The ghost in the network

30.10.2006
This is the true story of a ghost server -- a phantom server that nearly brought down our network. Paranormal? Perhaps not. Simple common sense and a little low-tech delivered what fancy equipment couldn't see.

Our current network evolved from massive mainframes to early Windows machines, Unix boxes, dumb terminals, NT and now thousands of smart clients and rooms of powerful dedicated servers. We monitor every facet of their operation. Yet a phantom nearly took us down.

The onset was not ominous. A network printer overran its buffer and jobs stopped printing. We speculated it was a hardware failure, swapped out the old printer, configured the new one, rebooted the device, and then it was business as usual.

Then it happened again on another printer. Soon a master console winked out. Just for a moment, but it was definitely gone. Users reported sporadic data header corruption. Strange incidents became more frequent with no set pattern.

A computer virus on a server? A network worm on a shared drive? Not likely. We use a multilevel security approach guarding against blended threats.

NetOps caught some of the signals. They were random but definitely originated from inside the perimeter. We had a phantom server.