W2K loses network connection.

[Bob]

Hi, I have a W2K server running HTTP,Mail,FTP. It is all brand new hardware
and all updates and drivers are the latest.. I do not have any firewall
software on the server. Everything runs fine for a few days then all of a
sudden the sever loses connection to the network....as if the net cable was
unplugged. I find that if I disable the network connection and then enable
again it works again. Of coarse a reboot makes it work as well. There are no
errors in the event log...
I am lost, can this be a virus ? Or where can I start to troubleshoot ?
Thanks !

 

[Dave Patrick]

The files may be corrupt. Control Panel|Administrative Tools|Services|Event
Log Service|General, set the "Startup Type:" to "Disabled" restart the pc,
then delete (or move) the corrupt *.evt file(s) from
%systemroot%\system32\config then set the Event Log Service "Startup Type:"
back to "Automatic", restart for effect.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
<snip>
There are no
| errors in the event log...
<snip>

 

[Bob]

Thanks for the help Dave, the event log shows any other event or
errors/info.
I was just saying that when the server loses the network connection it must
not be a error that can be logged by the event logger. Maybe there is
another way to look at the logs of the LAN adapter ? The strange part to me
is that disabling the LAN and then enabling it (without rebooting) brings
the connection back up....
Any knowledge you have about such would be greatly appreciated !

 

[Dave Patrick]

When it happens try from a command prompt;

ipconfig /all

ping 127.0.0.1



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Thanks for the help Dave, the event log shows any other event or
| errors/info.
| I was just saying that when the server loses the network connection it
must
| not be a error that can be logged by the event logger. Maybe there is
| another way to look at the logs of the LAN adapter ? The strange part to
me
| is that disabling the LAN and then enabling it (without rebooting) brings
| the connection back up....
| Any knowledge you have about such would be greatly appreciated !

 

[Bob]

Hi again, I did a ipconfig /all , below are the results. The server IP
config is all static so I did not think this would change.
I can ping 127.0.0.1 and also can surf the local sites on the server. This
seems to happen at 3-4 in the AM and as I say there is nothing logged about
the reason. All I have to do to get it to work again is disable and
re-enable the LAN...Is there anything way to see what happened ? Can this be
a attack from the outside ?
Thanks

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : server
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010
P
Gigabit Ethernet Controller
Physical Address. . . . . . . . . : 00-15-F2-74-CF-20
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 208.181.100.240
Subnet Mask . . . . . . . . . . . : 255.255.255.0
IP Address. . . . . . . . . . . . : 208.181.100.253
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 208.181.100.254
DNS Servers . . . . . . . . . . . : 208.181.100.253
207.194.28.230

 

[Dave Patrick]

Is this result from when it doesn't work? Also from Device
Manager|Properties for the LAN adapter Power Management uncheck the box for
'Allow computer to turn off......"

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hi again, I did a ipconfig /all , below are the results. The server IP
| config is all static so I did not think this would change.
| I can ping 127.0.0.1 and also can surf the local sites on the server. This
| seems to happen at 3-4 in the AM and as I say there is nothing logged
about
| the reason. All I have to do to get it to work again is disable and
| re-enable the LAN...Is there anything way to see what happened ? Can this
be
| a attack from the outside ?
| Thanks
|
| Windows 2000 IP Configuration
|
| Host Name . . . . . . . . . . . . : server
| Primary DNS Suffix . . . . . . . :
| Node Type . . . . . . . . . . . . : Broadcast
| IP Routing Enabled. . . . . . . . : No
| WINS Proxy Enabled. . . . . . . . : No
|
| Ethernet adapter Local Area Connection:
|
| Connection-specific DNS Suffix . :
| Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010
| P
| Gigabit Ethernet Controller
| Physical Address. . . . . . . . . : 00-15-F2-74-CF-20
| DHCP Enabled. . . . . . . . . . . : No
| IP Address. . . . . . . . . . . . : 208.181.100.240
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| IP Address. . . . . . . . . . . . : 208.181.100.253
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| Default Gateway . . . . . . . . . : 208.181.100.254
| DNS Servers . . . . . . . . . . . : 208.181.100.253
| 207.194.28.230
|
| | > Hi, I have a W2K server running HTTP,Mail,FTP. It is all brand new
| > hardware and all updates and drivers are the latest.. I do not have any
| > firewall software on the server. Everything runs fine for a few days
then
| > all of a sudden the sever loses connection to the network....as if the
net
| > cable was unplugged. I find that if I disable the network connection and
| > then enable again it works again. Of coarse a reboot makes it work as
| > well. There are no errors in the event log...
| > I am lost, can this be a virus ? Or where can I start to troubleshoot ?
| > Thanks !
| >
|
|

 

[Bob]

Yes this is the result when it is not working.....not reachable from
anywhere on the network, nor will it surf anywhere but its own websites. I
have cleared the power checkbox..... Can this be a Winsock problem, proxy or
malware ?

Is this result from when it doesn't work? Also from Device
Manager|Properties for the LAN adapter Power Management uncheck the box
for
'Allow computer to turn off......"

