🚀 go-pugleaf

We have a largish NetWare installation here at Warwick (40+ servers, 2000+
client workstations, 15000+ users) running predominantly on NetWare 3.12
with the full flavour :-) of client requesters and redirectors.  Runs just
fine most of the time as we've come to expect from NetWare 3.12.

Couple of weeks back we started to get reports of spurious and, it seemed,
quite random dropped connections across multiple servers and a mixed bag of
clients.  No changes had been made to the servers as far as we were
concerned, so we pointed fingers accusingly at the network.  We had started
looking in all the likely (but as usual, wrong) directions when we were
overtaken by quite a serious malfunction on our FDDI ring which took a few
days to repair.  As most of the servers are on FDDI I thought ah-ha!  But
no, the seemingly arbitrary connection losses continued after the network
had been restored to its former glory.  

We sniffed and snorted packets and started to notice that most of the
suffering clients weren't actually doing very much when they fell off, just
the odd request now and again, and the servers were actually telling the
client in the Connection status flags that the Request contained a bad
service connection - drop off time.  The only other packets around the
client at the time were type 20 IPX broadcasts.  Dratted NT / '95 machines
we thought, and then some bright spark remembered that a nasty '95 machine
had reared it's ugly head with NWSERVER SAP advertising on (a big NO NO)
just around the same time we started losing connections, and had been
promptly SAP filtered.

We terminated the offending '95er's packets at the mac level with extreme
prejudice and lo and behold, the connection lost problem appeared to go away
bigstyle.

We're currently at the post-mortem stage which may take some time as the
rogue machine(s) is somewhat out of our jurisdiction, but it would appear
that something that this particular Windows '95 machine was doing in the IPX
arena was interfering with established NetWare clients.  The many other '95
and NT machines around on campus do not seem to exhibit the same behaviour.

Of course, it may be that we are completely wrong about all this and the
problem may be due to something entirely different, or as a result of our
filtering (for example), so if anyone has an explanation or information
which may be of use I'd very much appreciate it.

Thanks in advance,

Cheers

Dave
-- 
Dave Williamson, Computing Services, Warwick University, Coventry CV4 7AL, UK
INET:	cuden@warwick.ac.uk		JANET:	cuden@uk.ac.warwick
Phone:	+44 203 523059			Fax:	+44 203 523267