Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Internet gets very very slow or sometimes does not show pages

Posted on 2006-04-13
81
Medium Priority
?
1,412 Views
Last Modified: 2013-12-07
Hi all
I am running windows 2003 server ent edition with AD, DHCP, DNS.  Using one of the default gateway as our mailserver.  Most of the times the internet gets really really slow and the page loading takes forever and sometimes the page would simply not show up.  I never had any problems before.
How would I check where the problem lies and how can I rectify it.
Thanks
0
Comment
Question by:amanzoor
  • 46
  • 19
  • 16
81 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 16449101
> Using one of the default gateway as our mailserver.
You mean the mailserver is also your primary router to the Internet?
Do you have any other router or firewall? Are you using Proxy server?
Is this server dual-homed with 2 NIC's?
Can you post output of "route print"
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16449105
Assuming you have a broadband or similar connection and we are not dealing with Dial-up.

It could be one of two; your DNS is slow or your Internet is maxing out on bandwidth unless there is a hardware issue somewhere.

To verify DNS response, when the system is fast ping www.google.com and note down the output with time it took for ping to start. Do the same when it is slow. See if there is any difference in the time it took for the ping to start (IP Address to show-up).

To verify bandwidth, do a speed test, if your ISP provides one, would be good. If not, run something from www.dslreports.com and check the difference.

Post your findings so we can further narrow it down.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16481711
Irmoore:
I mean default gateway for the internet.  Yes I do have a router 2600.  No proxy.  Yes the server is dual homed with 2 NICS.  Here is the route print.
H:\>route print

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10002 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
0x10003 ...00 02 55 32 c1 d5 ...... IBM 10/100 EtherJet PCI Management Adapter
0x10004 ...00 09 6b 98 0a a4 ...... IBM Netfinity 10/100 Ethernet Security Ada
er 2
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.10.10.254       10.10.10.3      1
          0.0.0.0          0.0.0.0     10.10.10.254     10.10.10.101      1
       10.10.10.0    255.255.255.0       10.10.10.3       10.10.10.3      1
       10.10.10.0    255.255.255.0     10.10.10.101     10.10.10.101      1
       10.10.10.3  255.255.255.255        127.0.0.1        127.0.0.1      1
     10.10.10.101  255.255.255.255        127.0.0.1        127.0.0.1      1
   10.255.255.255  255.255.255.255       10.10.10.3       10.10.10.3      1
   10.255.255.255  255.255.255.255     10.10.10.101     10.10.10.101      1
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
    172.168.0.230  255.255.255.255        127.0.0.1        127.0.0.1     50
        224.0.0.0        240.0.0.0       10.10.10.3       10.10.10.3      1
        224.0.0.0        240.0.0.0     10.10.10.101     10.10.10.101      1
  255.255.255.255  255.255.255.255       10.10.10.3       10.10.10.3      1
  255.255.255.255  255.255.255.255     10.10.10.101     10.10.10.101      1
Default Gateway:      10.10.10.254
===========================================================================
Persistent Routes:
  None

H:\>

NaveedB:
Test results are:
dslreports.com speed test result on 2006-04-18 15:57:05 EST:
479 / 4211
Your download speed : 479 kbps or 59.8 KB/sec.
 Your upload speed is much faster than down.. have you tweaked?

Your upload speed : 4211 kbps or 526.4 KB/sec.

PS: Welcome to dslreports.com! Run more tests! see


Notice I am timing out in pings:
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Request timed out.
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=5ms TTL=246
Reply from 72.14.207.99: bytes=32 time=5ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=8ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=8ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Request timed out.
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=8ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=13ms TTL=246


Help please.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 10

Expert Comment

by:naveedb
ID: 16483152
To start: you have two default gateways listed:

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.10.10.254       10.10.10.3      1
          0.0.0.0          0.0.0.0     10.10.10.254     10.10.10.101      1

You will need to take one out. If you want to keep the mailserver as your default gateway, specify only on the NIC that is connected with mailserver and remove default gateway from the other NIC. If you need to connect to a Network on other NIC through second gateway, you can add static routes.

We will need more information on your networks structure, like the networks it is connected to and why it has two NICs etc.

0
 
LVL 4

Author Comment

by:amanzoor
ID: 16488818
Thanks Naveedb
These NICS are from the same machine (10.10.10.3 and 10.10.10.101),  right now when my clients browse to the internet undre there network connections they get the IP from DHCP, and the default gateway for them is 10.10.10.3 which is fine.  I am not sure why it had two NICS.  I can remove the default gateway from the other NIC i.e
the configuration of the NIC card 10.10.10.101 will become:
ip address 10.10.10.101
subnet mask: 255.255.255.0
defualt gateway:
DNS: primary 10.10.10.3
       : Secondary 10.10.10.18
Is that fine?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16489054
Suggest disabling the 2nd NIC with 10.10.10.101 IP address on it...
That's why one of the first questions I asked was if it had 2 in it..

If this fixes all issues, then If 2x NIC's are requirement for resiliency we can work on a solution for you for that.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489410
ok Irmoore
I will just disable it and let you know if the issue is resolved.  
Thanks
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489488
Hi
Here is what i did:
I assigned static address to my machine and made my router as the default gateway i.e 10.10.10.254 and then tried pinging to 'www.google.ca' it times out after few seconds I wonder if the hardware problem lies somewhere on the switch or the router.
I disabled 10.10.10.101 then tried pinging 'www.google.ca' it times out after few seconds as well.
 Help plz
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16489523
Can you ping by IP address? Try pinging  198.6.1.2

What about your DNS? What IP are you setting for DNS resolution when you assign static IP?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489580
While pinging the IP it still times out
My DNS  server is running on the same 10.10.10.3 machine. SO my DNS is 10.10.10.3 and secondary is 10.10.10.18
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16489632
Can you ping your default gateway 10.10.10.254?
What kind of router is this? Have you tried rebooting it?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489671
yes I can ping my router 10.10.10.254
It is Cisco 2600, I rebooter my fibre optics to ethernet converter, router and the main switch (2900) last night, by pulling out the electric cords, but to no avail.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489719
correction:
>>>>>yes I can ping my router 10.10.10.254
               It is Cisco 2600, I rebooted..............
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489829
OK i pinged my internal router 10.10.10.254 and external ip address 'www.google.ca'.  For some reason it only times out on the external address pings.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16489851
Do you have access to the router console?
Can you ping external addresses from the router?
Did you reboot the router <after> disabling the 2nd NIC on the server? It could be an ARP cache timeout issue with the router.

router>ping 198.6.1.2
Or manually clear arp cache:
router>enable
password:
router#clear arp *

0
 
LVL 4

Author Comment

by:amanzoor
ID: 16489935
Yes Irmoore I can access the router console.  
I will try pinging external addresses from the router and let you know.  
which one is required:
-1- Did you reboot the router <after> disabling the 2nd NIC on the server?
-2-router#clear arp *
will one of them fix the arp or both of above points.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16490000
Try the manual clear arp first. That is much less intrusive that a complete reboot of the router.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16490328
I cleared the arp cache from the router.
Pinging from the server and a client to check.  Also running a speed test.
Will let you know in a minute
Right now my internet is painfully slow.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16490444
ok I am still getting a time out on external website pings from the server and the client machine.  From the router when I ping external website ip's they look fine.  
In the morning I did a speed test by 'www.dslreports.com' and results were 393kbps down and 3640kbps up.  
There is something going on with my internet speed which I have to figure out.
Help plz
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16490462
can you post result of "show interface" from the router?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16490470
Here is the most recent speed test:
dslreports.com speed test result on 2006-04-19 14:04:13 EST:
288 / 2811
Your download speed : 288 kbps or 36 KB/sec.
 Your upload speed is much faster than down.. have you tweaked?

Your upload speed : 2811 kbps or 351.4 KB/sec.

