Doing more investigation of this ITS reveals it appears to be related specifically to the version of ldapsearch used, and whether or not the connection actually goes over the network. Specifically, the result I see is:

ldap_chkResponseList ld 0x510190 msgid -1 all 0 ldap_chkResponseList returns ld 0x510190 NULL ldap_int_select read1msg: ld 0x510190 msgid -1 all 0 ber_get_next sasl_read: want=4, got=4 0000: 00 00 00 52 ...R sasl_read: want=82, got=39 0000: 05 04 07 ff 00 00 00 1c 00 00 00 00 9d cb c2 05 ................ 0010: 43 a1 60 68 a0 f7 33 da d1 37 2f d8 21 4a 75 87 C.`h..3..7/.!Ju. 0020: b1 d8 73 41 ea 20 6b ..sA. k

Working search shows:

ldap_chkResponseList ld 2f798 msgid -1 all 0 ldap_chkResponseList returns ld 2f798 NULL ldap_int_select read1msg: ld 2f798 msgid -1 all 0 ber_get_next sasl_read: want=4, got=4 0000: 00 00 00 52 ...R sasl_read: want=82, got=82 0000: 05 04 07 ff 00 00 00 1c 00 00 00 00 6b be 1b 98 ............k... 0010: 17 5f 4a 09 70 15 23 cc 32 9f 71 6f eb 6e d2 66 ._J.p.#.2.qo.n.f 0020: b1 9a 56 61 4b 0a 64 83 ec a3 95 27 7d 07 87 5c ..VaK.d....'}..\ 0030: aa 37 26 a6 43 23 98 ab 60 e0 35 3b 7a f6 89 c2 .7&.C#..`.5;z... 0040: ca 7a 47 ec c2 0a 28 63 50 a8 16 da ae 55 fd 11 .zG...(cP....U.. 0050: ab 15 ..

at which point it hangs.

I've tried the following things:

ldapsearch version 2.3.13 from a Solaris box. Searching with this version of ldapsearch never hangs, regardless of host location (remote machine room in Livermore, or local stanford machine room).

ldapsearch version 2.4.11 from a linux box to ldap1 (2.4.19 server) hangs. These two boxes are in different locations/networks.

ldapsearch 2.3.35 from ldap2 to ldap1 (2.4.19 server) hangs. These two boxes are on the same switch on the same vlan in the same building.

ldapsearch 2.4.19 from ldap1 to ldap2 (2.3.35 server) does *not* hang. These two boxes are on the same switch on the same vlan in the same building.

ldapsearch 2.4.19 from ldap1 to ldap-liv1 (2.4.19 server) hangs. So does the reverse direction. These two boxes are in very different locations.

This problem is also seen with Net::LDAPapi perl module, so it is library rather than tool specific.

--Quanah

--

Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration