Brann's questions

I've just bought four servers, rented a quarter of server bay, bought some Internet connectivity, bought a specialized line to a private network I'm using, and now I need to buy a router (or two?) to plug everything together.

While finding and comparing server hardware and hosting facilities has been quite easy, I've not been able to find a reliable source of information regarding network equipment. I've also got the feeling that there's no real alternative to Cisco in the corporate world, which makes comparing offers tougher.

Where can I look? What network hardware is used in a typical server room?

What network equipment should I buy in my specific situation?

• 4 servers, all with dual gigabit network cards
• 2 incoming internet connections (gigabit)
• 2 incoming connections to a private communication network
• traffic is expected to be low, redundancy requirements are high.
• [Edit:] 16 public IP Addresses

I used to think both terms referred to the exact same thing, but one of my clients just requested to have a look at both documents.

The request emanates from the security department of a very big company, so I guess they know what they're talking about ...

What's the difference between a DRP and a BCP ?

The industry standard when it comes from redundancy is quite high, to say the least. To illustrate my point, here is my current setup (I'm running a financial service).

Each server has a RAID array in case something goes wrong on one hard drive

.... and in case something goes wrong on the server, it's mirrored by another spare identical server

... and both server cannot go down at the same time, because I've got redundant power, and redundant network connectivity, etc

... and my hosting center itself has dual electricity connections to two different energy providers, and redundant network connectivity, and redundant toilets in case the two security guards (sorry, four) needs to use it at the same time

... and in case something goes wrong anyway (a nuclear nuke? can't think of anything else), I've got another identical hosting facility in another country with the exact same setup.

• Cost of reputational damage if down = very high
• Probability of a hardware failure with my setup : <<1%
• Probability of a hardware failure with a less paranoiac setup : <<1% ASWELL
• Probability of a software failure in our application code : >>1% (if your software is never down because of bugs, then I suggest you doublecheck your reporting/monitoring system is not down. Even SQLServer - which is arguably developed and tested by clever people with a strong methodology - is sometimes down)

In other words, I feel like I could host a cheap laptop in my mother's flat, and the human/software problems would still be my higher risk.

Of course, there are other things to take into consideration such as :

• scalability
• data security
• the clients expectations that you meet the industry standard

But still, hosting two servers in two different data centers (without extra spare servers, nor doubled network equipment apart from the one provided by my hosting facility) would provide me with the scalability and the physical security I need.

I feel like we're reaching a point where redundancy is just a communcation tool. Honestly, what's the difference between a 99.999% uptime and a 99.9999% uptime when you know you'll be down 1% of the time because of software bugs ?

How far do you push your redundancy crazyness ?

I've got a win 2003 server running a TFS server, and a Win 2008 server acting as a PDC.

A few days ago, I changed my DHCP and DNS server (which used to be the win 2008 server) to a Cisco Router. Since then, I've not been able to log in on my TFS server, which keeps complaining that my domain doesn't exists.

I've run dcdiag from my local Admin account to debug :

dcdiag /v /s:MYPDC /u:MYDOMAIN\Brann /p:*

Which returned me this error:

     * Active Directory LDAP Services Check
         The host 95cb8ce0-ecb1-43e3-87aa-e4ce74fe6._msdcs.MYDOMAIN could not be  resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         ......................... MYPDC  failed test Connectivity

I changed my DHCP server to use MYPDC as the primary DNS server again, and this error stopped appearing

I restarted the server, confident that the issue was solved, but now I'm getting this :

   Starting test: VerifyReferences
      Some objects relating to the DC IDS-SERVER have problems:
         [1] Problem: Missing Expected Value
          Base Object: CN=MYPDC,OU=Domain Controllers,DC=MYDOMAIN
          Base Object Description: "DC Account Object"
          Value Object Attribute Name: frsComputerReferenceBL
          Value Object Description: "SYSVOL FRS Member Object"
          Recommended Action: See Knowledge Base Article: Q312862

      ......................... IDS-SERVER failed test VerifyReferences

I've tried troubleshooting File Replication service as suggested in Q312862, but I'm stuck at the beginning :

C:\Documents and Settings\Administrator>ntfrsutl ds TFS
ERROR - Cannot bind w/authentication to computer, TFS; 000006d9 (1753)
ERROR - Cannot bind w/o authentication to computer, TFS; 000006d9 (1753)
ERROR - Cannot RPC to computer, TFS; 000006d9 (1753)

C:\Documents and Settings\Administrator>ntfrsutl ds MYPDC
ERROR - Cannot RPC to computer, MYPDC; 000006d2 (1746)

Any ideas on what to try next? Btw, other Vista computers on this domain can login just fine.