PS: Welcome to dslreports.com! Run more tests! see forums
Thanks
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16490547
show interfaces
FastEthernet0/0 is up, line protocol is up
  Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 5/255, rxload 5/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/34045 (size/max/drops); Total output drops: 16335
  Queueing strategy: weighted fair
  Output queue: 0/1000/64/16283 (size/max total/threshold/drops)
     Conversations  0/44/256 (active/max active/max total)
     Reserved Conversations 0/0 (allocated/max allocated)
  5 minute input rate 2151000 bits/sec, 447 packets/sec
  5 minute output rate 2133000 bits/sec, 444 packets/sec
     682749253 packets input, 3536904373 bytes
     Received 5498981 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     676265246 packets output, 718296331 bytes, 0 underruns
 --More--              0 output errors, 0 collisions, 8 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/0.10 is up, line protocol is up
  Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
  Description: Main CAMPUS VLAN
  Internet address is 10.10.10.254/24
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 5/255, rxload 5/255
  Encapsulation 802.1Q Virtual LAN, Vlan ID  10.
  ARP type: ARPA, ARP Timeout 04:00:00
 --More--         FastEthernet0/0.801 is up, line protocol is up
  Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
  Description: CONNECTION TO BUR CAMPUS
  Internet address is 10.10.11.254/24
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 5/255, rxload 5/255
  Encapsulation 802.1Q Virtual LAN, Vlan ID  801.
  ARP type: ARPA, ARP Timeout 04:00:00
 --More--         FastEthernet0/0.908 is up, line protocol is up
  Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
  Description: INTERNET VIA company
  Internet address is x.x.x.x/30
  MTU 1500 bytes, BW 1000000 Kbit, DLY 100 usec,
     reliability 255/255, txload 5/255, rxload 5/255
  Encapsulation 802.1Q Virtual LAN, Vlan ID  908.
  ARP type: ARPA, ARP Timeout 04:00:00
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16490781
FastEthernet0/0.908 is up, line protocol is up
  Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
  Description: INTERNET VIA company
  Internet address is x.x.x.x/30

What is upstream for the Internet access? Since these are all VLAN's and sub-interfaces, there must be something else upstream. Is this router doing NAT also? How many total systems are running through this?

Can you post result of "sho ip route"

0
 
LVL 10

Expert Comment

by:naveedb
ID: 16490851
Can you post your output from show log?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491015
show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is x.x.x.61 to network 0.0.0.0

     x.x.x.0/30 is subnetted, 1 subnets
C       x.x.x.60 is directly connected, FastEthernet0/0.908
     10.0.0.0/24 is subnetted, 2 subnets
C       10.10.10.0 is directly connected, FastEthernet0/0.10
C       10.10.11.0 is directly connected, FastEthernet0/0.801
S*   0.0.0.0/0 [1/0] via 216.185.84.61
FH_2620#show ip log
                  ^
% Invalid input detected at '^' marker.

