Stevie Posted October 13, 2013 Share Posted October 13, 2013 Having real issues with Ricoh's Sharescan (well it's Nuance's officially but Ricoh use it on their MFDs). Have about 14 MFDs all working fine with PCC (follow me printing) but Sharescan works for about 30-40mins, then randomly they all lose connection to Sharescan which runs on a server. The server appears fine, everything else on the network appears fine. If you then restart ShareScan Manager it pings all the MFDs and they all start to talk to the server again. I want to take one MFD and do a wireshark trace on it. Not sure where to start though. Not using wireshark much, how do I take a trace from the MFD to the server, so when they lose connection I can see what is going on? Quote Link to comment Share on other sites More sharing options...
Stevie Posted October 13, 2013 Author Share Posted October 13, 2013 Just having a thought, I'm assuming I just run wireshark on the server then filter out the IPs of the MFDs that talk to it. I'll have a look tomorrow. Quote Link to comment Share on other sites More sharing options...
Dec100 Posted October 14, 2013 Share Posted October 14, 2013 Just having a thought, I'm assuming I just run wireshark on the server then filter out the IPs of the MFDs that talk to it. I'll have a look tomorrow. I think you are on the right track. IP display filters for Wireshark: "ip.dst == x.x.x.x" (Match destination IP) "ip.src == x.x.x.x" (Match source IP) "ip.addr == x.x.x.x" (Match either) I believe you can also specify networks (e.g. "ip.addr == 10.10.0.0/16"). Incidentally, your problem sounds like it could be something like the NICs going into sleep mode or some such? Might be worth looking for an option along those lines in the MFD settings. I'd probably be asking Ricoh support before spending my time sniffing packets, because this may be something easy to fix they see all the time. Good luck! Quote Link to comment Share on other sites More sharing options...
Stevie Posted October 14, 2013 Author Share Posted October 14, 2013 I think you are on the right track. IP display filters for Wireshark: "ip.dst == x.x.x.x" (Match destination IP) "ip.src == x.x.x.x" (Match source IP) "ip.addr == x.x.x.x" (Match either) I believe you can also specify networks (e.g. "ip.addr == 10.10.0.0/16"). Incidentally, your problem sounds like it could be something like the NICs going into sleep mode or some such? Might be worth looking for an option along those lines in the MFD settings. I'd probably be asking Ricoh support before spending my time sniffing packets, because this may be something easy to fix they see all the time. Good luck! Thanks for info. Well this is where it gets interesting :) because we have spoken to Ricoh and they don't know why it's happening. Nuance own Equitrac printing and Sharescan, so it's Nuances software on the MFDs. Ricoh keep saying they can't get engineers to us in the time we need them, so I'm trying to learn what I need to do, so instead of wasting time waiting for them, look at stuff myself. So far I've learnt a lot from the last Ricoh software engineer that comes to install all the software. I now know how to install equitrac and sharescan to a new, fresh MFD that has come in and doesn't have it installed. I can then add it to the print queue, convert it to a equitrac port so the print goes via equitrac. Then add the MFD to sharescan so they can scan. Your suggestion sounds like something they'd mentioned. Because they noticed all the times were out on the MFDs and weren't set properly (I never did this, the original Ricoh engineers did this when they were originally setup the MFDs) because the hardware engineers just install them and make sure they print, they don't seem to do anything with the management of them via their web consoles. So I set all the timers as requested on all the MFDs (they were going to send one of the software engineers to do it, but that was pointless, it's a simple change I knew how to do and wasn't going to wait for them to arrive). They've checked and confirmed the settings are OK but still, the MFDs will suddenly all drop connection to the Sharescan server. It's odd. Quote Link to comment Share on other sites More sharing options...
Dec100 Posted October 15, 2013 Share Posted October 15, 2013 Well Wireshark should show you any TCP resets. What about looking for patterns? For example, do the devices lose connection after 30/40 minutes regardless of use, or is it only when they haven't been used for that long? If all devices lose connection at the same time, and regardless of when they were last used, it sounds like the server is the key and I would start looking on that. Obviously, make sure you have the latest hot fixes and software installed. Quote Link to comment Share on other sites More sharing options...
Stevie Posted October 16, 2013 Author Share Posted October 16, 2013 (edited) Looking through the Wireshark trace and googling TCP reset and how to filter it, I came back with the following and the following is when Sharescan had followen over and I was restarting the Sharescan Manager. All the MFDs are on the 10.97.7 range, the Sharescan server is the 10.97.3.96 IP http://ge.tt/658HdMv/v/0?c Don't know if this is all the MFDs suddenly sending TCP reset packets to the server. Edited October 16, 2013 by Stevie Quote Link to comment Share on other sites More sharing options...
Dec100 Posted October 16, 2013 Share Posted October 16, 2013 What traffic comes before the server's [RST, ACK] in these exchanges? The ACK part suggests the server is responding to the last communication from the client with a RST. Quote Link to comment Share on other sites More sharing options...
Stevie Posted November 5, 2013 Author Share Posted November 5, 2013 Sorry haven't replied, been too busy. We ended up not following up with the WIFI Shark traces as now Nuance appeared to have semi admitted they think their new hotfix will fix the issue. Whether it does we shall see. Quote Link to comment Share on other sites More sharing options...
Stevie Posted November 13, 2013 Author Share Posted November 13, 2013 Appears it has. Their hotfix has fixed the issue. Quote Link to comment Share on other sites More sharing options...
Dec100 Posted November 14, 2013 Share Posted November 14, 2013 Good stuff - Glad you got it fixed! I'm speculating, but from your trace it looked to me like the devices and the server were getting out of synch on the connections. For example, reasons the server may respond directly with a RST could be because of a firewall/HIPS (unlikely because it was working before) or because the server thinks it already has a connection open to that device on the same port. It suggests to me that the device thought the connection had closed and was trying to re-establish it, but the server thought the old one was still open so was rejecting the new connection. All guesswork, of course, but certainly Nuance's issue to fix. Quote Link to comment Share on other sites More sharing options...
Stevie Posted November 14, 2013 Author Share Posted November 14, 2013 This is what was in the hotfix notes: Issue Addressed: When a lot of (more than 70) MFPs are registered to a single manager, sometimes the manager hangs and the MFPs can’t connect to perform a new workflow.Solution: Cost Recovery was modified to include lock timers so it will abandon dead connections instead of waiting for them infinitely.This hotfix is intended for users running eCopy ShareScan 5.1, Build 5.1.20419.0 Seems to have fixed our issue but we only have 18 devices, not 70 :) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.