From: Jim Steele on
I am researching a network problem that I am hoping someone here can
give me some help with.

>From a topological perspective, I have a LAN connected to a WAN with a
single router. The router is in turn connected to a single 16-port
Linksys switch. There are perhaps five devices connected to ports 1-5
of the switch.

The symptoms are:
1. Intermittently the device on one of the ports (say port 3) stops
responding. The
application
running there appears to hang and the device will not respond to Ping
requests.
2. Shortly thereafter all devices on the switch appear to hang and will
also not
respond to ping requests.
3. Disconnecting the cable to device 3, and all other devices will
begin to function
properly. Reconnect said cable and shortly thereafter they will
freeze again.
Reboot the device connected to port 3 and all devices
will begin to work, including
the app on port 3. The problem may not re-occur for a
long time.

During one of the outages where device there was in frozen state (but
the other devices were
still responding) I managed to get an Ethereal (wireshark) log of
activity by plugging a laptop
into the 16-port switch. Apart from the normal traffic I would expect,
I see one message
originating from the device at port 3 (remember it is not responding to
pings at this time) that
I did not expect. The message is a MAC Pause control request. I have
attached the details below.

This message is being issued by the device at port 3 about once per
second. This continues
for an hour or so until I reboot the device. Then the message
disappears and the app on the
device begins to work correctly.

My question is this. What might be causing this message, and what
impact would or could it have on the other devices connected to the
switch. I believe that the message is indicating that the NIC for the
device on port 3 thinks that it is being overrun with traffic, and it
is asking
any switches on the segment to wait for a short time before sending it
any more traffic.
However, I don't see the traffic that would be overrunning the NIC, and
I would not expect that
this message would ever impact the behavior of the other devices
connected to the switch.

Any help or insight anyone could offer would be very much appreciated.

Thanks,

Jim
--------------------------------------------------------------------------------------------
No. Time Source Destination
Protocol Info
3 2006-09-14 14:04:20.423462 Radiant_a4:28:15
Spanning-tree-(for-bridges)_01 CTRL MAC PAUSE: Quanta 16415

Frame 3 (60 bytes on wire, 60 bytes captured)
Arrival Time: Sep 14, 2006 14:04:20.423462000
Time delta from previous packet: 0.028486000 seconds
Time since reference or first frame: 0.029808000 seconds
Frame Number: 3
Packet Length: 60 bytes
Capture Length: 60 bytes
Frame is marked: False
Protocols in frame: eth:macc
Coloring Rule Name: Broadcast
Coloring Rule String: eth[0] & 1
Ethernet II, Src: Radiant_a4:28:15 (00:e0:0d:a4:28:15), Dst:
Spanning-tree-(for-bridges)_01 (01:80:c2:00:00:01)
Destination: Spanning-tree-(for-bridges)_01 (01:80:c2:00:00:01)
Address: Spanning-tree-(for-bridges)_01 (01:80:c2:00:00:01)
.... ...1 .... .... .... .... = Multicast: This is a MULTICAST
frame
.... ..0. .... .... .... .... = Locally Administrated Address:
This is a FACTORY DEFAULT address
Source: Radiant_a4:28:15 (00:e0:0d:a4:28:15)
Address: Radiant_a4:28:15 (00:e0:0d:a4:28:15)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST
frame
.... ..0. .... .... .... .... = Locally Administrated Address:
This is a FACTORY DEFAULT address
Type: MAC Control (0x8808)
MAC Control
Pause: 0x0001
Quanta: 16415
----------------------------------------------------------------------------------------------
0000 01 80 c2 00 00 01 00 e0 0d a4 28 15 88 08 00 01 ........
...(.....
0010 40 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.......
.........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........
.........
0030 00 00 00 00 00 00 00 00 00 00 00 00