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hi again, I did a ipconfig /all , below are the results. The server IP
| config is all static so I did not think this would change.
| I can ping 127.0.0.1 and also can surf the local sites on the server.
This
| seems to happen at 3-4 in the AM and as I say there is nothing logged
about
| the reason. All I have to do to get it to work again is disable and
| re-enable the LAN...Is there anything way to see what happened ? Can
this
be
| a attack from the outside ?
| Thanks
|
| Windows 2000 IP Configuration
|
| Host Name . . . . . . . . . . . . : server
| Primary DNS Suffix . . . . . . . :
| Node Type . . . . . . . . . . . . : Broadcast
| IP Routing Enabled. . . . . . . . : No
| WINS Proxy Enabled. . . . . . . . : No
|
| Ethernet adapter Local Area Connection:
|
| Connection-specific DNS Suffix . :
| Description . . . . . . . . . . . : Marvell Yukon
88E8001/8003/8010
| P
| Gigabit Ethernet Controller
| Physical Address. . . . . . . . . : 00-15-F2-74-CF-20
| DHCP Enabled. . . . . . . . . . . : No
| IP Address. . . . . . . . . . . . : 208.181.100.240
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| IP Address. . . . . . . . . . . . : 208.181.100.253
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| Default Gateway . . . . . . . . . : 208.181.100.254
| DNS Servers . . . . . . . . . . . : 208.181.100.253
| 207.194.28.230
|
| | > Hi, I have a W2K server running HTTP,Mail,FTP. It is all brand new
| > hardware and all updates and drivers are the latest.. I do not have
any
| > firewall software on the server. Everything runs fine for a few days
then
| > all of a sudden the sever loses connection to the network....as if the
net
| > cable was unplugged. I find that if I disable the network connection
and
| > then enable again it works again. Of coarse a reboot makes it work as
| > well. There are no errors in the event log...
| > I am lost, can this be a virus ? Or where can I start to troubleshoot
?
| > Thanks !
| >
|
|

 

[Bob]

I forgot to mention that when it is in this non working state , if I attempt
a reboot it can take up to 15 minutes to "Close Network Connections" Not
sure if this info is of any help or not......

Is this result from when it doesn't work? Also from Device
Manager|Properties for the LAN adapter Power Management uncheck the box
for
'Allow computer to turn off......"

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hi again, I did a ipconfig /all , below are the results. The server IP
| config is all static so I did not think this would change.
| I can ping 127.0.0.1 and also can surf the local sites on the server.
This
| seems to happen at 3-4 in the AM and as I say there is nothing logged
about
| the reason. All I have to do to get it to work again is disable and
| re-enable the LAN...Is there anything way to see what happened ? Can
this
be
| a attack from the outside ?
| Thanks
|
| Windows 2000 IP Configuration
|
| Host Name . . . . . . . . . . . . : server
| Primary DNS Suffix . . . . . . . :
| Node Type . . . . . . . . . . . . : Broadcast
| IP Routing Enabled. . . . . . . . : No
| WINS Proxy Enabled. . . . . . . . : No
|
| Ethernet adapter Local Area Connection:
|
| Connection-specific DNS Suffix . :
| Description . . . . . . . . . . . : Marvell Yukon
88E8001/8003/8010
| P
| Gigabit Ethernet Controller
| Physical Address. . . . . . . . . : 00-15-F2-74-CF-20
| DHCP Enabled. . . . . . . . . . . : No
| IP Address. . . . . . . . . . . . : 208.181.100.240
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| IP Address. . . . . . . . . . . . : 208.181.100.253
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| Default Gateway . . . . . . . . . : 208.181.100.254
| DNS Servers . . . . . . . . . . . : 208.181.100.253
| 207.194.28.230
|
| | > Hi, I have a W2K server running HTTP,Mail,FTP. It is all brand new
| > hardware and all updates and drivers are the latest.. I do not have
any
| > firewall software on the server. Everything runs fine for a few days
then
| > all of a sudden the sever loses connection to the network....as if the
net
| > cable was unplugged. I find that if I disable the network connection
and
| > then enable again it works again. Of coarse a reboot makes it work as
| > well. There are no errors in the event log...
| > I am lost, can this be a virus ? Or where can I start to troubleshoot
?
| > Thanks !
| >
|
|

 

[Dave Patrick]

Can you ping any other nodes on 208.181.100.xxx ? Ping gateway? DNS servers?

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I forgot to mention that when it is in this non working state , if I
attempt
| a reboot it can take up to 15 minutes to "Close Network Connections" Not
| sure if this info is of any help or not......

 

[Bob]

No, I cannot ping to or from that machine (no nodes)...only local machine
stuff works. As I say you would think someone has unhooked the NIC cable...

 

[Dave Patrick]

You might give this a go.

http://support.microsoft.com/?kbid=837333

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| No, I cannot ping to or from that machine (no nodes)...only local machine
| stuff works. As I say you would think someone has unhooked the NIC
cable...