Long and quite bizzare network problem

A

Adysthemic

Group,
I manage a 70 pc lan running win2k server ,win2k Citrix
server.Clients are mostly win2k with 10 or so XPpro boxes.Only 10 clients in
the remote location are using Citrix over a nailed T1.Main and Citrix server
are identical ,hardware wise
2gig ram, raid5,Xeons,Intel dual nics.Differ only in HD size.Main server is
perfect,no problems well ,actually, ever.Nary a red in eventid :>).Citrix
server has periods from one hour to several days intermittently,where any
application takes up to 180 seconds to open.Once open it functions somewhat
normally.The program we use through Citrix,works fine through ica client,the
users are not aware of the slowdown.Accessing the desktop directly, however
on the Citrix server will show the same slow down.I've tried disabling every
single service and it has no effect,except for TCP/IP Netbios helper.That
cures the problem.So does unplugging the network cable from the Citrix box
when I'm working on it.Neither solution obviously,is an acceptable
"fix".Task manager shows no undue processor use when opening progs.A packet
sniffer shows this server and the main server,even when no one else is
logged on as the "biggest talkers",but I'd expect that,nothing I can see is
obviously wrong or out of the ordinary.I'm running DNS static IP,although
someone told me to have DHCP service enabled even if you are not using
it.Enable/Disable has not effect.Do you suppose that Netbios needs something
it is not getting readily?Tried setting up a WINS and LM Host server/file
for possible name resolution problem!?.But this is all win2kDoesn't really
need that..It had no effect?I've stopped this server from participating in
MB elections,turned off every service ,to test.Nothing works.If I disable
TCP-IP Netbios helper,it fixes the problem but kills access to UNC and
security propagation on this server,then I cannot even log on to the Citrix
console.Any ideas from a computergod out there?This gets to me so much I'd
even spend my own money to resolve it,hehe.I called in a couple local
network
gurus and they had no ideas that I had not already tried.
1.Changed from 3com dual nic to Intel
2.Stopped server from MB elections
3.Stopped all non essential services,i.e. diskkeeper,NAV,etc.
4.Turned off Task Scheduler.
I have many other things I've tried ,just ask,if anyone needs to know.
I'm not putting the blame on Citrix at the moment,but I have I not found
Citrix to be all that trouble free in the past.Unfortunately,I have been
through the tedious time wasting license installation process,the printer
hassles etc. that I hesitate to try anything that will upset the
applecart.This is only effecting me at the moment but as we add
clients...I'd like to have everyone on Citrix as it would greatly simplify
all the updates we have to the software we are using.I'm just too gunshy at
the moment to trust Citrix.It stopped functioning altogether one morning and
they would not even speak to me w/out a 400 dollar hit on the company CC.The
"soultion" was to reinstall erm duh.Most of the time was spent re-licensing
while all the remote clients were waiting.Not something I'd want to rely
on,ya know?
Helllppp!?,Adysthemic

Followup...



After a year and one half of thinking about this Citrix server problem
slowdown almost everday,I've discovered a breakthrough.I d/l ed this little
proggie a very long time ago,and only decided to play w/it this morning.It
is called tcpView.Don't know why I tried it.I already had a big ol powerful
packet sniffer to look at.
But honestly,although I understood how to use the sniffer on a basic
level,it did not
present things in the visual way I needed.

With tcpv running,I opened a prog on the Citrix server.After 90 seconds the
prog opened.Watching the tcpv program,I saw that microsoft-ds sent a SYN
packet to one specific computer,Admin3, on the network.

The metaframe server is expecting that one box to ACK back,but it does
not,if it is not on line,so any program that you try to open will wait for
that ACK response,that does not come.It will wait until the ACK
times out, then the program will open.

This does not seem to be program specific.As a standard I test open event
viewer.But anything from ms office, to my packet sniffer to whatever ,will
cause the Citrix server to send a SYN packet to Admin3,and hang opening
untill the expected
ACK response times out,unless Admin3 is online!!???Any computergods out
there have even a remote suggestion why this is occuring?

