Enterprise Console: packet loss causing problems with RMS

Several issues reported in Enterprise Console, and some high CPU utilization issues, can be traced to packet loss during data transmission caused by network problems, and the re-transmitting of dropped segments. These problems are not revealed until Sophos Remote Management System (RMS) increases the quantity of IP traffic.

Symptoms include:

1. High CPU utilization on the Enterprise Console server
2. Computers grayed out in Enterprise Console
3. In the 'Up to date' column in Enterprise Console, computers listed as 'Not Since...'
4. Installation timeouts
5. Missing pkc and pkp keys in the Windows registry
6. The building up of *.msg files in the envelopes folder.

What to do

1. Checking for retransmitted segments

From a command prompt at the server, type

netstat -s 2 | find "Segments Retransmitted"

This command reports the number of TCP segments that are being retransmitted. Make a note of this number.

To check if packet loss is the problem, initiate data transfer between the server and a workstation, e.g. by copying the ESXP folder to the workstation. Then run the above command again.

If the number has increased, there is packet loss or congestion somewhere on the network.

A network performance monitor, e.g. Iperf.exe, will give more detail as to the extent, and source, of network congestion.

2. Looking for causes of packet loss

Check for problems on your network which might lead to packet loss, for example

• misconfigured devices, e.g. routers, switches, NIC Cards (ARP poisoning, misconfigured duplexing, speed etc.)
• damaged network cables
• attenuation (e.g. overlong cable, or connection via too many switches).