FH_2620#show log
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
    Console logging: disabled
    Monitor logging: level debugging, 0 messages logged
    Buffer logging: level debugging, 143136 messages logged
    Trap logging: level informational, 143140 message lines logged
 --More--         
Log Buffer (65536 bytes):
TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.45.129.4:9921) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.205.148.170:6348) sent 139 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (64.229.127.121:10318) sent 139 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.48.228.48:14616) sent 139 bytes
Apr 19 14:46:49: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.54.209.124(50902) -> 216.185.84.185(1097), 1 packet
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.170.80.128:40932) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (71.198.213.160:10711) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.169.222.43:6348) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.212.132.243:6348) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (207.134.181.91:6346) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.13.228.176:2282) sent 0 bytes
 --More--         69:24399) sent 34 bytes -- responder (70.230.170.85:49591) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (64.180.13.29:46575) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.11.57:2666) sent 548 bytes -- responder (66.77.84.94:80) sent 17035 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.57.196.13:4906) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.248.112.253:2453) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (12.222.199.40:51818) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (207.180.180.65:5588) sent 126 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.103.208.142:2396) sent 139 bytes
Apr 19 14:47:14: %SEC-6-IPACCESSLOGP: list 101 denied tcp 84.65.100.142(1823) -> 216.185.84.185(39044), 1 packet
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.120.17.40:34255) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.40.244.232:33081) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (207.75.32.93:28188) sent 0 bytes
 --More--         Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.67.33.109:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.99.238.95:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (80.192.36.210:44449) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (196.206.146.206:60306) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.65.179.154:20038) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.214.92.55:19366) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.68.234.39:17194) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.30.16.95:27552) sent 61 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.96.167.65:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.67.33.109:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.186.161.20:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (128.196.239.178:35484) sent 129 bytes
 --More--         Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 42 bytes -- responder (192.175.48.6:53) sent 119 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (124.121.33.63:50465) sent 139 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.71:3907) sent 126 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:15: %SEC-6-IPACCESSLOGP: list 101 denied tcp 207.46.18.30(80) -> 216.185.84.185(2791), 1 packet
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.98.129.145:7476) sent 102 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.236.157.49:21907) sent 138 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.193.60.154:15619) sent 131 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.71:6346) sent 29 bytes -- responder (67.169.75.37:6346) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (88.107.194.54:45017) sent 139 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (62.30.164.62:4166) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.73.209.75:3572) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.0.173.210:1176) sent 0 bytes
 --More--         Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.193.214.113:3234) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (155.143.14.148:4854) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.46.41.68:32102) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.110.134.222:39374) sent 139 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.139.129.3:30659) sent 139 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.119.158.105:12673) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (66.214.231.178:34292) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.110.210.8:10767) sent 99 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.188.116.214:30269) sent 116 bytes
Apr 19 14:47:16: %SEC-6-IPACCESSLOGP: list 101 denied udp 204.16.208.105(55135) -> 66.207.100.152(1026), 1 packet
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.128.240.82:43990) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.54.206.209:26010) sent 0 bytes
 --More--         Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.112.84.193:45244) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.56.215.54:42146) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.251.101.173:14316) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (80.192.11.171:37011) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.83.84.242:12000) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.25.130.219:6348) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (59.92.242.152:32196) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.29.130.82:50673) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.189.100.118:2474) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.138.224.143:45144) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.126:1539) sent 545 bytes -- responder (199.212.18.76:80) sent 23693 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (211.31.86.221:29360) sent 139 bytes
 --More--         Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (64.201.216.64:6346) sent 74 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.119.28.172:6346) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.86.137.195:41181) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (205.250.114.65:39611) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.134:16165) sent 29 bytes -- responder (69.199.88.196:2112) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.134:23135) sent 29 bytes -- responder (142.104.165.19:6346) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.101.72.83:46164) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (12.152.162.91:29374) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.226.15.187:41767) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (59.167.189.12:6348) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.135.134.52:6346) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (142.162.199.230:6346) sent 0 bytes
 --More--         Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.125.64.234:44084) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (128.211.235.34:33427) sent 126 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (207.199.209.101:51988) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.28.183.86:33710) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.170.28.202:21889) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (209.33.101.154:14032) sent 116 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.20.132.168:7615) sent 98 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.37.66.65:51570) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.38.150.50:11009) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.214.152.137:34418) sent 139 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.183.158.76:43793) sent 124 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.21.76.186:47912) sent 139 bytes
 --More--         Apr 19 14:47:18: %SEC-6-IPACCESSLOGP: list 101 denied tcp 68.41.62.36(6348) -> 216.185.84.185(4736), 1 packet
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.165.50.100:49351) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.13.11.76:47634) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.47.174.99:21424) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.169.71.66:19374) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.24.184.131:10371) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.18.44.13:6348) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.188.93.23:6346) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.229.112.243:6346) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.14.74.13:34494) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.226.73.247:26630) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.27.127.211:21735) sent 0 bytes
 --More--         Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.47.244.83:6346) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (12.221.193.129:15040) sent 139 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.81.105.203:6346) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.142.104.211:19006) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.237.79.27:5708) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.139.221.116:10508) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.42.9.124:4652) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.137.204.146:9910) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.194.209.54:39805) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.171.30.223:31399) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.31.13.117:41294) sent 139 bytes
Apr 19 14:47:19: %SEC-6-IPACCESSLOGP: list 101 denied tcp 211.31.205.177(36280) -> 216.185.84.185(1205), 1 packet
 --More--         Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (80.193.161.179:31942) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.132.94.150:27835) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.124.62.45:21189) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.76.64.19:15841) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.235.23.43:6349) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.170.68.137:4903) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.141.41.246:6123) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (156.34.195.140:10246) sent 139 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (129.1.223.90:34740) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (64.252.17.160:48820) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.164.198.177:13695) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.180.89.164:13565) sent 0 bytes
 --More--         Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.236.160.176:6346) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.252.124.146:20460) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.12.99.252:6346) sent 139 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (83.184.229.96:55779) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.27.101.13:37353) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.145.90.205:33946) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (129.108.213.28:21453) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.230.54.239:9041) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.169.230.45:6349) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (80.7.234.5:3819) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.162.98.190:51586) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.224.180.230:33927) sent 113 bytes
 --More--         Apr 19 14:47:20: %SEC-6-IPACCESSLOGP: list 101 denied tcp 207.46.96.141(1863) -> 216.185.84.185(1201), 1 packet
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.147.211.28:23320) sent 121 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.37.22.214:30364) sent 139 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (35.11.162.87:56841) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.124.150.242:1631) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.89.17.115:64215) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (205.134.239.24:2207) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (75.3.93.23:51001) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.138:4812) sent 307 bytes -- responder (205.134.231.54:80) sent 469 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.171.9.219:48713) sent 139 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:4931) sent 102 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.86.120.98:34559) sent 99 bytes
 --More--         Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.141:4294) sent 1904 bytes -- responder (64.233.163.104:80) sent 4195 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (165.190.89.160:47948) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (66.171.75.155:40413) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (66.108.62.0:21973) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (213.194.255.116:17270) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (87.7.149.177:7704) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.36.7.123:6348) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.121.172.70:6346) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (128.175.141.84:4181) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.140.114.137:48456) sent 139 bytes
Apr 19 14:47:22: %SEC-6-IPACCESSLOGP: list 101 denied tcp 216.109.119.252(80) -> 216.185.84.185(1498), 1 packet
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.146.35.19:19327) sent 0 bytes
 --More--         Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (138.234.126.220:17372) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.232.92.100:6346) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.157.106.153:13139) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.49.208.173:6346) sent 138 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.70.229.15:19749) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (200.232.255.65:6520) sent 102 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.137.51.79:43668) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 42 bytes -- responder (192.175.48.6:53) sent 119 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (87.97.107.104:11203) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.57.246.181:25859) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.66:1892) sent 129 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.189.57.23:23015) sent 0 bytes
 --More--         Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (195.158.85.30:17975) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.180.239.109:14415) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.131.212.105:17141) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.36.75.181:6348) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.227.146.225:3742) sent 102 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.44.251.29:46775) sent 139 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.11.40:2222) sent 16 bytes -- responder (69.213.137.51:32297) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.67.25.250:29890) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (217.54.130.74:17199) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.190.165.130:15483) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.55.233.217:6348) sent 139 bytes
Apr 19 14:47:23: %SEC-6-IPACCESSLOGP: list 101 denied tcp 70.28.176.39(4284) -> 216.185.84.185(39044), 1 packet
 --More--         Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.209.172.91:34295) sent 139 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.100.6.92:40945) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.193.226.17:22580) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.0.188.200:6346) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.65.131.187:4014) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (62.166.22.234:45339) sent 132 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.2.242.28:19984) sent 139 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.142.54.73:9631) sent 126 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (194.54.230.17:28754) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.201.207.85:17209) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.77.125.152:50559) sent 126 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (216.51.235.169:7192) sent 125 bytes
 --More--         Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (152.35.22.151:26838) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.186.202.14:51189) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.201.204.201:6346) sent 540 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.14.73.215:37984) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.40.96.78:18793) sent 138 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.59.1.197:3192) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.175.7.46:4126) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.30.189.72:1467) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.166.57.196:1142) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (151.57.208.137:40091) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (87.74.102.236:27096) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.31.252.104:15057) sent 0 bytes
 --More--         Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.124.233.143:6348) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (59.167.150.74:27599) sent 133 bytes
Apr 19 14:47:25: %SEC-6-IPACCESSLOGP: list 101 denied udp 70.48.39.103(60000) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 44 bytes -- responder (192.52.178.30:53) sent 222 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (200.139.147.90:3067) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.65.44.72:3561) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.70.196.208:2270) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.194.62.110:4845) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (75.2.168.57:18182) sent 139 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 44 bytes -- responder (207.46.66.75:53) sent 79 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.143.80.232:41936) sent 139 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:1040) sent 81 bytes -- responder (192.175.48.6:53) sent 235 bytes
