4

We have an IP Phone system (most models are snom 320). Today someone's phone has decided to stop working. It has an IP address assigned to it by DHCP, and I can sometimes go to it's IP address to view the phone's configuration page. Sometimes the page gives the standard "Unable to connect Firefox can't establish a connection to the server at 192.168.3.173." Message instead.

The really weird thing is if I keep Ping running, I see the ping time is consistantly about 1ms when the page loads, but when it decides not to load it changes to a random time of 20-400ms. As soon as the ping time returns to 1ms the page loads again. These cycles seem to last a few mins at a time.

EG

64 bytes from 192.168.3.173: icmp_req=39 ttl=64 time=1.01 ms
64 bytes from 192.168.3.173: icmp_req=40 ttl=64 time=1.04 ms
64 bytes from 192.168.3.173: icmp_req=41 ttl=64 time=1.04 ms
64 bytes from 192.168.3.173: icmp_req=42 ttl=64 time=1.01 ms
64 bytes from 192.168.3.173: icmp_req=43 ttl=64 time=1.06 ms
--------------------stops loading here----------------------
64 bytes from 192.168.3.173: icmp_req=612 ttl=64 time=6.92 ms
64 bytes from 192.168.3.173: icmp_req=613 ttl=64 time=184 ms
64 bytes from 192.168.3.173: icmp_req=614 ttl=64 time=99.9 ms
64 bytes from 192.168.3.173: icmp_req=615 ttl=64 time=325 ms
64 bytes from 192.168.3.173: icmp_req=616 ttl=64 time=245 ms
64 bytes from 192.168.3.173: icmp_req=617 ttl=64 time=165 ms
64 bytes from 192.168.3.173: icmp_req=618 ttl=64 time=86.0 ms

Does anyone have any idea what's going on or how to fix it?

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
Nick
  • 151
  • 2
  • Do you have latency pinging anything else on the network, such as your gateway? Can you run a packet capture from the phone? – pooter03 Dec 18 '14 at 16:52
  • @pooter03 pinging other phones which work just give a consistent time of ~1ms. Other computers give similar results. I don't think I can run package capture from the phone, I can't see any options for that in the admin menu. – Nick Dec 18 '14 at 16:56
  • 1
    If it is plugged into a managed switch, you can mirror the port to a pc or laptop running Wireshark or whatever your preferred sniffer is. Another option would be to find a hub and plug the phone and computer running Wireshark into that. Check the logs if that model supports it (I use Allworx phones). Also, try swapping locations with another phone that works and see if the problem follows the original phone or effects the new phone. That is an easy way to isolate if it is a network or phone issue. – pooter03 Dec 18 '14 at 17:01
  • Are you using managed switches? If so, I'd start by looking at the interface counters and utilization. – joeqwerty Dec 18 '14 at 17:02
  • @pooter03 I don't have privileges on the switch unfortunately, I'll try to get someone who does to set that up! – Nick Dec 18 '14 at 17:07
  • In the meantime, try swapping the phones and see if the problem pops up. Also, this question is probably better suited for Superuser or Network Engineering. – pooter03 Dec 18 '14 at 17:16
  • @pooter03 SuperUser? How do you figure? Honestly IP Phones are generally under the management of the sysadmins, so I'm pretty OK with the question staying here. Possibly Network Engineering if the issue is indeed consistent after switching ports. – Reaces Dec 18 '14 at 17:47
  • Well it isn't a problem with the PBX and he doesn't have access to the switch. I was thinking Network Engineering but I could easily be wrong. I'm still new at this site :) – pooter03 Dec 18 '14 at 17:58
  • @pooter03 It seems it was down to an IP conflict issue, with the routing oscillating between the phone and a mystery device. Now to try to work out what the mystery device is! – Nick Dec 19 '14 at 13:09

1 Answers1

1

It seems there was at least one other device using the same IP address on the network. I don't know how this occurred, as they should be assigned from DHCP. After unplugging the phone and still seeing the >400ms slow ping times, I reset the DHCP for the phone and it got a new IP address and works fine with pings ~1ms.

I don't know what the strange device is with widely varying ping times which was on the same IP, but whatever it is it seems to have been causing the oscillating varying ping responses from the phone.

Nick
  • 151
  • 2
  • 1
    You should verify if the other device has the same MAC as the phone or a different one. I am guessing it most likely has a different MAC, since the problem wasn't there after you got a new IP address. If it is a physical device, and the MAC isn't spoofed, then the MAC address will provide you a hint about the manufacturer of that other device. The other device on that IP could be a virtual machine, that could explain the varying response times. – kasperd Dec 19 '14 at 13:25
  • If you are running Windows, with the phone unplugged, ping the IP and then run arp -a from the command prompt. You can use [this](http://www.coffer.com/mac_find/) site to see who the vendor is and maybe give you a clue as to what type of device it is. – pooter03 Dec 19 '14 at 13:43
  • @pooter03 I'm on linux, but I'm on the 192.168.1.xxx subnet, while the phones are all on the .3 subnet. When I run arp -a I only see devices on the .1 subnet. I suppose I'll have to swap the router my computer is plugged into? – Nick Dec 19 '14 at 14:03
  • Yeah. Plug your computer into the same network as the phone and make sure it is using a .3 address. I'm not sure what the Linux equivalent of arp -a is though. :) – pooter03 Dec 19 '14 at 14:54