need help with CSS11501

[ahmadfarkhan]

i had install one CSS11501 which is balance the 3 websphere (webserver) server. the problem is when we used the CSS11501 for doing a load balance only certain user can access the webpage and certain user cannot access. this 3 servers are using https application. but when we take out the load balancer and servers running using software balance in servers itself, it's running fine and all user can access the page. from the sys.log i can see a lot of this message appear :

JAN 15 23:25:52 1/1 930 IPV4-7: Ipv4SlaveProcessUnresolved: destined to

202.71.106.111, fall-in VIP range, pkt free'd

JAN 15 23:26:12 1/1 931 IPV4-7: Ipv4SlaveProcessUnresolved: destined to

202.71.106.111, fall-in VIP range, pkt free'd

and also this msg

JAN 15 23:26:13 1/1 932 FLOWMGR-7:

DoS SYN attack: 203.106.79.118:1125->202.71.106.111:443

synCnt: 4, initSeq: 641471

JAN 15 23:26:31 1/1 933 FLOWMGR-7:

DoS SYN attack: 203.106.79.118:1132->202.71.106.111:443

synCnt: 4, initSeq: 659731

appreciate if someone can help me on this matter. thanks in advance.

[Gilles Dufour]

the first messages is an indication of some arp failure. Should not be a big concern.

The later is an indication that host 203.106.79.118 sent a few SYN to the VIP but never got a response from the server.

If it works for some users and don't for others, the only troubleshooting action required is to capture a sniffer trace to see what is going on.

Capture a trace for a working user and a non-working user and compare them.

The config is quite simple there is nothing there indicating a possible problem.

Regards,

Gilles.

[ahmadfarkhan]

hi giles,

thanks for your reply. actually i have 3 servers connected to the load balancer. By right, load balancer is intelligent enough to forward the packet to the server B if server A is not response. this problem is like some clients are failing when hitting the vip on the CSS. is there any limitation amount number of client to hit the vip ?.

one more thing is the users are external users meaning that is from internet (using public IP). how possibly i trace the internet users?.

Thanks.