jpolache's questions

I have been tasked with compiling a list of possible network equipment changes at a data center. The task includes tagging which changes need change control and which don't. Does anyone know of a "best practices" list that I can start from?

The methods for doing change control at this data center are well established. The list would be of specific configuration items that should or should not be included in the change control process, of example;

static route entries
switch port assignments
firewall rule additions/changes
etc.

I’m working in a large data center and have been assigned to troubleshoot and issue with a windows (IIS) web server that acts as a portal for a customer of the data center. This portal server is on a DMZ at the local data center.

I don’t have access to the portal desktop and am relying on an off-site administrator to work with me to do testing and report the condition of the portal. He tells me there are no software firewalls or other filtering configured.

While most of the remote web pages work fine, several of the URLs the portal is suppose to serve up fail to load. I had wireshark installed on the portal system and had a capture taken of one of the failures. I used IE to access one of the remote web servers at issue. I could see the TCP SYN-ACK coming back from the remote server, but after several HTTP GETs fail to get a response the portal server sends a reset.

(response to answer 1: From the capture taken outside the firewall;

Internet Protocol, 
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
    0000 00.. = Differentiated Services Codepoint: Default (0x00)
    .... ..0. = ECN-Capable Transport (ECT): 0
    .... ...0 = ECN-CE: 0
<snip>
Transmission Control Protocol
<snip>
    Flags: 0x18 (PSH, ACK)
    0... .... = Congestion Window Reduced (CWR): Not set
    .0.. .... = ECN-Echo: Not set

It appears ECN is disabled.)

The webmaster of the remote web server assures me that no sites are being blocked. I had a capture taken outside the local firewall, so there should be no issue there.

Another tech set up a laptop and used the IP address of the portal (we took the portal off-line for the test). The laptop loads the URL as expected. I tried having Firefox loaded to make sure that the HTTP GET was not mal-formed. Same failure as with IE.

So, it seems it is not the remote web server or the network, because there was no problem with the laptop.

At this point, I’m not sure what other questions to ask or tests to do.

I have Hitachi ID Password Manager (formerly p-synch) set up to change the password on (among other systems) an aix 6.1 server running samba. p-synch has the capability of executing additional commands by configuring "chat script" in the conf file. But p-sync does not send the old password and runs the script as the "p-sync admin ID".

Only root can change the samba password without the old password. I could get around this problem with sudo, but it is not currently installed on the aix system, and I want to make sure that sudo is the only option before installing and configuring it.

Any suggestions?

As a network administrator (Cisco switches, work with WAN providers, protocol analysis) I have an "area of responsibility" for the customer's VOIP project. The telecom group has primary responsibility for dial plans, voice mail and the monitoring tools that came with the Avaya system, but the traffic goes over the data network, so at some point I expect to be involved.

QoS has been implemented. I have not yet received any formal training, and most of the training offerings I have seen have had more to do with VOIP administration than data network related issues.

My customer is doing an Avaya VOIP pilot. I am looking at traces in Wireshark to build my troubleshooting skills. I have found much documentation on VOIP, but little that focuses on protocol analysis and how the various protocols work together.

I can see H.323 in the trace, but some packets contain TPKT, Q.931 and H.225 while others do not.

Wireshark Statistics->RTP->Show All Streams shows 15 streams while Statistics->VOIP Calls shows only 1 call.

Can anyone point me at some good sources of information on how to understand VOIP at this level?