Simple Question... Please an Answer will be appreciated

[riverbr]

Guys, I'm asking this question, because I have a small company and I can not efford a big time consultant. so please any information would really be appreciated.

I have a Mac-address 00:00:f8:01:f0:9b that It is trasmitting 802.3 Frame time. This mac-address (whatever it is) it's trasmitting a lot of data in the network and it is slowing the network down a lot.
a 4.6 MB excel file takes my users 50 sec to 1 minute to open (I know this is incredible).

More Information:
The network is using: TCP/IP as the main Protocol. (At least that it's what it's supposed to be using).
According to the Book: 802.3 Frame time is:
A Carrier-Sense Multiple Access With collision Detection (CSMA/CD) LANs (Ethenet).

Now Questions:

How do I find out the IP address or hostname of the Mac-Address??

What The hell is 802.3 and what could possible be using it?

And Why would this hardware be using 802.3 frame type???


I would really appreciate any input you guys can supply to eliminated this problem.


Thanks,

Regards,
Riverbr

[skywalker[TSG]]

has it always been like this or is it a new problem if the problem is new then u should look at any changes made to this comp new hardware/software etc. maybe their is some conflict here

[Stan]

Hi

It depends on how many PC's you have on your network.
On a command prompt, type "ipconfig /all"
You will see all the info of the NIC: ip address, subnet, gateway and MAC address.
Obvioulsy, you have to go through all the PC's until you find the one you are looking for.
I know it might take a long time but that's all I can think about for the moment.

About the 802.3 frame time, I don't have any answer. I let you know if I find smthg.

Good luck

Stan


This is what I found about CSMA/CD

Short for Carrier Sense Multiple Access / Collision Detection, a set of rules determining how network devices respond when two devices attempt to use a data channel simultaneously (called a collision). Standard Ethernet networks use CSMA/CD. This standard enables devices to detect a collision. After detecting a collision, a device waits a random delay time and then attempts to re-transmit the message. If the device detects a collision again, it waits twice as long to try to re-transmit the message. This is known as exponential back off.

CSMA/CD is a type of contention protocol

Don't think it will help you... you never know...

Stan


[This message has been edited by Stan (edited 07-09-99).]

[MadMax]

I'm no great shakes at this but I'll give it a try....

Frame type ???.?=IPX/SPX protocol
IPX/SPX USUALLY equals Netware

Do you have a Netware Server?
Do you have ANY ipx enabled comps?

I'd start looking there.

How did you determine that MAC?
How do you know that MAC is xmitting all that data?

[800XL]

Ahh, frame types. I knew I kept those Novell manuals for something. Ethernet 802.3 is the standard Novell IPX protocol frame type. If you have a Netware server on your LAN, that would be a good place to start looking for that MAC address. Another likely suspect would be any network printing devices you may have. Be careful if you decide to go about disabling that frame type on the one device that is using it though. You may be looking at some legacy print server that is using IPX and 802.3 frame type and needs it around. Also, if you have a Netware server, odds are all of your client machines are accessing it using IPX, and likely also 802.3 frame type. (Netware 5 or 4.xx with NWIP would be the only exceptions.) You can change the frame type loaded on the Netware machine to something like Ethernet II, which is the standard TCP/IP frame type, but I don't know if it would really help your problem.

How are you tracking this info down? If you are using some sort of packet sniffer like LANalyzer or NetXRAY you should be able also find where these packets are headed to. If you are just getting a lot of broadcast 802.3 traffic, then I agree that you have nailed the problem and now it just comes down to fixing it. If the packets are actually going someplace, then it may be a needed evil, unless you upgrade the offending hardware.

I'll see if I can track some software down that will allow you to pinpoint that MAC address to a machine or IP. I know of some $500+ solutions but they would be overkill totally. A little more info on the type of machines and servers on your LAN might help to sort out the problem though. Just a real rough rundown of what you've got OS wise (95/98/NT/etc) and any other networked devices (printers/fax/servers).

[BBA]

rivrbr, do you own the company or are you an employee?

Can you describe what PC equipment you physically have on site?

Who set up the network? Was it a professional IT person or perhaps yourself?

What kind of Internet access do you have set up on site?

I ask these questions because you kind of opened a can of worms throwing out Novell frame type standards and NIC mac addresses.

I/we may be able to provide better information to you if we knew some specifics.

If you have a 10BaseT network, then opening a 4.6M Excel spreadsheet and establishing links may well indeed take over a minute as normal, so we have to take a lot of things into consideration.

BBA

[Tex_Gex]

If it is a Novell network ,I urge you to find someone who knows Novell !!!! It will tell you what you want to know.

You said 1 minute for a 4.5 meg excel file ? It's not that bad.... I was a Network Admin on a 100mb lan over a fiber backbone that was not much faster...

If you really want to know ???? the Console Monitor on a Netware server will tell you the user/person/machine/print server logged into the network with the said Mac address...

Let me know if you want more info.. I hesitate because Novell can be scary for an average computer user..

If your close to Denver I would help for lunch and gas/beer money..I know I'm crazy
but I like helping...

[Jin Vitas]

Where is this guy??

well.. If you used a sniffer.. and sniffed out that mac address as having.. "alot of network traffic" then it may possibly be the SERVER itself. or if in a workgroup.. Broadcasting every little thing.. what you might want to do is setup an LMhosts file. and if your not running netware.. dont use IPX.. 802.3 frame type according to the IEEE is ethernet.

[Tex_Gex]

Did I upset you Jim ? What did I say ?

[800XL]

I guess I wasn't that clear in my reply. A Netware server is the most likely machine to be sending/recieving a lot of Ethernet_802.3 frames. Virtually no other networking devices that I can think of use that frame type, other than a Netware server, or Netware connected device. (printers, clients, etc) Of course, I could be wrong. I don't claim to be a networking guru.

There are four basic Ethernet Frame Types, 802.2 (older Netware standard) 802.3, II, and SNAP. For simplicity's sake, I usually stick to Ethernet_II if I have to specify it. Since what I do pretty much always involves TCP/IP it seems to work better. You can bet that if there is only one device spitting out 802.3 broadcasts, then it is running IPX and involves Netware somehow.

[Jin Vitas]

I was talking about riverbr.. the guy does not answer.. therefore closed thread.

and Tex_gax.. spell names right. =)