Sometime over this past weekend we began to experience strange internet/network related issues that has us (my boss, myself, and our ISP) somewhat stumped. I've personally never dealt with anything like this. The boss has been running a capture with Wireshark, I've been investigating potential malware/virus infections, and we've even considered a rogue device being connected to our network somewhere. The current theory could be a bad core switch (5406) despite 2 vlans never failing.
Internet (and the ability to reach or ping our gateway) has come and gone 2 dozen times over the last couple of days. Just when we think we might have an "AH HAH!" moment, it happens again 5 minutes later, on a different machine.
I'm wondering if anyone has any good, but general suggestions as to where I can even begin to try and tackle this? This really falls on the bosses plate, but I'm fascinated and would like to help if possible.
I've been running XARP to try and detect ARP Cache poisoning and it does say it has detected instances of it.... assuming it's accurate and I'm using it correctly (press start essentially)... but once it finds a potential "poisoning"... then what?
I've cleared my ARP cache a dozen times this morning... sometimes my internet is up, and sometimes it isn't... that's both a symptom as well as an explanation that I may not even be able to get any replies....
Internally we aren't aware of anything being wrong. Meaning that all internal resources seem to be working and responding (mail servers, file servers, network shares, printers, etc)...
Some may suggest that we install Wireshark, and as I said my boss is currently running it, but my question in response would be "What exactly are we looking for"?
Anyway thanks for any direction... this is the oddest situation...........!