Kimden:                          Sinan Bedir <sinan.bedir@simet.com.tr>

Gönderme Tarihi:           17 Mart 2016 Perşembe 16:45

Kime:                               teknik@simet.com.tr

Konu:                              FW: smc gs10c port isolation problem

Ekler:                               Capture.JPG; Capture2.JPG; config.xml

 

 

 

 

 

Dear Andy,

 

Please help to verify at SMCGS10C-Smart and follow up with Emre.

 

Thanks.

 

 

 

Hi Ahbee,

Software version is SMCGS10C-Smart (standalone) Version 1.0.1.2. I am sending a backup of the configuration and the attached screenshot. Another version SMCGS10C-Smart-Fw_v1.0.1.0, when we try, it didn’t work. I know still ping other computers.

 

Best Regards,

 

 

Dear Emre,

 

Please provide your settings and your SMCGS10C software version to me.

 

I test at my unit and it work correctly. Thanks.

 

 

 

Hi,

 

Ok. We will try but in SMCGS10C has same feature about port isolation. When we use, didn’t work. Please check this feature at 10C

 

Best Regards,

 

 

Dear Emre,

 

The software based is not same between SMCGS10C and SMCGS50C, please try to using SMCGS18/26/50C to do testing as they are using same software based.

 

For SMCGS10C issue you mentioned, I need to do a testing to confirm it.

 

Thanks.

 

 

 

Hi,

 

We use SMCGS10C and try port isolation. Mark port 1 and 2. Check and we can’t isolate two ports. Ping can be taken from one port and the other is access. It isn’t work.

When you found the SMCGS50C CPU load is 100%, there is not abnormal behavior on the switch.
After arp inspection configurations working system stable about one day. Not on any locked.

 

Best Regards,

 

 

Dear Emre,

 

You just need check the port number that want to isolate, with below example, port 1~46 can’t  communicate with each other, only available communicate with port 47~50.

 

So the configuration is simple, if the port is connect to gateway or uplink port, then don’t check it, otherwise check the port isolation to isolate the port.

 

Besides, when you found the SMCGS50C CPU load is 100%, did you found any abnormal behavior on the switch?

 

If possible please help to capture the packets again when the switch is really in the high CPU load.

 

Thanks.

 

 

 

Hi Ahbee,

 

We enabled arp inspection in the 0.8 IP and 0.11 IP switches. And then we watch the cpu information. I am sending screenshots in the appendix. Sometimes a hundred percent.

 

192.168.0.4 CPU Load utilization always very high
192.168.0.8 CPU Load utilization sometimes very high (sometimes a hundred percent.)
192.168.0.11 CPU Load utilization sometimes very high (sometimes a hundred percent.)

 

In addiction, we will ask a question. We want to isolate ports. We look the user manuel. In Port Isolation Configuration menü, we mark the ports which are to be isolated from each other. But for example, port number 48 is gateway. We mark port number 1 and 2. So port 1 and 2 are isolated. And they isolated from gateway. Is there any problem in here? So we want to get all isolated ports. But we just want to get access to other ports, you access the gateway. How do we do this?

 

Best regards,

 

 

Dear Emre,

 

I had try to inject to packets back to the switch, but seem the switch work fine.

 

But I found almost 44% packets is the ARP packets that the captured files that you send to me.

 

As you mentioned there found some users using netcut in the network, netcut will continue send out the false arp to the network, that will cause the user not available to reach to the gateway.

 

I will suggest you enabled the arp inspection in the switch.(Please check enclosed example I write before)

 

So, now need to clarify the switch locked is cause by the netcut or some specific traffic.

 

If you remember last email I mentioned when I remote login to the switch, I only found 192.168.0.4 the cpu load constant very high, but the packets captured from you is at the switch 192.168.0.8,

 

Just double confirm with you, when you captured the traffic, did you found the 192.168.0.8 cpu load becomes very high? Just want to know the taffic you captured really possible will cause the CPU load high or not.

192.168.0.4 CPU Load utilization always very high
192.168.0.8 CPU Load utilization always very low
192.168.0.11 CPU Load utilization always very low

 

Thanks.

 

 

 

Hi,

ESET antivirus programs on computers connected to the locked port is installed. One was found to be a network setup program called Netcut in some users.

 

Best Regards,

 

 

Dear Emre,

 

Not very understand, could you explain more details?

 

 

 

Hi,

 

In addiction, Problems experienced in computer information that came installed ESET programs and The program is Netcut.

 

Best Regards,

 

 

Hi,

 

I am sending debug result of the addition. After a while I open ports on the switch closing locks. This is an unusual situation. This situation was too much trouble.

We applied procedure. But the switch still locked. I'm sending the file of wireshark in the link.

https://drive.google.com/file/d/0B0PXSQ07cu8sU0RodmhkSElsTjA/view?usp=sharing

 

 

 

=============================================================================
Notice : When you reply this email, please add the PTR No. into your mail content for tracing
PTR No. : 17-2015-11-09
Open Date : 11/9/2015 4:07:09 PM
Subject : smc gs50c problem
Model No : SMCGS50C-Smart
Customer Type :
=============================================================================

Dear Emre and Fikret,

Any update?

Thanks.

Best regards
Ahbee Wai

11/11/2015 5:34:31 PM Send Reply To Customer / ahbee_wai

Dear Emre and Fikret,

I summary the information:
1. Monday I had login to the switch and check the status.
192.168.0.4 CPU Load utilization always very high
192.168.0.8 CPU Load utilization always very low
192.168.0.11 CPU Load utilization always very low




Seem the symptom not occurs at every SMCGS50C-Smart.
Please provide any information to me if you can figure out what the different between the switch, why the symptom is different.

2. Check the debug syslog message
Using below command to check any debug message or not, and copy the debug syslog to me
>debug syslog show


Then using below command to erase the debug syslog, wait several hours and check any new debug syslog or not, then copy to me too,
>debug syslog erase
Deleting syslog from flash...Done!

3. I still doubt possible some kind traffic cause the symptom, please help to setup a PC to capture the traffic on the switch.

Procedure:
1. you set the port that connect to network or device as source port and set to both, for example port 1,2,3
2. the pc that install wireshark and connect to the switch for capture traffic need to set to destination, for example port 4
3. enabled the type as mirror mode and save
4. Port set to mirror destination port can't access to the switch, if you want to configure the switch, you may need connect to others port that did not set to destination.
5. please collect the traffic at the switch always high cpu load utilization, such as 192.168.0,4, at least 5 minutes when you make sure the symptom still occurs.

Thanks.

Best regards
Ahbee Wai

PTR DocLink >>
=============================================================================

AVG tarafından kontrol edildi - www.avg.com
Sürüm: 2015.0.6176 / Virüs Veritabanı: 4460/11008 - Sürüm Tarihi: 16.11.2015

AVG tarafından kontrol edildi - www.avg.com
Sürüm: 2015.0.6176 / Virüs Veritabanı: 4460/11014 - Sürüm Tarihi: 17.11.2015

AVG tarafından kontrol edildi - www.avg.com
Sürüm: 2015.0.6176 / Virüs Veritabanı: 4460/11027 - Sürüm Tarihi: 19.11.2015

AVG tarafından kontrol edildi - www.avg.com
Sürüm: 2015.0.6176 / Virüs Veritabanı: 4460/11020 - Sürüm Tarihi: 18.11.2015

AVG tarafından kontrol edildi - www.avg.com
Sürüm: 2015.0.6176 / Virüs Veritabanı: 4460/11027 - Sürüm Tarihi: 19.11.2015

AVG tarafından kontrol edildi - www.avg.com
Sürüm: 2015.0.6176 / Virüs Veritabanı: 4460/11027 - Sürüm Tarihi: 19.11.2015