 --More--         Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (85.66.87.248:6348) sent 74 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.14.195.25:41455) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (203.81.231.15:21832) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (88.233.81.136:45952) sent 138 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.23.22.81:11702) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.64.102.91:6348) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:4938) sent 102 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.197.9.7:30481) sent 80 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 39 bytes -- responder (220.73.220.4:53) sent 318 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 38 bytes -- responder (65.203.234.28:53) sent 349 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 54 bytes -- responder (64.251.27.189:53) sent 99 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.30.93.181:55469) sent 120 bytes
 --More--         Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:1040) sent 47 bytes -- responder (69.28.95.98:53) sent 92 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:1040) sent 48 bytes -- responder (62.58.50.220:53) sent 112 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 51 bytes -- responder (209.208.0.96:53) sent 231 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 47 bytes -- responder (69.8.2.162:53) sent 199 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 44 bytes -- responder (207.68.160.190:53) sent 79 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (142.157.203.157:2690) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.49.144.178:3160) sent 0 bytes
Apr 19 14:47:26: %SEC-6-IPACCESSLOGP: list 101 denied tcp 64.40.102.44(80) -> 216.185.84.185(3024), 1 packet
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.55.199.133:41374) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.96.220.165:26389) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 39 bytes -- responder (63.241.73.200:53) sent 318 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.70.240.138:6346) sent 139 bytes
 --More--         Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 38 bytes -- responder (69.45.78.3:53) sent 349 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 38 bytes -- responder (65.55.238.126:53) sent 82 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.114.86.94:24578) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 105 bytes -- responder (208.172.91.5:53) sent 556 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.66.160.26:37624) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.118.96.135:43752) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (141.109.102.92:6348) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.41.8.109:2056) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 60 bytes -- responder (65.59.226.69:53) sent 251 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (202.131.172.227:28241) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 57 bytes -- responder (206.25.8.69:53) sent 285 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 60 bytes -- responder (208.172.13.230:53) sent 251 bytes
 --More--         Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.88.22.100:9117) sent 119 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.227.210.33:11058) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (142.177.185.59:6346) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.108.153.86:46888) sent 138 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.131:3646) sent 446 bytes -- responder (216.239.59.104:80) sent 447 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.126:1521) sent 1386 bytes -- responder (132.156.10.87:80) sent 14310 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.126:1522) sent 3544 bytes -- responder (132.156.10.87:80) sent 80736 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.23.187.120:12390) sent 88 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.41.93.78:25774) sent 133 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.70.254.27:47365) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.237.23.213:6349) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.164.183.22:6348) sent 0 bytes
 --More--         Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.179.255.233:6346) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.183.184.156:6346) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.150.224.101:6346) sent 139 bytes
Apr 19 14:47:27: %SEC-6-IPACCESSLOGP: list 101 denied tcp 213.224.176.96(62525) -> 216.185.84.185(24399), 1 packet
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.96.231.111:6348) sent 139 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (151.197.200.81:8374) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.39.131.7:6348) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.144.207.7:6348) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.104.18.91:4043) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.41.48.123:34334) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.47.76.135:32528) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.49.223.218:13227) sent 139 bytes
 --More--         Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.107.239.132:60389) sent 102 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.164.59.247:32209) sent 139 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.58:2793) sent 568 bytes -- responder (65.54.179.192:443) sent 2571 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.114.209.58:44873) sent 102 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.66:1902) sent 162 bytes -- responder (65.98.38.30:8001) sent 599 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.174.153.160:3653) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (85.147.58.154:65419) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.49.5.58:60296) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.227.205.150:35204) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.31.89.98:34354) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.166.26.178:28080) sent 0 bytes
Apr 19 14:47:28: %SEC-6-IPACCESSLOGP: list 101 denied tcp 200.94.173.105(1715) -> 216.185.84.185(24399), 1 packet
 --More--         Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.218.107.79:25422) sent 139 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.231.60.170:39314) sent 139 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (62.119.80.168:20077) sent 131 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.141.15.170:50191) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (217.165.84.16:37378) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (210.49.95.135:19543) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.229.112.243:6346) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (144.96.32.220:6346) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.178.195.177:6346) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.31.4.91:4995) sent 139 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.230.164.243:3116) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.35.42.251:1905) sent 0 bytes
 --More--         Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.216.221.152:50702) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.9.118.255:1854) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.47.185.31:33709) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.99.63.35:33694) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (211.28.105.112:17968) sent 0 bytes
Apr 19 14:47:29: %SEC-6-IPACCESSLOGP: list 101 denied udp 201.58.164.59(65074) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.235.233.163:51048) sent 140 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.161.180.3:62551) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.36.166.94:43031) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.111.59.197:22605) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (217.85.216.219:19587) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (200.121.178.198:18772) sent 0 bytes
 --More--         Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.31.195.139:6348) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.143.132.105:6348) sent 139 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (194.74.167.61:6346) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.227.159.101:6346) sent 432 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.16.213.232:11002) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (199.126.43.84:18946) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.151.134.182:20177) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.201.90.95:34321) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.87.197.104:22622) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (209.205.246.62:6348) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.45:3599) sent 1398 bytes -- responder (64.4.52.30:80) sent 3480 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.92:1896) sent 6895 bytes -- responder (207.46.115.12:80) sent 6190 bytes
 --More--         Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.46.204.132:42748) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.248.185.232:51222) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.170.40.23:41333) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (64.13.18.51:38966) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.109.241.223:28062) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (194.165.126.177:21571) sent 0 bytes
Apr 19 14:47:30: %SEC-6-IPACCESSLOGP: list 101 denied udp 64.65.242.222(62574) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (60.50.138.199:19375) sent 128 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.33.87.248:49581) sent 139 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.56.81.19:3150) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.55.228.222:1535) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.39.53.114:1253) sent 0 bytes
 --More--         Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (88.105.49.152:39295) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 30 bytes -- responder (192.26.92.30:53) sent 112 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (71.38.193.202:18731) sent 139 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 32 bytes -- responder (199.7.67.1:53) sent 266 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4378) sent 5669 bytes -- responder (83.85.241.130:6346) sent 15181 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.155.171.85:8964) sent 132 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 30 bytes -- responder (64.125.152.224:53) sent 192 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.203.210.238:43529) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.203.126.47:27184) sent 0 bytes
Apr 19 14:47:31: %SEC-6-IPACCESSLOGP: list 101 denied tcp 71.12.203.145(1768) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (83.115.136.8:23397) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.20.170.129:15965) sent 0 bytes
 --More--         Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.1.3.130:14206) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.17.235.181:10979) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.2.195.140:6348) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.131:6348) sent 29 bytes -- responder (68.60.70.231:41754) sent 84 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (217.164.49.114:36776) sent 139 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3872) sent 14793 bytes -- responder (24.61.172.220:14797) sent 35499 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.148.248.100:62941) sent 102 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.31.42.158:4228) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.47.165.165:4607) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.193.51.15:2995) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.133.125.91:1244) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.37.68.59:3932) sent 0 bytes
 --More--         Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (12.205.49.207:33976) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.139.216.209:31445) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.180.229.165:2982) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.209.163.60:27381) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.144.160.132:6346) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.224.154.111:48997) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (217.42.3.143:11570) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (201.1.197.10:8650) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 38 bytes -- responder (192.52.178.30:53) sent 267 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 38 bytes -- responder (65.98.38.26:53) sent 283 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.44.199.249:31892) sent 139 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (203.218.55.53:39003) sent 139 bytes
 --More--         Apr 19 14:47:32: %SEC-6-IPACCESSLOGP: list 101 denied tcp 205.134.231.54(80) -> 216.185.84.185(4840), 1 packet
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.212.214.177:25339) sent 126 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.47.80.22:41811) sent 138 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:1264) sent 151 bytes -- responder (207.46.96.141:1863) sent 263 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (80.148.22.84:22448) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.244.190.253:7622) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.38.33.210:15045) sent 99 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.115.103.44:16254) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.77.26.245:51115) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.140.73.124:17044) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.213.250.4:6346) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.71:3913) sent 4428 bytes -- responder (65.54.183.192:80) sent 6234 bytes
 --More--         Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4579) sent 11609 bytes -- responder (66.222.201.137:6348) sent 18579 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.253.239.114:62949) sent 102 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.97.60.107:6348) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (201.124.252.167:8659) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.66.180.165:10350) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (71.122.28.172:6346) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.114.241.46:18109) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.65.105.114:56128) sent 132 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.71:3908) sent 486 bytes -- responder (207.46.114.117:1863) sent 385 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3739) sent 17653 bytes -- responder (71.104.201.191:34871) sent 24811 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.82:46545) sent 23 bytes -- responder (141.151.180.233:47559) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (213.105.220.189:13946) sent 139 bytes
 --More--         Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3731) sent 19512 bytes -- responder (84.64.13.124:6346) sent 54060 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4380) sent 9513 bytes -- responder (24.23.128.9:17429) sent 33885 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (217.164.150.174:50940) sent 0 bytes
Apr 19 14:47:34: %SEC-6-IPACCESSLOGP: list 101 denied tcp 24.45.113.11(6346) -> 216.185.84.185(1909), 1 packet
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (64.53.181.167:26056) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.64.57.72:6348) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.80.27.65:6348) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.232.213.238:6346) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.192.21.100:3148) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.85:3548) sent 325 bytes -- responder (207.142.131.202:80) sent 374 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.33.110.194:16253) sent 139 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (200.55.68.246:10280) sent 139 bytes
 --More--         Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.13.135.100:42945) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.83.87.168:30234) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.143.58.87:21749) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.214.90.209:12471) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.186.165.22:6348) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.163.214.129:5341) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.38.24.138:47791) sent 126 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:1139) sent 744 bytes -- responder (72.47.9.62:40903) sent 10006 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3773) sent 15664 bytes -- responder (72.137.13.54:6348) sent 22197 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.33.58.148:6346) sent 139 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4604) sent 8275 bytes -- responder (24.12.113.121:41085) sent 14000 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.137.21.31:48866) sent 0 bytes
 --More--         Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.119.153.182:30690) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.89.229.216:17727) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.29.132.207:28359) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (206.146.86.207:27640) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3737) sent 22418 bytes -- responder (81.79.35.63:21666) sent 53544 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.248.67.127:17840) sent 124 bytes
Apr 19 14:47:35: %SEC-6-IPACCESSLOGP: list 101 denied tcp 68.42.170.33(39390) -> 216.185.84.185(1821), 1 packet
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (83.24.236.41:40193) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.201.215.104:34459) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (80.5.141.101:9544) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.138.119.197:6346) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (220.22.254.67:6346) sent 0 bytes
 --More--         Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.86.131.235:39801) sent 139 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.47.9.62:40903) sent 139 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (61.26.65.241:45777) sent 139 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.20.160.232:1669) sent 80 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.206.160.68:2335) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.191.53.161:60227) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.39.172.39:3948) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.42.234.125:4363) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.179.193.94:6348) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:4942) sent 100 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.177.186.254:6349) sent 139 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) se
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16491072
>Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.206.160.68:2335) sent 0 bytes

