Query

[wxgeek.livejournal.com]

I know this isn't a tech support page for actual support, and this is non-critical... but I just had two customers in a row whose OSes insisted that their ethernet cables were unplugged... yet I could bounce a SYN packet off port 80 and get ACK back, and bounce a SYN packet off 81 and get RST back... like I should get from working network adapters. I wrote both of these off (after considerable hair-pulling and troubleshooting) as OS issues, and recommended a format/reload. Also possible dead hardware. Not the point, though. Has anyone seen anything like this before?

thx,
me

Edit: Yes, both customers had laptops, two NICs. Both were hard-wired into their modems, and their wireless NICs were disabled.

Comments

[valiskeogh.livejournal.com]

my first thought is that it's entirely possible for the user to have TWO NIC's. some recent mobo's have dual nic's, and it's entirely possible that the user bought a mobo with a built in NIC and for some reason (probably dumbness) bought a NIC card and put that in as well.

in which case, one NIC can be plugged in and happily passing packets, and the other will be showing a lil icon in the systray saying "network cable unplugged".

if you can still get to the machine, i'd ask the user to go... well i'd probably have to hand carry the user... into the device manager, check network adapators and see what's there.

Valis

[spiker-uk.livejournal.com]

Valis's suggestion is probably the best and most likely!

I saw one weird and wonderful case whereby the (100BaseT, not gig!) NIC claimed to be unplugged because the non-transport wires in the cable were not live (i.e. orange & green live, blue and brown pairs not crimped or connected) -- and I pray to $DEITY that I never see one of those again; so two in the same day is probably at hell-freezing-over stage :-)

[canray.livejournal.com]

Were these Laptops? Could have been a Wireless Network Adapter that was connected while the Wired Connection wasn't.

I know a large number of calls that was just that simple.

[jecook]

That's..... really weird.

IIRC, 10/100base T/TX uses the green/orange pairs, but does not use the blue/brown pairs. 100Base T4 (which I've never seen in operation anywhere) does use all four pairs, as does 1000Base over copper. But then, I've seen stupider things...

[random-c.livejournal.com]

First thought - wrong adapter. Just about everything I've seen recently, including my embedded stuff, has had at *least* two adapters. Oh the fun and games we had when the bloody supplier *very slightly* changed the second one, which meant that instead of being called 'Lan2' and disabled it was live and calling itself Local Area Connection 3, disconnected. That wouldn't have been a problem, as the correct port was still there and active... except the scripts Dev lashed together were sometimes latching on to that instead of Local Area Connection, reporting that they had no network, and so stopping the whole thing working.

[taleya.livejournal.com]

I'd go with valiskeogh - Dual nics.

[random-c.livejournal.com]

I had cause to discover a while ago that a 100-base cable will sometimes still work at 10-base, if the client auto-detects... after my father has fired several staples through it attaching it to the wall having run out of proper clips.

[wxgeek.livejournal.com]

yeah, I thought about that. One NIC, one wireless for each. Wireless disabled in both cases.

[wxgeek.livejournal.com]

I thought about that! and disabled the wireless adapters, and had the customers plugged directly in.

[canray.livejournal.com]

OK then. Nope, never come across this then.

I know it's saying "Media Disconnected", but is it getting any kind of connectivity at all?

Otherwise, it's just likely dead NICs/Ethernet Cables/Not plugged in other end...

[wxgeek.livejournal.com]

Yeah. The customer is getting zero connectivity, but I can hit port 80 on their machine with SYN and I get ACK; I hit port 81 with SYN and I get RST. It's talking. but it's not letting the customer talk.

[djbp.livejournal.com]

If laptops, are they on mains power, some disable the built in networkcard when on battery.

[valiskeogh.livejournal.com]

i ran into that once... hated it...

no wait, it was a DESKTOP. user complained of losing connectivity. they would come back to their desk and couldn't get to any of their network shares. DAMNED IF I KNOW HOW, but the system was set to go to standbye, and the nic was set to enable the OS to turn it off to save power.

augh...

[wxgeek.livejournal.com]

I'd like to think that!

[wxgeek.livejournal.com]

right, but then it should silently drop packets when I hit ports 80 and 81 with SYN packets, right? If the network adapter is off?

[torkell]

Firewall of doom? I've seen some really strange networking involving firewalls.

[thecrazyfinn.livejournal.com]

Vista will show 'Media Disconnected' when the actual issue is it can't get an IP from a DHCP server. Had this happen me today in fact, due to my switch and wifi router having a deep and abiding loathing for each other.

[wxgeek.livejournal.com]

Potential firewall of doom, but I uninstalled it in both instances. But WTF re: media disconnected? The firewall is creating virtual air gaps now??

[wxgeek.livejournal.com]

oh -REALLY-?! WTF.

[torkell]

Network driver of doom then.

Thinking about it some more, I had problems for a while where Windows would disagree with the wireless card about what was happening. I saw both Windows claiming there was no connection where I had (and was transferring data over) one, and vice versa.

[wxgeek.livejournal.com]

Uninstalled / reinstalled NIC via the device manager, but no dice there. At that point I'm suspecting a more horribly corrupted network driver - more than any sane human would want to fix by hand - and thus, the recommended backup/format/reinstall.

[techieb0y.livejournal.com]

I've generally been able to trust Windows when it says 'media disconnected'. I'd attack this from the other direction: can you get layer-2 visibility close enough to ARP the IP you were trying to ping, and thus be sure that it really was the machine belonging to the user you were talking to? Last I checked, Windows will un-bind a dynamic IP from the interface when it goes disconnected, so if the OS doesn't think it's owning the IP, you're most likely pinging something else that isn't what you expected. (Or are your users in a static IP environment?)

[wxgeek.livejournal.com]

I actually thought about this too, and pulled up the customer's MAC address, and had them read theirs off to me; they both matched. Because I figured hey, if they weren't actually keeping that IP anymore, we might've reassigned it. Usually doesn't happen that fast, but might! So I compared mac addresses. No joy. :\

[thecrazyfinn.livejournal.com]

Pretty much my response when I tripped over the issue. I knew damned well I had good link, as I'd already verified that.

[mouser.livejournal.com]

Not all hardware handles standby/hibernate/resume with the power-saving stuff correctly. I've had some WEIRD stuff happen with laptops. I *ALWAYS* make sure the power is IN, the ehternet cable is IN, and they do a COLD boot. Missing ANY of those *occasionally* means the ethernet card wont tell the Windows (I assume) that it's connected - sometimes that it even EXISTS!

I assume if you PHYSICALLY disconnect the machines it stops responding? You've gone over the obvious, try to try REALLY obvious! (Are you SURE it's the right IP?)