This behaviour of the Admin3 response illustrated why I never had a problem
on Tuesdays.Sheesh Tuesday was a day I had Admin3 left on overnight for a
backup to CDR,so the Citrix server always worked fine on
Tues.Mornings as it was available to quickly ACK the SYN packet.(geez no I'm
NOT stoned :>P).This was what was causing a semi patterned appearance of the
symptom.
If Admin3 was online,the slowdown on the Citrix server, opening any program,
does not occur.
So why is the Citrix server "obsessed" with sending a SYN packet to
Admin3,whether or not it is online ,expecting an ACK,before it "lets" any
program open??!!Oh BTW,this seems to all be based on microsoft-ds and ms
netbios ssn.The SYN originates on some port in the 4000 range,I forget at
the moment.I think the ACK is expected
from 445, having something to do with the Server Message Block [SMB]
according to the Packet Sniffer,but I ain't too swift in my interpretations
with that packetsniffer tool yet.Please,please can anyone gimme a clue about
all this?I'm self taught and cannot find anything after 9hrs of hunting
today.This has been my bane for a very long time,I think of it everyday,tnx
Adysthemic
 
S

serverguy

One thing you have failed to mention is what type of network this is. W2K
Domain? Is Admin3 the master browser on the network? Usually there will be
lots of event log errors when the master browser is offline. But this could
be why the packets are going to it. There must be at least one master
browser on each subnet for dns to work properly. You can disable the master
browser on Admin3 via registry settings, suggest you do some reading on this
first so you understand it.
If you do it, another computer will take over as master browser and you
could run into the same problem. So, you could disable the master browser
setting on all computers except for the main server (which should be online
most of the time), and hopefully that will stop the timing out delay.

Of course, this is all speculation, but it wouldn't hurt to check it out.

Adysthemic said:
Group,
I manage a 70 pc lan running win2k server ,win2k Citrix
server.Clients are mostly win2k with 10 or so XPpro boxes.Only 10 clients in
the remote location are using Citrix over a nailed T1.Main and Citrix server
are identical ,hardware wise
2gig ram, raid5,Xeons,Intel dual nics.Differ only in HD size.Main server is
perfect,no problems well ,actually, ever.Nary a red in eventid :>).Citrix
server has periods from one hour to several days intermittently,where any
application takes up to 180 seconds to open.Once open it functions somewhat
normally.The program we use through Citrix,works fine through ica client,the
users are not aware of the slowdown.Accessing the desktop directly, however
on the Citrix server will show the same slow down.I've tried disabling every
single service and it has no effect,except for TCP/IP Netbios helper.That
cures the problem.So does unplugging the network cable from the Citrix box
when I'm working on it.Neither solution obviously,is an acceptable
"fix".Task manager shows no undue processor use when opening progs.A packet
sniffer shows this server and the main server,even when no one else is
logged on as the "biggest talkers",but I'd expect that,nothing I can see is
obviously wrong or out of the ordinary.I'm running DNS static IP,although
someone told me to have DHCP service enabled even if you are not using
it.Enable/Disable has not effect.Do you suppose that Netbios needs something
it is not getting readily?Tried setting up a WINS and LM Host server/file
for possible name resolution problem!?.But this is all win2kDoesn't really
need that..It had no effect?I've stopped this server from participating in
MB elections,turned off every service ,to test.Nothing works.If I disable
TCP-IP Netbios helper,it fixes the problem but kills access to UNC and
security propagation on this server,then I cannot even log on to the Citrix
console.Any ideas from a computergod out there?This gets to me so much I'd
even spend my own money to resolve it,hehe.I called in a couple local
network
gurus and they had no ideas that I had not already tried.
1.Changed from 3com dual nic to Intel
2.Stopped server from MB elections
3.Stopped all non essential services,i.e. diskkeeper,NAV,etc.
4.Turned off Task Scheduler.
I have many other things I've tried ,just ask,if anyone needs to know.
I'm not putting the blame on Citrix at the moment,but I have I not found
Citrix to be all that trouble free in the past.Unfortunately,I have been
through the tedious time wasting license installation process,the printer
hassles etc. that I hesitate to try anything that will upset the
applecart.This is only effecting me at the moment but as we add
clients...I'd like to have everyone on Citrix as it would greatly simplify
all the updates we have to the software we are using.I'm just too gunshy at
the moment to trust Citrix.It stopped functioning altogether one morning and
they would not even speak to me w/out a 400 dollar hit on the company CC.The
"soultion" was to reinstall erm duh.Most of the time was spent re-licensing
while all the remote clients were waiting.Not something I'd want to rely
on,ya know?
Helllppp!?,Adysthemic

Followup...