Apparently you also have a bunch of VOIP phones? Skype phones? All the Voice traffic is contending for the Internet access . . .
And the VoIP traffic is on the same VLAN as the data traffic. . .  not always a good thing.

Can you address my other questions? What else is out in front of this router?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491144
irmoore
This is all it has, no other interfaces.  One cable coming from hte back of router goes into the cisco switch 2900, one cable coming out of the converter (fibre to ethernet) goes into the same switch, and then that switch feeds to one 3com switch and thats it.  
I am feeding my two servers from this switch directly.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491159
How can I bann or stop these skype voip telephony from my network?  May be from AD? etc
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491197
Irmoore
In total I must have more than 100 users at one point (peak point), I am not sure if my router is doing NAT.  I am running DHCP on a diff server,  I only have 5mbps of connection from ISP.  Please help me to ban all these VOIP things from my network.
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16491308
We can apply acl on your router to ban VOIP Traffic. With AD, you will need to restrict users from installing software, for that you will need to remove software first.

Assuming it is VoIP, can you post your config from the router,

type show runn and post the output

Also, before posting, remove all your public IP Addressess, username/passwords.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491511
show run
Building configuration...

Current configuration:
!
! No configuration change since last restart
!
version 12.0
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname FH_2620
!
logging buffered 65536 debugging
no logging console

!
!
!
!
!
clock timezone EST -5
clock summer-time EDT recurring
ip subnet-zero
 --More--         no ip source-route
ip host accpac.ggw.net 19.20
ip host switch 10.10.10.253
ip name-server xxxx.94
ip name-server xxxx138
ip name-server xxxx.134
!
ip inspect audit-trail
ip inspect name inter tcp
ip inspect name inter udp
ip inspect name inter ftp
ip inspect name inter http
ip inspect name inter smtp
ip inspect name inter tftp
ip inspect name inter cuseeme
ip inspect name inter h323
ip inspect name inter rcmd
ip inspect name inter realaudio
ip inspect name inter sqlnet
ip inspect name inter streamworks
ip inspect name inter vdolive
ip audit notify log
ip audit po max-events 100
 --More--         !
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 no ip directed-broadcast
 speed 100
 full-duplex
 fair-queue 64 256 0
!
interface FastEthernet0/0.10
 description main CAMPUS VLAN
 encapsulation dot1Q 10
 ip address 10.10.10.254 255.255.255.0
 no ip redirects
 no ip directed-broadcast
 ip nat inside
!
 --More--         interface FastEthernet0/0.801
 description CONNECTION TO BUR CAMPUS
 encapsulation dot1Q 801
 ip address 10.10.11.254 255.255.255.0
 no ip redirects
 no ip directed-broadcast
 ip nat inside
!
interface FastEthernet0/0.908
 description INTERNET VIA company
 bandwidth 1000000
 encapsulation dot1Q 908
 ip address x.x.x.62 255.255.255.252
 ip access-group 101 in
 no ip redirects
 no ip directed-broadcast
 ip nat outside
 ip inspect inter out
!
ip nat translation timeout 1600
ip nat pool inter x.x.x.185 x.x.x.185 netmask 255.255.255.248
ip nat inside source list 1 pool inter overload
ip nat inside source static tcp 10.10.10.101 82 66.x.x.x.x 82 extendable
 --More--         ip nat inside source static tcp 10.10.10.101 83 66.x.x.x.x 80 extendable
ip nat inside source static tcp 10.10.10.101 82 x.x.x.x 80 extendable
ip nat inside source static tcp 10.10.10.101 81 .153 80 extendable
ip nat inside source static tcp 10.10.10.3 5336 189 5336 extendable
ip nat inside source static 10.10.10.101 189
ip nat inside source static 10.10.10.18 .187
ip nat inside source static 10.10.10.20 .186
ip nat inside source static 10.10.10.99 .190
ip nat inside source static 10.10.10.3 .188
ip nat inside source static tcp 10.10.10.20 8080 186 80 extendable
ip nat inside source static tcp 10.10.10.20 5336 .186 5336 extendable
ip nat inside source static udp 10.10.10.20 500 .186 500 extendable
ip nat inside source static 10.10.11.8 .157
ip classless
ip route 0.0.0.0 0.0.0.0 x.x.x.x.61
no ip http server
!
!
map-list nat
!
map-list ip
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.11.0 0.0.0.255
 --More--         access-list 98 permit 24.244.193.6
access-list 98 permit x.x.x..126
access-list 101 permit tcp host x.x.x.x.20 any eq 135
access-list 101 remark Inbound Internet Access List
access-list 101 permit tcp host .126 host .62 eq telnet
access-list 101 permit tcp host .6 host .62 eq telnet
access-list 101 permit tcp host 179 host .62 eq telnet
access-list 101 permit tcp host .2 host .62 eq telnet
access-list 101 permit tcp any host .153 eq www
access-list 101 permit tcp any host .154 eq www
access-list 101 permit tcp any host .155 eq www
access-list 101 permit tcp any host .155 eq 82
access-list 101 permit tcp any host 157
access-list 101 permit tcp any host .189 eq 5336
access-list 101 permit esp any host 4.186
access-list 101 permit esp any host 4.187
access-list 101 permit ahp any host 4.186
access-list 101 permit ahp any host 4.187
access-list 101 permit tcp any host .186 eq www
access-list 101 permit tcp any host 186 eq 8080
access-list 101 permit tcp any host .186 eq 5336
access-list 101 permit udp any host .186 eq isakmp
access-list 101 permit udp any host 187 eq isakmp
 --More--         access-list 101 permit tcp any host .187 eq smtp
access-list 101 permit tcp any host .187 eq www
access-list 101 permit tcp any host 187 eq 443
access-list 101 permit tcp any host .187 eq 8098
access-list 101 permit tcp any host 187 eq 8099
access-list 101 permit tcp any host .187 eq pop3
access-list 101 permit tcp any host 4.189 eq 1723
access-list 101 permit gre any host .189
access-list 101 permit tcp any host .189 eq www
access-list 101 permit tcp any host .189 eq smtp
access-list 101 permit tcp any host 189 eq pop3
access-list 101 permit tcp any host .189 eq 8080
access-list 101 permit tcp any host .189 eq 8383
access-list 101 permit tcp any host .189 eq 8181
access-list 101 permit tcp any host .189 eq 19815
access-list 101 permit tcp any host .189 eq 81
access-list 101 permit tcp any host .189 eq 82
access-list 101 permit tcp any host .189 eq 8093
access-list 101 permit tcp any host .188 eq ftp
access-list 101 permit tcp any host .190 eq www
access-list 101 permit ip any host 4.190
access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
access-list 101 permit udp host 17.35 host 4.62 eq ntp
 --More--         access-list 101 permit udp host .34 host 84.62 eq ntp
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any traceroute
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any ttl-exceeded
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any source-quench
access-list 101 permit icmp any any packet-too-big
access-list 101 deny   ip any any log
banner motd ^CC

*** UNAUTHORIZED ACCESS IS PROHIBITED!  ALL ACTIVITY IS LOGGED! ***

^C
!
line con 0
 login
 transport input none
line aux 0
 --More--         line vty 0 3
 logging synchronous
 login
line vty 4
 logging synchronous
 login
 transport input pad v120 telnet rlo
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491592
May be this will Help:
I have two wireless access points (linksys WRT54GS) feeding these culprit users: may be I can stop any port on these routers??? instead of screwing the main cisco router.  Do you agree?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16491678
Agree if you can't control users, control the traffic at the router.
The AP's probably don't have a way to filter the traffic, but you can easily block it at the router with an acl:

access-list 102 permit udp any any eq domain
access-list 102 deny udp any any
access-list 102 permit ip any any

interface Fast 0/0.10
 ip access-group 102 in


Do you have access to the switch web interface? Look at the port statistics page and look for error counters at the switchport.

0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491739
irmoore
OK agreed.
I am not that good with routers acl, please mention in steps:
what are the opening commands and what are the closing ones.

which interface to open first?


access-list 102 permit udp any any eq domain (which domain my domain or skype?)
access-list 102 deny udp any any
access-list 102 permit ip any any

interface Fast 0/0.10
 ip access-group 102 in

which commands are closing commands
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16491781
Yes I can access the switch:
do you want to see sh interfaces? or anything else let me know the command please
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16491851
router#config term
router(config)#access-list 102 permit udp any any eq 53  (allow dns domain resolution)
router(config)#access-list 102 deny udp any any
router(config)#access-list 102 permit ip any any
router(config)#interface Fast 0/0.10
router(config-if)# ip access-group 102 in
router(config-if)#end
router#

That will stop skype users in their tracks.