I've got a clickonce repository hosted on a Apache server ; for obvious reasons*, I don't want this repository to be cached by a proxy server.

I know there's no way to prevent a proxy to cache something if it wants to, but I'm looking for a way of either hinting the proxy not to cache my URL, or providing it with an "obsolescence date".

Is there a way to do that with Apache? If not, is it possible to do that with another webserver (IIS?)

If there are some options working only with some specific proxy vendors, I'm interested in those too.

** If the repository is cached, the software checks its version against an obsolete copy of the "latest version" (held by the proxy) instead of checking itself against the "real" latest version, which is on my server.

I want to connect to an FTP server from my local network, which is behind a NAT.

The gateway is a Win 2008 server, configured with routing and remote services / Nat enabled. The problem exists from XP, Vista sp1, and Vista sp2 computers.

Here's what I get (using the default DOS ftp client, but I get the same thing using FileZilla)

ftp> open ftp.foo.com
Connected to ftp.foo.com.
220-

[here I wait for 30s before getting the following line]

Connection closed by remote host.
ftp>

As you can see I'm disconnected before the login process, so I don't have the opportunity to use PASSV.

Here's what works :

• everything else (ie, every non-ftp related connection)
• connection to this specific server from my NAT gateway
• connection on other servers from my behind-nat computer
• direct internet connection to this specific ftp server from my computer (ie, without using the NAT server)

The company providing the ftp says the problem is not on their end, since I can connect from my NAT server. The same reasoning leads to the problem not being on my side neither (I can connect on other ftp servers)

What should I check ?

EDIT : here's what I get when I sniff the connection on the gateway while attempting to connect from my behind-the-nat computer :

On the Internet facing interface :

No.     Time        Source                Destination           Protocol Info
   1312 320.576218  213.186.xx.xxx        192.168.1.1           FTP      Response: 220-
   1313 320.576602  213.186.xx.xxx        192.168.1.1           FTP      Response: 220-Bienvenue, 
   1315 320.610911  213.186.xx.xxx        192.168.1.1           FTP      Response: 220-

And on my internal LAN interface :

    No.     Time        Source                Destination           Protocol Info
       9288 118.698920  213.186.xx.xx        192.168.0.100         FTP      Response: 220-

       9293 118.890406  213.186.xx.xx        192.168.0.100         FTP      Response: 220-Bienvenue, 
    Frame 9293 (166 bytes on wire, 166 bytes captured)
    Ethernet II, Src: Tp-LinkT_c6:e2:3f (00:21:27:c6:e2:3f), Dst: Giga-Byt_22:b0:99 (00:1f:d0:22:b0:99)
    Internet Protocol, Src: 213.186.xx.xx(213.186.xx.xx), Dst: 192.168.0.100 (192.168.0.100)
    Transmission Control Protocol, Src Port: ftp (21), Dst Port: jini-discovery (4160), Seq: 7, Ack: 1, Len: 112
        Source port: ftp (21)
        Destination port: jini-discovery (4160)
        Sequence number: 7    (relative sequence number)
        [Next sequence number: 119    (relative sequence number)]
        Acknowledgement number: 1    (relative ack number)
        Header length: 20 bytes
        Flags: 0x18 (PSH, ACK)
        Window size: 65536 (scaled)
        Checksum: 0xa5bc [incorrect, should be 0x96cb (maybe caused by "TCP checksum offload"?)]
        [SEQ/ACK analysis]
    File Transfer Protocol (FTP)

   9306 119.187327  213.186.xx.xx        192.168.0.100         FTP      [TCP Retransmission] Response: 220-Bienvenue, 
   9326 119.787350  213.186.xx.xx        192.168.0.100         FTP      [TCP Retransmission] Response: 220-Bienvenue, 
No.     Time        Source                Destination           Protocol Info
   9373 120.987450  213.186.xx.xx        192.168.0.100         FTP      [TCP Retransmission] Response: 220-Bienvenue, 

Any idea of why this CRC problem might be happening ?

btw, here are my mtu settings (on the gateway)and they are identical on my computer.

C:\Windows\system32>netsh interface ipv4 show interfaces
Idx  Met   MTU   State        Name
---  ---  -----  -----------  -------------------
  1   50 4294967295  connected    Loopback Pseudo-Interface 1
 10   30   1500  connected    Local Area Connection
 13   20   1500  connected    Local Area Connection 2

And here's some MTU analysis on my computer :

Pinging 192.168.0.1 with 1472 bytes of data:
Reply from 192.168.0.1: bytes=1472 time<1ms TTL=128

Pinging 192.168.0.1 with 1473 bytes of data:
Packet needs to be fragmented but DF set.

Here's what I get if I try to connect using telnet :

220-

Connection to host lost.

Press any key to continue...