After a year and one half of thinking about this Citrix server problem
slowdown almost everday,I've discovered a breakthrough.I d/l ed this little
proggie a very long time ago,and only decided to play w/it this morning.It
is called tcpView.Don't know why I tried it.I already had a big ol powerful
packet sniffer to look at.
But honestly,although I understood how to use the sniffer on a basic
level,it did not
present things in the visual way I needed.

With tcpv running,I opened a prog on the Citrix server.After 90 seconds the
prog opened.Watching the tcpv program,I saw that microsoft-ds sent a SYN
packet to one specific computer,Admin3, on the network.

The metaframe server is expecting that one box to ACK back,but it does
not,if it is not on line,so any program that you try to open will wait for
that ACK response,that does not come.It will wait until the ACK
times out, then the program will open.

This does not seem to be program specific.As a standard I test open event
viewer.But anything from ms office, to my packet sniffer to whatever ,will
cause the Citrix server to send a SYN packet to Admin3,and hang opening
untill the expected
ACK response times out,unless Admin3 is online!!???Any computergods out
there have even a remote suggestion why this is occuring?

This behaviour of the Admin3 response illustrated why I never had a problem
on Tuesdays.Sheesh Tuesday was a day I had Admin3 left on overnight for a
backup to CDR,so the Citrix server always worked fine on
Tues.Mornings as it was available to quickly ACK the SYN packet.(geez no I'm
NOT stoned :>P).This was what was causing a semi patterned appearance of the
symptom.
If Admin3 was online,the slowdown on the Citrix server, opening any program,
does not occur.
So why is the Citrix server "obsessed" with sending a SYN packet to
Admin3,whether or not it is online ,expecting an ACK,before it "lets" any
program open??!!Oh BTW,this seems to all be based on microsoft-ds and ms
netbios ssn.The SYN originates on some port in the 4000 range,I forget at
the moment.I think the ACK is expected
from 445, having something to do with the Server Message Block [SMB]
according to the Packet Sniffer,but I ain't too swift in my interpretations
with that packetsniffer tool yet.Please,please can anyone gimme a clue about
all this?I'm self taught and cannot find anything after 9hrs of hunting
today.This has been my bane for a very long time,I think of it everyday,tnx
Adysthemic
 
A

Adysthemic

serverguy said:
One thing you have failed to mention is what type of network this is. W2K
Domain? Is Admin3 the master browser on the network? Usually there will be
lots of event log errors when the master browser is offline. But this could
be why the packets are going to it. There must be at least one master
browser on each subnet for dns to work properly. You can disable the master
browser on Admin3 via registry settings, suggest you do some reading on this
first so you understand it.
If you do it, another computer will take over as master browser and you
could run into the same problem. So, you could disable the master browser
setting on all computers except for the main server (which should be online
most of the time), and hopefully that will stop the timing out delay.

Of course, this is all speculation, but it wouldn't hurt to check it out.
serverguy,
Yes it is a win2k domain.There has been nothing in the event
logs to indicate a problem,on either MF server or it's"obsession" Admin3.I
used browsermon and Admin3 is not a master browser.MF server is a member
server not the DC.This connection it needs to establish with Admin3 seems to
have something to do with SMB.This is so curious,that even though the
original problem is managed now,I'd give a nut to find out what's causing
it.Perhaps their in love,said one of the exec.secretaries,heh.If admin3 dies
I'll live with this problem forever,LOL,Adysthemic
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Multi forest and Citrix farm 1
Sniffer Output 1
Excel VBA in Citrix. 0
Citrix Deployment of Access 2007 Front End 0
VPN mtu problem 2
Word Word Print Macro in Citrix 0
OLE Server Error 1
RDP for Beginner how to start 2

Top