Strange behavior MINI

[jma]

We use a WS-6-MINI to extend the number of ports on our gateway. So the switch is connected directly to the internet with a static IP. It has been working fine that way for the last 3 years. Since 3 days we have been experiencing a strange problem. The switch was unreachable and stopped passing traffic for approximately 10 minutes a couple of times a day. Then it came back and seemed to have rebooted, so we could not see anything in the log. Since the switch is in our server center we had to go there to see what was actually happening but while we were there nothing happened. So we replaced the switch with another MINI, completely with another power supply. A couple of hours later, this other switch had the same problem but this time it did not even reboot anymore. While it was having the problem, all lights on the switch are out and sometimes a couple of green lights blink once and then go out again. We have left the switch like this to see if it would recover and/or if we could access it and read the log but after more than one hour we had to reboot it and then it worked again.
The switch is in firmware 1.5.0 and is not delivering power to any device. 4 PC's are connected and one Mikrotik CCR router.
We have tried to power the switch it with a POE adapter and then we changed this also with a regular adapter. Both result in the same behavior that we never had before.
Could this be a DDOS attack or is there some known issue that could be causing this?

[Stephen]

Definitely never heard of this behavior. Is it possible you could install a syslog server in the network in order to retain the log from the MINI?

[sirhc]

Well if it is on a public IP address and you never upgraded the firmware until you had a problem them it may have been hacked.

We strongly suggest if putting on a public IP that you keep firmware up to date and use the Access Control List to limit what IPs can mess with the switch UI/CLI.

I would do a factory power on default then set it back up this will remove any possible malicious code installed by hackers.

[jma]

Firmware was 1.5.0 when this happened, both on the first as on the second switch. The access is limited to our own set of IP addresses.
Today the switch kept working without any interruption. I really do not understand what has caused this problem.
I will try to install a syslog server next week.

[jma]

We have installed a syslog server. The problem is still there. The switch stops working for approx. 9 to 10 minutes after which it reboots.
There is nothing in the syslog from just before it happens. And then syslog mentions the cold boot.
We have this sometimes 3 to 4 times a day. Sometimes it does not happen for a couple of days.
Anyone any idea what could be causing this and/or how we could detect what is actually happening?
Switch has been replaced, cables have been replaced, power supply also.

[sirhc]

Turn OFF Flow Control on all ports and let me know if the issue stops.

[jma]

Hi @sirhc. Thanks for your help. I have just turned off flow control on all ports and will post the result.

[jma]

Hi @sirhc. I did not have to wait a long time to see that turning off flow control has not solved the problem. We just had another 10 minutes that the switch was not reachable and then did a cold boot. Today is a really bad day. We have had it almost every hour.

[sirhc]

OK, how about our Manager software, do you use it?

If you do use it you only have ONE instance running? If you monitor 2 a switch with 2 copies of Manager BAD THINGS HAPPEN.

Can you post up these TABS: Status, Ports, Device/Status (see my post footer on how to properly upload pictures)

[jma]

Screenshots uploaded.

We use PRTG to monitor this switch (but only ping and http sensor).
No other monitoring on it.