On the switch, "show interface fast 0/xx" where xx = interface connecting to Public Internet feed
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16492029
irmoore
-which line is blocking skype?
-does it matter to have access-list 102 as mine say 101?




show interfaces
VLAN1 is up, line protocol is down
  Hardware is CPU Interface, address is 0006.28ab.1580 (bia 0006.28ab.1580)
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 1000 bits/sec, 1 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     80774 packets input, 8570578 bytes, 0 no buffer
     Received 80714 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 input packets with dribble condition detected
     54 packets output, 3933 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
 --More--         VLAN10 is up, line protocol is up
  Hardware is CPU Interface, address is 0006.28ab.1580 (bia 0006.28ab.1580)
  Internet address is 10.10.10.105/24
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA
  ARP type: ARPA, ARP Timeout 04:00:00
 --More--         FastEthernet0/1 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1581 (bia 0006.28ab.1581)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 22:39:33, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     1 packets input, 64 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     11 packets output, 2024 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/2 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1582 (bia 0006.28ab.1582)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 90000 bits/sec, 48 packets/sec
  5 minute output rate 431000 bits/sec, 60 packets/sec
     3343416 packets input, 930121494 bytes
     Received 97198 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 7 ignored
     0 watchdog, 58159 multicast
     0 input packets with dribble condition detected
     3901412 packets output, 2205781228 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/3 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1583 (bia 0006.28ab.1583)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 22:39:38, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     1 packets input, 64 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     7 packets output, 1240 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/4 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1584 (bia 0006.28ab.1584)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 2000 bits/sec, 2 packets/sec
  5 minute output rate 15000 bits/sec, 5 packets/sec
     46615 packets input, 17227632 bytes
     Received 453 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 37 multicast
     0 input packets with dribble condition detected
     127370 packets output, 34700564 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/5 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1585 (bia 0006.28ab.1585)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:01, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 42000 bits/sec, 16 packets/sec
     1102913 packets input, 611446168 bytes
     Received 9126 broadcasts, 0 runts, 0 giants, 0 throttles
     13 input errors, 0 CRC, 13 frame, 0 overrun, 0 ignored
     0 watchdog, 6 multicast
     0 input packets with dribble condition detected
     2189797 packets output, 680041524 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/6 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1586 (bia 0006.28ab.1586)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 41000 bits/sec, 16 packets/sec
  5 minute output rate 9000 bits/sec, 6 packets/sec
     1787054 packets input, 665118959 bytes
     Received 21583 broadcasts, 0 runts, 0 giants, 0 throttles
     3 input errors, 0 CRC, 3 frame, 0 overrun, 2 ignored
     0 watchdog, 54 multicast
     0 input packets with dribble condition detected
     963004 packets output, 536256504 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/7 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1587 (bia 0006.28ab.1587)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 22:39:42, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     1 packets input, 64 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     7 packets output, 1240 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/8 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1588 (bia 0006.28ab.1588)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 240000 bits/sec, 22 packets/sec
  5 minute output rate 21000 bits/sec, 18 packets/sec
     1428929 packets input, 760448542 bytes
     Received 2955 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     1547732 packets output, 327016383 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/9 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1589 (bia 0006.28ab.1589)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 22:39:44, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     1 packets input, 64 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     7 packets output, 1240 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/10 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.158a (bia 0006.28ab.158a)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 633000 bits/sec, 64 packets/sec
  5 minute output rate 78000 bits/sec, 39 packets/sec
     6317717 packets input, 3851888302 bytes
     Received 102292 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 2 ignored
     0 watchdog, 94985 multicast
     0 input packets with dribble condition detected
     3649201 packets output, 431566509 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
 --More--              0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/11 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.158b (bia 0006.28ab.158b)
  Description: Trunk to Router
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 252/255, txload 2/255, rxload 2/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:25, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 860000 bits/sec, 124 packets/sec
  5 minute output rate 885000 bits/sec, 143 packets/sec
     12916991 packets input, 1460368320 bytes
     Received 1368 broadcasts, 625265 runts, 0 giants, 0 throttles
     625265 input errors, 0 CRC, 0 frame, 0 overrun, 26 ignored
     0 watchdog, 1359 multicast
     0 input packets with dribble condition detected
     14197033 packets output, 1673265181 bytes, 0 underruns
     0 output errors, 0 collisions, 3 interface resets
     0 babbles, 0 late collision, 0 deferred
 --More--              0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
 --More--         FastEthernet0/12 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.158c (bia 0006.28ab.158c)
  Description: Connection to Media Converter
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:01, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 226000 bits/sec, 63 packets/sec
  5 minute output rate 660000 bits/sec, 84 packets/sec
     6363988 packets input, 1885396156 bytes
     Received 250947 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 11 ignored
     0 watchdog, 224022 multicast
     0 input packets with dribble condition detected
     9076769 packets output, 310500242 bytes, 0 underruns
     0 output errors, 0 collisions, 3 interface resets
     0 babbles, 0 late collision, 0 deferred
 --More--              0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16492111
irmoore
how to undo the above mentioned commands, in case the router does not cooperate
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16492189
Also my existing 101 access list is applied onto .908 internet via company interface and we are going to apply it on 0/0.10 Main campus will that matter?
Sorry to ask you so many questions before doing this, just want to make sure.
Thanks
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16492320
access-list 102 permit udp any any eq domain <== this line allows DNS
access-list 102 deny udp any any  <== this line will block Skype calls (until they tunnel over tcp 80)
access-list 102 permit ip any any <== this line permits everything else

Yes, it must be a different acl number than your current acl 101
101 is applied inbound on your "wan" interface
A new acl to block skype calls must be applied inbound to the local LAN interface


FastEthernet0/11 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.158b (bia 0006.28ab.158b)
  Description: Trunk to Router
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:25, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 860000 bits/sec, 124 packets/sec
  5 minute output rate 885000 bits/sec, 143 packets/sec
     12916991 packets input, 1460368320 bytes
     Received 1368 broadcasts, 625265 runts, 0 giants, 0 throttles
     625265 input errors, 0 CRC, 0 frame, 0 overrun, 26 ignored   <== I'm concerned about these high numbers of input errors
     0 watchdog, 1359 multicast
     0 input packets with dribble condition detected
     14197033 packets output, 1673265181 bytes, 0 underruns
     0 output errors, 0 collisions, 3 interface resets                   <== no output errors here is good news!
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16492362
>we are going to apply it on 0/0.10 Main campus will that matter?
Yes, it will matter. Please don't apply same acl to two different interfaces...
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16494312
irmoore
=====>625265 input errors, 0 CRC, 0 frame, 0 overrun, 26 ignored   <== I'm concerned about these high numbers of input errors
-This is the port in which the router is going in.Do you think these errors are coming from the port next to it which is the converter (fiber to ethernet) is going in??  Should I get my converter checked?
-ok I will apply the acl 102 to 0/0.10 for blocking the skype.
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16494406
before you do anything, do this

on the router type

clear counters

then wait few hours and check again.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16494610
Yes, I'd get the fiber converters checked out.
Are these converters full-duplex capable?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16498189
naveedb:
what would clear counter do?
Should I apply the acl after the clear counters?

Irmoore
Yes it is a full duplex capable (Etherwan Xpresso media converter)

Thanks
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16498870
it will reset the counters and then we can see how many errors are seen during certain time.

You can do it anytime, ACL is a seperate issue, this is only to narrow down on errors.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16499284
IC I will do it right away.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16499408
I cleared the counters on the Switch (not the router) and now when I checked the same interface 'fastethernet 0/11 trunk to the router' has 798 errors (it was 65 thousand something), this interface has a router cable going in.
Suggestions?
Thanks
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16500737
naveedb
The input errors are now 25000 (increasing).  
can you please also tell me how and where in the Active directory I can block VOIP and chat programs like  skype, yak etc.  
Thanks
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16501033
Can you also do the same on router and see if we see the errors count?

How is the router connected to switch, cat5e? Can you change the cable? and see if errors keep increasing?

AD, will address after we have worked on the errors.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16501303
naveedb
Router interfaces have no errors, its on the switch only.
I think its a cheaper cable (I can go right now and buy a good one, should I get cat 5 e ?)
ok
Thanks
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16501359
I checked the labels it says UTP cat 5
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16501576
Do you have a spare lying around that you can try?

Also, can you plug it into another port on the switch and see if errors continue. It is very strange to see errors only at one end and not the other. We are sue looking at the right port?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16501765
Yes I do have one spare I will change it right now
Yes its the right port on the switch.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16501811
ok I cleared the counters and changed the cables and checked interfaces,
the errors started right away now they are 271
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16502282
And you are positive that they are not showing on the router?

Can you post running config from switch?
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16506743
naveedb
I have checked again the router interfaces and all of them are clean.

