Big Lan Problems at work

[Jamoe]

Hi all.

We appear to be having problems with our soho firebox which appears to be stopping all traffic to the internet.

Our adsl comes in through a modem/router, and off that comes our linux box and the firebox. Out network goes through the firebox. (router/linux/firebox all have there own IP assigned)

The modem/router is fine, i tested it by connecting a laptop directly to the router. The problem appears to be the firebox which just stops all outgoing stuff.

I can reset the firebox and the internet will work again for a short period befor it stops responding. When I do tracerts the connection between the firebox and the router seems to fail.

Anyone got any ideas, im pretty sure its the firebox screwing up but I have no solution short of replacing it.

Cheers

Jamoe

[suicidal_monkey]

maybe there's something blasting the firebox with traffic and it's eventually shutting your network off? The enemy within type thing...



...don't listen to me, I know nothing about this...
 

[Jamoe]

it oucld be, the box tends to stop work partway through the day. We've had no problems up until now. Could it be a virus on one of the PCs thats flooding the firebox?

It's really odd, i can ping the firebox but not the router pn the other end. Totally bizzare.

[DuVeL]

I'm not one of the techies in here but I've heard about a virus from last week that was searching for small LANnetworks and then it would use the internetconnection to slow it down or send alot of stuff.
Me being a n00b in techstuff, that's all I know. Sorry. :unsure:

[DarkAngel]

Try just connecting just one of the pc's (make sure to do a virus scan on it ect) to the firebox once you have reseted and test how long it holds. If it still disconnects i would say its the firebox, if it works a general virus problem on a network pc.

[Jamoe]

yesterday when we booted everything down we then brought each PC on gradually untill everything was on and working fine.

It does appear to be same time during the day so it might be time triggered. Buts it gone at 9:30am, 2pm and 4pm. It tends to stay up after 4pm though.

We have sophos installed on all machines that are patched every day automatically so I'd be hard pressed to say it was a virus.

Im at home today which is nice as it means i can actualy get on with some work. Looks like ill be having fun tomorrow checking each PC for viruses. Holy poop, thats made me think of a couple of PC's that might not have any protection, maybe its those.

Cheers

Jamoe

[Rabbi Bob]

You may want to download Ethereal and set it on your network to watch the traffic for a bit.  You can also connect to the internal entrance side of your network and sniff the packets that are coming in and going out.

You can go a step further later on if you're really interested in it and set up a Snort senser.  There is a bit of learning curve (I'm still playing with mine after two months), but the traffic analysis is amazing.  You can set up specific rules to detect just about anything (bittorrent, IM programs, etc).  If you keep the signatures updated, you can scan for virii and worm activity.

If you have a linux box on the network and want see something interesting & graphical, install Etherape.  I wish they'd make it a screensaver.  :devil:

[Jamoe]

Thanks for all the help guys.

My boss finally rang up the company that support "some" of equipment (they wont touch the linux box, but they did when we had SCO) anyway, they found that nothing was wrong with the firebox and that the problem was related to the router. (sigh) It appears that we are getting "intermittent loss of sync" on the bt line, I assume this cuases the loss of connection to the firebox even after the router has got the adsl connection back. ONly after rebooting the firebox does the network get its line back.

BT have apparently been informed. Oh joy now we will have to wait for them to pull there fingers out.

Once again cheers Guys.

[suicidal_monkey]

Originally posted by Jamoe@Sep 16 2005, 10:22 AM
It appears that we are getting "intermittent loss of sync" on the bt line

[post=95012]Quoted post[/post]

[/b]

you're not with BTOpenworld or some other BT variant of the adsl offerings are you? My dad has intermittent loss of sync (and has done since switching to a proper modem) on his home connection. BT as an ISP are horribly unhelpful in my experience. Fine with phones though... <_<

[Jamoe]

No we have been with Demon on a Pro Account for over a year with no problems what so ever. ACrtualy thinking about upgrading but definatly not when we have these problems.

It start happening on Monday (possible Friday).

Touch Wood it hasnt happened yet today. :S

[Jamoe]

I thought I had updated this thread ah well.

I turned on a PC that had been off all day and not long after we lost internet access. So, I turned that machine off rebooted the firebox and tried again.. yep it killed the internet (hehe).

This machine was recently used by a student so I assumed the worse and relealised it wasn't running our networked version of sophos. Once all was updated I ran a scan and a lovely mass mailing worm appeared. It was found in a folder this student was using (he called it "Dans Files").

Long story short, I killed the worm and everything seems to work ok


Disclaimer: I may have posted this else where, but it seems a good idea to have this thread resolved incase anyone comes across it later on.

[suicidal_monkey]

Originally posted by suicidal_monkey@Sep 15 2005, 02:23 PM
maybe there's something blasting the firebox with traffic and it's eventually shutting your network off? The enemy within type thing...
...don't listen to me, I know nothing about this...
 

[post=94919]Quoted post[/post]

[/b]

told you so sort of

[Jamoe]

You did indeed if only I had listend (and be bothered to run aorund all 40+ machines)

Pure luck I found it but i should have guessed to look there first.

[TeaLeaf]

Originally posted by suicidal_monkey@Sep 27 2005, 12:12 PM
told you so sort of

dMw is proud to announce the award of 5 Smug Points to suicidal_monkey for a correctly applied 'I told you so'  :roflmao:  :roflmao:  :roflmao:

Nice catch SM

TL.