Query

[wxgeek.livejournal.com]

I know this isn't a tech support page for actual support, and this is non-critical... but I just had two customers in a row whose OSes insisted that their ethernet cables were unplugged... yet I could bounce a SYN packet off port 80 and get ACK back, and bounce a SYN packet off 81 and get RST back... like I should get from working network adapters. I wrote both of these off (after considerable hair-pulling and troubleshooting) as OS issues, and recommended a format/reload. Also possible dead hardware. Not the point, though. Has anyone seen anything like this before?

thx,
me

Edit: Yes, both customers had laptops, two NICs. Both were hard-wired into their modems, and their wireless NICs were disabled.

Comments

[valiskeogh.livejournal.com]

my first thought is that it's entirely possible for the user to have TWO NIC's. some recent mobo's have dual nic's, and it's entirely possible that the user bought a mobo with a built in NIC and for some reason (probably dumbness) bought a NIC card and put that in as well.

in which case, one NIC can be plugged in and happily passing packets, and the other will be showing a lil icon in the systray saying "network cable unplugged".

if you can still get to the machine, i'd ask the user to go... well i'd probably have to hand carry the user... into the device manager, check network adapators and see what's there.

Valis

[wxgeek.livejournal.com]

yeah, I thought about that. One NIC, one wireless for each. Wireless disabled in both cases.

[spiker-uk.livejournal.com]

Valis's suggestion is probably the best and most likely!

I saw one weird and wonderful case whereby the (100BaseT, not gig!) NIC claimed to be unplugged because the non-transport wires in the cable were not live (i.e. orange & green live, blue and brown pairs not crimped or connected) -- and I pray to $DEITY that I never see one of those again; so two in the same day is probably at hell-freezing-over stage :-)

[jecook]

That's..... really weird.

IIRC, 10/100base T/TX uses the green/orange pairs, but does not use the blue/brown pairs. 100Base T4 (which I've never seen in operation anywhere) does use all four pairs, as does 1000Base over copper. But then, I've seen stupider things...

[canray.livejournal.com]

Were these Laptops? Could have been a Wireless Network Adapter that was connected while the Wired Connection wasn't.

I know a large number of calls that was just that simple.

[wxgeek.livejournal.com]

I thought about that! and disabled the wireless adapters, and had the customers plugged directly in.

[random-c.livejournal.com]

First thought - wrong adapter. Just about everything I've seen recently, including my embedded stuff, has had at *least* two adapters. Oh the fun and games we had when the bloody supplier *very slightly* changed the second one, which meant that instead of being called 'Lan2' and disabled it was live and calling itself Local Area Connection 3, disconnected. That wouldn't have been a problem, as the correct port was still there and active... except the scripts Dev lashed together were sometimes latching on to that instead of Local Area Connection, reporting that they had no network, and so stopping the whole thing working.

[taleya.livejournal.com]

I'd go with valiskeogh - Dual nics.

[wxgeek.livejournal.com]

I'd like to think that!

[djbp.livejournal.com]

If laptops, are they on mains power, some disable the built in networkcard when on battery.

[valiskeogh.livejournal.com]

i ran into that once... hated it...

no wait, it was a DESKTOP. user complained of losing connectivity. they would come back to their desk and couldn't get to any of their network shares. DAMNED IF I KNOW HOW, but the system was set to go to standbye, and the nic was set to enable the OS to turn it off to save power.

augh...

[wxgeek.livejournal.com]

right, but then it should silently drop packets when I hit ports 80 and 81 with SYN packets, right? If the network adapter is off?

[torkell]

Firewall of doom? I've seen some really strange networking involving firewalls.

[wxgeek.livejournal.com]

Potential firewall of doom, but I uninstalled it in both instances. But WTF re: media disconnected? The firewall is creating virtual air gaps now??

[thecrazyfinn.livejournal.com]

Vista will show 'Media Disconnected' when the actual issue is it can't get an IP from a DHCP server. Had this happen me today in fact, due to my switch and wifi router having a deep and abiding loathing for each other.

[wxgeek.livejournal.com]

oh -REALLY-?! WTF.

[delta_mike]

That's just fucking wrong.

[techieb0y.livejournal.com]

I've generally been able to trust Windows when it says 'media disconnected'. I'd attack this from the other direction: can you get layer-2 visibility close enough to ARP the IP you were trying to ping, and thus be sure that it really was the machine belonging to the user you were talking to? Last I checked, Windows will un-bind a dynamic IP from the interface when it goes disconnected, so if the OS doesn't think it's owning the IP, you're most likely pinging something else that isn't what you expected. (Or are your users in a static IP environment?)

[wxgeek.livejournal.com]

I actually thought about this too, and pulled up the customer's MAC address, and had them read theirs off to me; they both matched. Because I figured hey, if they weren't actually keeping that IP anymore, we might've reassigned it. Usually doesn't happen that fast, but might! So I compared mac addresses. No joy. :\

[the-hunter.livejournal.com]

Y'know, I have to chuckle here...
The community is set up for venting and relaxation and getting away from work. And as soon as a problem is thrown in, we all go *Oooh! Shiny!* and...carry on working...

See, tech support isn't a job. it isn't a way of life, it is a fucking addiction...

[fenrirvallin.livejournal.com]

Tech support is addictive, and occasionally fun.

Customers are not.

[spiker-uk.livejournal.com]

Yeah. But tech support people are smart and tend to like interesting problems (particularly when they're well-phrased and from someone who has credence in the community) :-)

[delta_mike]

I was about to suggest that they might have plugged their cable into a lights-out management port, but laptops?

Firewire devices usually show up as network-capable, and are usually disconnected. If you were looking at the network status for the Firewire connection, and not the real NIC, that might throw the customer off.

[wxgeek.livejournal.com]

Nah; I had 'em read the screen to me verbatim. We were looking at ethernet NICs the whole time.

[liber-cogito.livejournal.com]

Broadcom has a power management setting on notebooks that will disable the onboard NIC when on battery power.

[wxgeek.livejournal.com]

Well isn't -that- evil?

[syberghost.livejournal.com]

You need one of these for proper testing:

http://www.fiftythree.org/etherkiller/img/etherkiller.jpg

[wxgeek.livejournal.com]

oh I KNOW. :)