Current configuration of SWITCH:
!
version 12.0
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname NAME OF SWITCH
!
enable
!
!
!
!
!
!
ip subnet-zero
!
!
!
interface FastEthernet0/1
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/2
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/3
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/4
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/5
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/6
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/7
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/8
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/9
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/10
 switchport access vlan 10
 spanning-tree portfast
!
interface FastEthernet0/11
 description Trunk to Router
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,10,801,908,1002-1005
 switchport mode trunk
 spanning-tree portfast
!
interface FastEthernet0/12
 description Connection to Media Converter
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 908
 switchport trunk allowed vlan 1,10,801,908,1002-1005
 switchport mode trunk
 spanning-tree portfast
!
interface VLAN1
 no ip address
 no ip directed-broadcast
 no ip route-cache
 shutdown
!
interface VLAN10
 ip address 10.10.10.105 255.255.255.0
 no ip directed-broadcast
 no ip route-cache
!
ip default-gateway 10.10.10.254
snmp-server engineID local XXXXXXXXXXXXXXXXX
snmp-server community private RW
snmp-server community public RO
!
line con 0
 exec-timeout 0 0
 
 loggi

 transport input none
 stopbits 1
line vty 0 4

 logging synchronous
 login
line
 
 logging synchronous
 login
!
end








0
 
LVL 10

Expert Comment

by:naveedb
ID: 16506800
Quick look, I do not see anything wrong, except that you are trunnking some VLANS which are not configured on the router 1002-1005 which can be removed.

What about "show diagnostic "
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16506878
_2912#show diags ?
  addr-move  Show learned address movement count and rate
  link-flap  Show link up/down count and rate

naveed which command you need?





0
 
LVL 4

Author Comment

by:amanzoor
ID: 16507114
_2912#show diags


FernHill_2912#show diags addr-move
Interface                 Total   Last Min
-------------------- ---------- ----------
FastEthernet0/2             431          0
FastEthernet0/4               1          0
FastEthernet0/10            503          0

_2912#show diags link-flap
Interface                 Total   Last Min
-------------------- ---------- ----------
FastEthernet0/2               1          0
FastEthernet0/4               4          0
FastEthernet0/5               3          0
FastEthernet0/6               4          0
FastEthernet0/8               1          0
FastEthernet0/10              1          0
FastEthernet0/11              8          0
FastEthernet0/12              1          0
_2912#


0
 
LVL 10

Expert Comment

by:naveedb
ID: 16507564
Before we do anything, can you connect the router to a different port, just reconfigure it with trunk settings same sa fa 0/11

I just want to eliminate all things that can cause input errors.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16509157
naveedb
I am not good with routers.  Give me the commands and which interface to apply them,  and I will switch the router port to different one.
Thanks
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16509853
Don't do anything with the router, the changes need to be made on the switch.

Which port can you use on the switch for testing. Right now it is connected on fa 0/11 can we test on fa 0/10? You will need to disconnect what is connected there to do the testing. Once testing is done, we will need to reverse the changes.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16513107
Naveedb
I can use port 7 or 8 on the switch for testing.  Right now there is nothing on them.  Sure with your help I can revert the changes.
This might help:
Since we are using the VLAN to our other branch, do you need to see the interfaces or show run from that switch as well?
THanks
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16513250
Maybe latter, lets do one step at a time. So, login to the switch and type the following commands in order

enable
config term
inteface fa 0/7
 description Trunk to Router-TEST PORT
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,10,801,908
 switchport mode trunk
 end

You should now be able to connect the router to port 7, wait 2-3 minutes before it comes up.

Then clear counter and show interface fa 0/7 to see if errors show up again.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16513541
Thanks Naveed
PLease also let me know how to undo it (if in case I do something wrong)  .
I will be able to do all the commands on Monday (I will be away from the office for sat and sun).
I will do and let you know.
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16514962


Sure, after you have tested it for few hours, you can either power cycle the switch (do not save changes with copy run start) OR log back into the switch and issue the following commands.

enable
config term
inteface fa 0/7
 no description Trunk to Router-TEST PORT
 duplex auto
 speed auto
 no switchport trunk encapsulation dot1q
 no switchport trunk allowed vlan 1,10,801,908
 no switchport mode trunk
 switchport access vlan 10
 spanning-tree portfast
 end

After you are done, type show run and see if fa 0/7 look like this to confirm:

interface FastEthernet0/7
 switchport access vlan 10
 spanning-tree portfast
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16516691
interface FastEthernet0/12
 description Connection to Media Converter
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 908  <== I'm wondering if this is interfering with routing.....

Setting a switchport to native vlan other than 1 disables vlan tagging for that vlan.
The router configured with a sub-interface .908 requires the vlan tag for that interface.

Is there a particular reason that fa0/12 is set to native vlan 908 ?

Try removing that from this interface and see if it makes any difference..

interface fast 0/12
  no switchport trunk native vlan 908


0
 
LVL 4

Author Comment

by:amanzoor
ID: 16524947
naveeb I changed the port for router to f 0/7, after a while the input errors started look under please:

FastEthernet0/1 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1581 (bia 0006.28ab.1581)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 5d16h, output hang never
  Last clearing of "show interface" counters 00:00:06
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/2 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1582 (bia 0006.28ab.1582)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 2/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:01, output hang never
  Last clearing of "show interface" counters 00:00:07
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 367000 bits/sec, 209 packets/sec
  5 minute output rate 823000 bits/sec, 222 packets/sec
     367 packets input, 71851 bytes
     Received 2 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     481 packets output, 403970 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/3 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1583 (bia 0006.28ab.1583)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 5d16h, output hang never
  Last clearing of "show interface" counters 00:00:07
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/4 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1584 (bia 0006.28ab.1584)
  MTU 1500 bytes, BW 0 Kbit, DLY 0 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 3d17h, output hang never
  Last clearing of "show interface" counters 00:00:07
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/5 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1585 (bia 0006.28ab.1585)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:01, output hang never
  Last clearing of "show interface" counters 00:00:07
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 26000 bits/sec, 1 packets/sec
  5 minute output rate 86000 bits/sec, 38 packets/sec
     205 packets input, 198245 bytes
     Received 2 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     569 packets output, 135732 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/6 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1586 (bia 0006.28ab.1586)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:01, output hang never
  Last clearing of "show interface" counters 00:00:07
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 77000 bits/sec, 34 packets/sec
  5 minute output rate 7000 bits/sec, 4 packets/sec
     381 packets input, 101042 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     49 packets output, 10543 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/7 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1587 (bia 0006.28ab.1587)
  Description: Trunk to Router-Test Port
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 240/255, txload 2/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:19, output 00:00:00, output hang never
  Last clearing of "show interface" counters 00:00:08
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 766000 bits/sec, 154 packets/sec
  5 minute output rate 801000 bits/sec, 177 packets/sec
     2184 packets input, 1962102 bytes
     Received 0 broadcasts, 324 runts, 0 giants, 0 throttles
     324 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     2612 packets output, 2060616 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/8 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.1588 (bia 0006.28ab.1588)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters 00:00:08
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 640000 bits/sec, 182 packets/sec
  5 minute output rate 267000 bits/sec, 174 packets/sec
     144 packets input, 25711 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     171 packets output, 28192 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/9 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.1589 (bia 0006.28ab.1589)
  MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex , Auto Speed , 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 5d16h, output hang never
  Last clearing of "show interface" counters 00:00:08
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/10 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.158a (bia 0006.28ab.158a)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:00:01, output hang never
  Last clearing of "show interface" counters 00:00:09
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 638000 bits/sec, 69 packets/sec
  5 minute output rate 83000 bits/sec, 42 packets/sec
     926 packets input, 987439 bytes
     Received 10 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 10 multicast
     0 input packets with dribble condition detected
     591 packets output, 193247 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/11 is down, line protocol is down
  Hardware is Fast Ethernet, address is 0006.28ab.158b (bia 0006.28ab.158b)
  Description: Trunk to Router
  MTU 1500 bytes, BW 0 Kbit, DLY 0 usec,
     reliability 236/255, txload 131/255, rxload 143/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:05:23, output 00:04:55, output hang never
  Last clearing of "show interface" counters 00:00:11
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 369000 bits/sec, 39 packets/sec
  5 minute output rate 381000 bits/sec, 47 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
FastEthernet0/12 is up, line protocol is up
  Hardware is Fast Ethernet, address is 0006.28ab.158c (bia 0006.28ab.158c)
  Description: Connection to Media Converter
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 2/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:01, output hang never
  Last clearing of "show interface" counters 00:00:21
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 460000 bits/sec, 125 packets/sec
  5 minute output rate 940000 bits/sec, 149 packets/sec
     3169 packets input, 1655640 bytes
     Received 78 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 68 multicast
     0 input packets with dribble condition detected
     3762 packets output, 3226905 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16525552
guys
what is the meaning of the lines above my show run in router:

