicate IP addresses. It used to be that Macs would hold on to their IP addresses longer than they should have, and so what would happen is those IP addresses would end up getting handed out to more than one machine. And whatever other machines got handed out that same IP address, then it would cause a duplicate IP address conflict on your network, and Windows would pop up with a little message that there's a duplicate address that's out there, even though it was the MAC address, the address of the MAC on there, that was causing the problem. So duplicate IP addresses can also be an issue.

Another thing that could be causing an issue is if there is some sort of missing route. For instance, let's say this device is trying to connect to a remote network and for some reason it's not able to do that. Well, perhaps this router is not aware of this network. Maybe it's statically assigned there, or maybe it's a dynamic routing protocol, but for some reason it's missing the route to get to this network.

Something else that can be problematic is asymmetric routing. What asymmetric routing is, is let's say this machine is trying to get to this machine, and packets that are flowing one way are coming across one connection and packets that are flowing another way are going across a different connection. Where this can be problematic is if you have something smart in there, like maybe some sort of firewall that's blocking some of this traffic. If it doesn't see some of this traffic going one way and log it correctly, then it can't allow the traffic to come back in. So that could be one of the problems as well.

On these networks, everything gets interconnected, and when one of these networks fails anywhere in between here, or a connection fails somewhere in between, it can cause problems too. It could be your device. It could be your device is not connecting correctly to the local area network, or it could be a connection on one of these others, or it could be not just the connection but the network itself goes down for some reason. So network and connection failures somewhere along the line can cause serious problems for your communication back and forth.

On a similar note, maybe it's not a network going down which is the problem, but maybe it's just suboptimal performance, that there is some sort of link that's struggling on your network. Perhaps one of these links just doesn't have the bandwidth that it needs to handle the traffic, so the traffic along this line is really underperforming, and the communication between these two devices is competing with being able to go across those lines. Or this can also happen: maybe these links right here are slower than these links right here. And so what happens if one of these links goes down is that it has to use that slower route to get over to this network, and so that could also create suboptimal performance.

Or maybe all of these devices are connected to each other. But as we talked about, there are dynamic routing protocols that will communicate back and forth between these devices so that these remote networks are discoverable. So this router right here discovers this network, this remote network right here. These dynamic routing protocols are important to be able to transfer this data. And if for some reason some of these routers don't see one of their neighbors, or get the wrong routing information, or it hasn't been updated yet and these different routers have different information on there during that time, and we call that convergence, during that time we could have communication errors on our network. So this dynamic routing protocol can cause some errors on our network, both flat out connectivity issues or maybe suboptimal performance.

Layer 4 Issues

Even layer 4 can have some issues. One of the big issues from a layer 4 perspective could be because of the firewall settings. A firewall on your network is designed to protect your network. So perhaps this network right here has a firewall that protects it from traffic, so certain traffic is not able to get to it. Typically what firewalls do is allow most traffic, or certain traffic, to get out, and then a response to that traffic to come back in, and then it blocks most other traffic from getting into your network. That way you have a certain amount of security with it, and that traffic will get blocked.

But the thing is, since it is blocking traffic, we could configure it incorrectly and cause a problem. Some of the things that we filter off of is IP address, or it could be off of a certain service, or it could be off of a certain port, and that will block traffic based off of that. So those are some of the settings we can take a look at.

Even the order in which we create ACLs makes a difference. We create a bunch of statements of what we're going to allow and what we're not going to allow, and even the order makes a difference in how it gets processed and whether certain traffic makes it through or doesn't make it through. So even the order is important. There's also an implicit deny anything at the end of it. That's for security reasons. So if all else fails, if it doesn't match any of these statements that you create for it, then it's going to drop the traffic. So just assume that if nothing is specified, it's going to drop the traffic, or you have to specify what is going to be able to get through on a firewall.

And then there are also something called wildcard masks, which operate similarly to masks but they're a little different. And sometimes those can be a little tricky to get right and to put onto these firewalls. So you look at that wildcard mask too, to make sure that these statements are correct. But firewall settings is one of those things that you do have to watch out for. Sometimes you have them on the machine as well as on the network, to protect your network and to protect your machine. And I've seen settings where those can be conflicting sometimes. And that's also one of the reasons why there's sometimes struggles with these firewall settings.

Besides just filtering off of the ports on these firewalls, the other things that we could see is uncommon protocols, and maybe those get stopped by a firewall, or maybe somewhere along the way something doesn't know how to handle those uncommon protocols. So perhaps we're having some sort of issue with uncommon protocols. Or somebody has set up a service with a non-standard port. So maybe this is a web server, and instead of port 80 maybe they set it up as port 8080. And we could see issues with that if traffic is getting blocked at a firewall and traffic can't get to that, or perhaps a machine is trying to connect to port 80 rather than port 8080 because it's not specified. So if we use non-standard ports, then we can also sometimes see issues crop up.

DHCP

Next up, DHCP. DHCP we're going to consider as part of the application layer, and that is that devices on your network need to get an IP address, so it can get it through dynamic host configuration protocol. But there are some things to watch out for. For instance, let's say there's another device on your network that also acts as a DHCP server, and it's a rogue DHCP server, which means it's not intended to be a DHCP server. In fact, I've actually set up a DHCP server on a network that I wasn't supposed to set it up on, and I caused some problems on that network. So you do see that happen occasionally.

There also is a scope to this. There is a range of IP addresses that it's handing out. You know, maybe you're handing out 250 different addresses on your network, but there is more than 250 devices on your network. And I ran into this issue at a college when I was managing their network, and that can be very problematic, and somehow you need to expand the scope of that. So that's the DHCP scope.