Advertisement
- Home
- Networking
- Network Management
- Help in Diagnosis of a Network Traffic Problem affecting core services
Advertisement
- 1. uetian1707 87,353
- 2. RobWill 60,470
- 3. DevilWAH 56,375
- 4. lrmoore 19,748
- 5. Johnjces 16,950
- 6. from_exp 14,100
- 7. ebjers 13,980
- 8. toniur 13,200
- 9. martin_b... 12,700
- 10. KCTS 12,311
- 11. lnkevin 11,050
- 12. that1guy15 9,610
- 13. tigermatt 9,200
- 14. Chris-Dent 8,560
- 15. shakoush... 8,400
- 16. Richard_... 7,925
- 17. Cyclops3... 7,676
- 18. 2PiFL 7,375
- 19. giltjr 6,720
- 20. JFrederic... 6,300
- 20. ryansoto 6,300
- 22. mwecom... 6,075
- 23. rindi 6,054
- 24. donmanrobb 5,950
- 25. OutlawSy... 5,900
- 1. uetian1707 115,375
- 2. RobWill 91,614
- 3. DevilWAH 56,575
- 4. lrmoore 49,210
- 5. KCTS 23,709
- 6. Johnjces 23,450
- 7. giltjr 22,110
- 8. pseudocy... 20,416
- 9. keith_ala... 18,700
- 10. rindi 18,684
- 11. ebjers 18,230
- 12. toniur 16,400
- 13. lnkevin 16,261
- 14. MrHusy 15,700
- 15. leew 14,600
- 16. from_exp 14,100
- 17. Fatal_Ex... 13,225
- 18. martin_b... 12,700
- 19. donjohnston 12,650
- 20. oBdA 12,630
- 21. 2PiFL 12,475
- 22. harbor235 12,325
- 23. Cyclops3... 12,126
- 24. shakoush... 11,900
- 25. Jay_Jay70 11,648
| 04.06.2008 at 05:38PM PDT, ID: 23300209 |
|
[x]
Attachment Details
|
||
Help in Diagnosis of a Network Traffic Problem affecting core services
Asked by subz0r69z0r in Network Management, Linux Networking, Network Software Firewalls
Tags: IPCOP, 1.4.18, Network Traffic Problem
Hello,
We have an IPCOP box with two Zones, GREEN and RED. The RED interface has an Public IP address and connects directly to a router and out to the Internet. The GREEN interface connects back in to the Local Network. RED IF has port forwarding rules to facilitate core services in the LAN such as Email, VPN, Mobility etc. The GREEN zone has unrestricted access out to the RED zone. Please see attached code snipplet for an (allbeit poor) attempt to draw the network.
The problem we are getting is the pipe out to the Internet is getting flooded with traffic on very regular intervals. When such a surge in traffic occurs extrernal response times to 203.42.x.x sit between 2500-3500ms or simply time out. Of course due to this our core services (VPN, EMAIL) stop working.
Please view attached pictures for the traffic graphs in IPCOP.
GREEN
Traffic is spiking roughly every 2 hours lasting for about an hour. The traffic is incoming on GREEN.
RED
Outbound traffic on RED is corresponding directly with inbound traffic on GREEN.
This has been happening for about 4 days now but is not the first time it has happened. Unless I am reading it wrong the traffic is being generated from inside our network and could possibly be due to a workstation being 'owned'.
If anyone could suggest steps I can take to find the source of the problem and fix I would be most appreciative. I am able to run tcpdump on the IPCOP box but have only ever run this once so if possible provide syntax.
ThanksStart Free Trial
We have an IPCOP box with two Zones, GREEN and RED. The RED interface has an Public IP address and connects directly to a router and out to the Internet. The GREEN interface connects back in to the Local Network. RED IF has port forwarding rules to facilitate core services in the LAN such as Email, VPN, Mobility etc. The GREEN zone has unrestricted access out to the RED zone. Please see attached code snipplet for an (allbeit poor) attempt to draw the network.
The problem we are getting is the pipe out to the Internet is getting flooded with traffic on very regular intervals. When such a surge in traffic occurs extrernal response times to 203.42.x.x sit between 2500-3500ms or simply time out. Of course due to this our core services (VPN, EMAIL) stop working.
Please view attached pictures for the traffic graphs in IPCOP.
GREEN
Traffic is spiking roughly every 2 hours lasting for about an hour. The traffic is incoming on GREEN.
RED
Outbound traffic on RED is corresponding directly with inbound traffic on GREEN.
This has been happening for about 4 days now but is not the first time it has happened. Unless I am reading it wrong the traffic is being generated from inside our network and could possibly be due to a workstation being 'owned'.
If anyone could suggest steps I can take to find the source of the problem and fix I would be most appreciative. I am able to run tcpdump on the IPCOP box but have only ever run this once so if possible provide syntax.
ThanksStart Free Trial
1: 2: 3: 4: 5: 6: 7: 8: 9: |
INTERNET
|
|
RED/Public IP Addr. 203.42.x.x
IPCOP
GREEN/192.168.1.5
|
|
LAN 192.168.1.0/24
|
Attachments:
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628
