Network stability tests?

[Sonic84]

Hello, I was wondering if anyone had any tricks for checking network stability for a large organization. I often receive reports from users about failed Casper installs. When I check out the JAMF log on their Mac, I see many entries where the JSS is not reachable. Often right next to entries where the JSS was reachable. However when I run tests while remoted to a client via SSH, I can find no problem. The server is perfectly accessible and responding as expected. Likewise when I check the JSS server, I see no interruption in services or any issue with the server resources. I suspect issues with our network, however I have no hard proof to present to the networking team.

I've been testing clients by using the JAMF binary commands (recon, manage, log, policy), long ping sessions, and by running jamf checkJSSConnection in a loop for hours on end. The only real pattern is when I am watching, there are no problems connecting to the JSS. :(
This is true for systems hardwired to the corporate network and for folks on WiFi.

example of some tests I usually run:

traceroute -I myjss.company.com
nslookup myjss.company.com
jamf log; jamf manage; jamf recon
ping -c 1500 myjss.company.com
while [ 1 ]; do jamf checkJSSConnection; sleep 1; done

Any advise?

[james_ridsdale]

I too see this - have you spoken to support? You SSL, is it self-signed or public?

[davidacland]

It sounds like you might need to generate some log files that report the connection status and the state of the machine in each case.

I would probably use the commands you are already trying but deployed as a script, writing to a custom log file and triggered to run on a regular cycle (perhaps every 5-10 mins) for a 24-48 hour period. You could deploy it as a package to a selection of test Macs and then gather the results.

[jhalvorson]

I think what your experiencing is what we experience too. It's a known issue listed in the Casper Suite 9.52 through 9.63 release notes.

[D-006627] When restarting a computer that has been imaged using Casper Imaging, the computer fails to enroll if attempting to connect to the JSS via an Apple Thunderbolt to Ethernet Adapter.

Would you agree or do you feel it's something different than the known issue?

[Sonic84]

Hello, Thank you for the responses. I've got a public SSL cert for the JSS. The cert signer has a root CA included in Apple's default root certs list. Good call out about SSL, I'll add openssl s_client -connect my.jss.com:8443 to my list of checks.

@jhalvorson We're using thin provisioning for client preparation. We haven't has to use Casper Imaging for a few years now. I Don't think D-006627 would apply in this case as we have had no issues with enrollments since JSS 9.32. Before then, clients were plagued by enrollment issues and Device Signature error problems.