hostname FH_2620
!
logging buffered 65536 debugging
no logging console
enable !
!
!
!
!
clock timezone EST -5
clock summer-time EDT recurring
ip subnet-zero
no ip source-route
ip host accpac.ggw.net x.x.x.x   <--------we are using accpac its the accpac external ip here?
ip host switch 10.10.10.253<---I can access my switch with 10.10.10.105 instead of this ip, so should it be 10.10.10.105?
ip name-server x.x.x.x<-------this is fine
ip name-server x.x.x.x<------------I am not sure about these server External Ip what should go here
ip name-server x.x.x.x<------------I am not sure about these server External Ip what should go here
!
ip inspect audit-trail    <-------------------------what is this?
ip inspect name inter tcp   <-------------------------what is this?
ip inspect name inter udp   <-------------------------what is this?
ip inspect name inter ftp   <-------------------------what is this?
ip inspect name inter http   <-------------------------what is this?
ip inspect name inter smtp   <-------------------------what is this?
ip inspect name inter tftp   <-------------------------what is this?
ip inspect name inter cuseeme   <-------------------------what is this?
ip inspect name inter h323   <-------------------------what is this?
ip inspect name inter rcmd   <-------------------------what is this?
ip inspect name inter realaudio    <-------------------------what is this?
ip inspect name inter sqlnet   <-------------------------what is this?
ip inspect name inter streamworks   <-------------------------what is this?
ip inspect name inter vdolive   <-------------------------what is this?
ip audit notify log
ip audit po max-events 100
!
!
Thanks





0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16525780
The "ip host xxx " entries are nothing more than an internal hosts file for the router itself to use.
Example:
router#switch  <== this command will attempt to telnet to host named "switch" which is 10.10.10.253
Or router#ping switch
 ping 10.10.10.253

The "ip inspect name xxx <protocol>" is the firewall feature set of the router. This inspect list creates temporary access-lists for outgoing connections to allow the reponses back in. Each protocol has a set behavior pattern and the inpsect makes sure that behavior conforms to the rules.

The error counters on the switchport interface could be a result of the vlan tagging issue I raised in my previous post.
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16525833
Easy question!

Hostname is just used to map an IP Address with hostname on the router (just like hosts file on Windows/Unix machines). Localized to router so will not effect anything else. You can not use this hostname/ip mapping except when you are on the router itself.

ip-name server is DNS server.

ip-inspect statements are used for Context-Based Access Control. Normally your router will inspect the protocols to verify they have not been tampered with to avoid like Denial of Service attacks.

None of these statements will create errors on the port.

Not easy question:

So, we have elimiated cable, port on switch. Now that leaves the configuration and router port.

Can you post your output from the following commands on router and switch

show vlan

0
 
LVL 4

Author Comment

by:amanzoor
ID: 16525849
irmoore
thanks, sure I can remove the tag from the switch. If something does't work properly .....can I get my switch to go back to original settings by simply restarting the switch?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16526042
Yes, as long as you don't save the config with "write memory" or "copy run start", then a reboot will always go right back where it was.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16526052
naveed
FH_2620#show vlans from router:

Virtual LAN ID:  10 (IEEE 802.1Q Encapsulation)

   vLAN Trunk Interface:   FastEthernet0/0.10

   Protocols Configured:   Address:              Received:        Transmitted:
           IP              10.10.10.254          33517709            20717422

Virtual LAN ID:  801 (IEEE 802.1Q Encapsulation)

   vLAN Trunk Interface:   FastEthernet0/0.801

   Protocols Configured:   Address:              Received:        Transmitted:
           IP              10.10.11.254           4040769             3680817

Virtual LAN ID:  908 (IEEE 802.1Q Encapsulation)

   vLAN Trunk Interface:   FastEthernet0/0.908

   Protocols Configured:   Address:              Received:        Transmitted:
           IP              Our router external IP         22372267            34746425

show vlan from switch:


_2912#show vlan
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active
10   VLAN0010                         active    Fa0/1, Fa0/2, Fa0/3, Fa0/4,
                                                Fa0/5, Fa0/6, Fa0/8, Fa0/9,
                                                Fa0/10
801  VLAN0801                         active
850  Halton                           active
851  Halton_ASAP                      active
908  VLAN0908                         active
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        1002   1003
10   enet  100010     1500  -      -      -        -    -        0      0
801  enet  100801     1500  -      -      -        -    -        0      0
850  enet  100850     1500  -      -      -        -    -        0      0
851  enet  100851     1500  -      -      -        -    -        0      0
908  enet  100908     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      0      -        -    -        1      1003
1003 tr    101003     1500  1005   0      -        -    srb      1      1002
1004 fdnet 101004     1500  -      -      1        ibm  -        0      0
1005 trnet 101005     1500  -      -      1        ibm  -        0      0
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16526246
Irmoore:
*************
interface FastEthernet0/12
 description Connection to Media Converter
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 908  <== I'm wondering if this is interfering with routing.....

Setting a switchport to native vlan other than 1 disables vlan tagging for that vlan.
The router configured with a sub-interface .908 requires the vlan tag for that interface.

Is there a particular reason that fa0/12 is set to native vlan 908 ?

Try removing that from this interface and see if it makes any difference..

interface fast 0/12
  no switchport trunk native vlan 908
**************************************

I removed it from this interface: here is the show run from the switch, the network got disconnected from the Internet, so I have to restart the swicth and everything came back:

interface FastEthernet0/12
 description Connection to Media Converter
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,10,801,908,1002-1005
 switchport mode trunk
 spanning-tree portfast
!
interface VLAN1
 no ip address
 no ip directed-broadcast
 no ip route-cache
 shutdown
!
interface VLAN10
 ip address 10.10.10.105 255.255.255.0
 no ip directed-broadcast
THanks

0
 
LVL 79

Accepted Solution

by:
lrmoore earned 1000 total points
ID: 16526491
Oops . . . .
This is looking like something not easily solved in this type forum. You may have to buckle down and get someone to come onsite and help sort this thing out for you.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16526695
Thanks Irmoore for your help.  I will get someone to fix it, I really appreciate the time you took looking into my problem.  
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 16527069
I hate that we can't get  you going here. I just went onsite with a customer that had very similar issues where the whole network ground to a crawl and we kept seeing error counters on the firewall interfaces that were 'other' errors.
Went in looking for a network problem or switch loop. What I found was a dns loop that was causing so much network traffic that it took down the whole network. Primary dns server listed proxy server as forwarder, proxy server listed remote site dns servers as forwarders. Primary dns server did not have remote secondary dns servers in the list of servers that it would exhange zone files with so they weren't getting the zone information at all. Fixed that in 5 minutes flat and the network was humming right along faster than ever with a bunch of happy people.

Error packets ended up being dual-homed server NIC teaming heartbeats which did not affect the network.

Network issues are not always solved by just looking at the primary symptoms.

Hope you get someone good to help you out!

0
 
LVL 10

Assisted Solution

by:naveedb
naveedb earned 1000 total points
ID: 16527599
Can you try the following on switch:

interface FastEthernet0/11
no switchport trunk allowed vlan 1,10,801,908,1002-1005
switchport trunk allowed vlan 10, 801, 908
exit

See if it makes any difference on the errors counter. I agree with Irmoore, you may need to get someone one site for the errors.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 16528458
OK guys
Your suggestions with DNS tempted me to check DNS event viewer.  I am getting lots of Event Id: 4515 saying the zone 'ourdomain' was previously loaded...........................
may be this is causing the intermittence in the internet connection??
Help
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show you step-by-step instructions to build your own NTP CentOS server.  The network diagram shows the best practice to setup the NTP server farm for redundancy.  This article also serves as your NTP server documentation.
In this article I will be showing you how to subnet the easiest way possible for IPv4 (Internet Protocol version 4). This article does not cover IPv6. Keep in mind that subnetting requires lots of practice and time.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question