奇怪的网络问题

Philmoon

原帖由 grins 于 2006-12-5 11:19 发表\r\n使用的本地dns解析，好像和dns没有关系。

\r\n\r\n使用浏览器访问网站肯定是与DNS有关系的。建议将DNS服务器改为外部的公用DNS试试，如电信ISP服务商的DNS。\r\n另外，象www.sina.com.cn这样的网站不会接受telnet的。因此telnet不上去不说明问题。有些连ping都不接受。

grins

原帖由 briangao 于 2006-12-5 14:38 发表\r\nThe IP address you are using is RFC1918 private IP. In order for you to access internet, your firewall must do NAT ( network address translation). Can you verify with your network admin how your na ...

\r\n\r\n如主题中所写，我以一台windows笔记本设置为和故障服务器一样的网络参数，然后接上故障服务器的网线，可以正常上网。\r\n但为何这台solaris的对外访问就是出不了网关呢？\r\n\r\n局域网中其它的solaris和windows一样的网络设置都是正常访问外网啊\n\n[ 本帖最后由 grins 于 2006-12-5 16:12 编辑 ]

grins

原帖由 Philmoon 于 2006-12-5 14:55 发表\r\n\r\n\r\n使用浏览器访问网站肯定是与DNS有关系的。建议将DNS服务器改为外部的公用DNS试试，如电信ISP服务商的DNS。\r\n另外，象www.sina.com.cn这样的网站不会接受telnet的。因此telnet不上去不说明问题。有 ...

\r\n\r\n我telnet www.sina.com.cn 80，这个在我这里是没有返回结果的，而正常应该有“escape ]”的

grins

原帖由 FOR_FREE 于 2006-12-5 13:12 发表\r\n我上面想错了~~你的PING包是从哪里来的呢？？有没有sniffer看一下~

\r\n\r\n嗯，是应当用sniffer查看一下故障服务器的对外访问的数据包是否走出了网关

Philmoon

原帖由 grins 于 2006-12-5 16:14 发表\r\n\r\n\r\n我telnet www.sina.com.cn 80，这个在我这里是没有返回结果的，而正常应该有“escape ]”的

\r\n\r\n刚才就试了一把，除了漆黑的屏幕之外没有任何东东。谁说正常该有 escape ] 呢？这个escape ] 提示是建立了telnet联系以后才会有的。象sina这样的网站不可能接受telnet请求的。

grins

原帖由 Philmoon 于 2006-12-5 16:29 发表\r\n\r\n\r\n刚才就试了一把，除了漆黑的屏幕之外没有任何东东。谁说正常该有 escape ] 呢？这个escape ] 提示是建立了telnet联系以后才会有的。象sina这样的网站不可能接受telnet请求的。

\r\n呵呵，如果没有cde没有窗口也没有浏览器，如何用现成工具来判断一台主机是否开了某端口？\r\n如www.sina.com.cn的80端口？

Philmoon

原帖由 grins 于 2006-12-5 16:34 发表\r\n\r\n呵呵，如果没有cde没有窗口也没有浏览器，如何用现成工具来判断一台主机是否开了某端口？\r\n如www.sina.com.cn的80端口？

\r\n\r\n不用浏览器，那只有找X客们的端口扫描工具了……问题是，这些工具一般都在WIN下运行，WIN里没浏览器能行吗？

grins

那就记住使用telnet server port来判断某端口是否打开吧，打开了显示“]”，没开telnet没有响应；\r\n\r\n还是回到主题吧

briangao

原帖由 grins 于 2006-12-5 03:01 发表\r\n\r\n\r\n如主题中所写，我以一台windows笔记本设置为和故障服务器一样的网络参数，然后接上故障服务器的网线，可以正常上网。\r\n但为何这台solaris的对外访问就是出不了网关呢？\r\n\r\n局域网中其它的solaris和windows一样 ...

\r\n\r\nWhen you access www.sina.com.cn from your laptop, how did you do that? Was that from a browser or through telnet www.sina.com.cn? If you were using a browser, you may have used a proxy server. Check your proxy setting in the browser.\r\nIf you don\'t have a proxy, then we need to go through the following steps to get to the bottom of your issue. \r\n\r\n1. Hook up your laptop with the same setting as your Solaris server. In the command window, type ipconfig /all\r\n2. Type  route print\r\n3. ping your default gateway\r\n4. Type arp -a\r\n5. Type nslookup www.sina.com.cn\r\n6. Type tracert www.sina.com.cn\r\n7. telnet www.sina.com.cn 80\r\n8. While the above telnet is still running, in another command window, type netstat -na|find /i \"80\" \r\n\r\n\r\nNow hook up your Sun server with the same setting\r\n\r\n9. Type ifconfig -a \r\n10. netstat -nr\r\n11. ping your default gateway\r\n12. ping 224.0.0.1\r\n13. arp -a\r\n14. nslookup www.sina.com.cn\r\n15. traceroute www.sina.com.cn\r\n16. Do a snoop when ping www.sina.com.cn\r\n17. If you can\'t ping, do a snoop -v when you ping www.sina.com.cn\r\n18. Do a snoop when telnet www.sina.com.cn 80\r\n19. When the above telnet is still going, type netstat –na|grep –i 80 in another terminal window\r\n20. If you can\'t telnet to port 80 of www.sina.com.cn, do a snoop -v when telneting to www.sina.com.cn 80\r\n\r\nPost your result here.

briangao

The first difference I see is that you couldn\'t traceroute to newsmth.org while you could tracert to it. Traditionaly windows tracert uses ICMP and Unix traceroute uses UDP high ports. However, this may have been chaanged. So I need you to do traceroute -v -I  -i eri0  -q 1 newsmth.org and then in a separate command, do snoop -v when you are doing just traceroute -v -i eri0 -q 1 newsmth.org. The -I option in the first run forces ICMP protocol. \r\n  \r\nAlso, please telnet to port 80 of newsmth.org instead of just telnet and do a snoop -v of it. \r\n\r\nThe Solaris release you are using is Solaris 9 Dec of 2002 (really old). Did you patch it? If not, you may want at least install recommened patch cluster. Otherwise weird thing like this could happen. If you\'d like to post the patch info, you could show me uname -a and showrev -p output. \r\n\r\nThis problem is really weird. At this time I\'m still not convinced that it is necessary a server based problem even though it could be. It still could be a network problem, such as your network device is blocking UDP high ports. You have two network devices between your server and the internet, one is 192.168.11.1 and the other is  172.16.8.21 (or external IP 202.99.57.113). The most effective way of troubleshooting the problem is actually monitor the traffic on these network devices. Even it turns out that it is your server\'s problem, you can tell it better from the logs on these devices. Without accessing to them, we are dancing around to figure it out. I strongly recommend that you get your network admin involved.