Start Free Trial

asked on

Internet gets very very slow or sometimes does not show pages

Hi all
I am running windows 2003 server ent edition with AD, DHCP, DNS. Using one of the default gateway as our mailserver. Most of the times the internet gets really really slow and the page loading takes forever and sometimes the page would simply not show up. I never had any problems before.
How would I check where the problem lies and how can I rectify it.
Thanks

> Using one of the default gateway as our mailserver.
You mean the mailserver is also your primary router to the Internet?
Do you have any other router or firewall? Are you using Proxy server?
Is this server dual-homed with 2 NIC's?
Can you post output of "route print"

Assuming you have a broadband or similar connection and we are not dealing with Dial-up.

It could be one of two; your DNS is slow or your Internet is maxing out on bandwidth unless there is a hardware issue somewhere.

To verify DNS response, when the system is fast ping www.google.com and note down the output with time it took for ping to start. Do the same when it is slow. See if there is any difference in the time it took for the ping to start (IP Address to show-up).

To verify bandwidth, do a speed test, if your ISP provides one, would be good. If not, run something from www.dslreports.com and check the difference.

Post your findings so we can further narrow it down.

ASKER

Irmoore:
I mean default gateway for the internet. Yes I do have a router 2600. No proxy. Yes the server is dual homed with 2 NICS. Here is the route print.
H:\>route print

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10002 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
0x10003 ...00 02 55 32 c1 d5 ...... IBM 10/100 EtherJet PCI Management Adapter
0x10004 ...00 09 6b 98 0a a4 ...... IBM Netfinity 10/100 Ethernet Security Ada
er 2
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.10.10.254 10.10.10.3 1
0.0.0.0 0.0.0.0 10.10.10.254 10.10.10.101 1
10.10.10.0 255.255.255.0 10.10.10.3 10.10.10.3 1
10.10.10.0 255.255.255.0 10.10.10.101 10.10.10.101 1
10.10.10.3 255.255.255.255 127.0.0.1 127.0.0.1 1
10.10.10.101 255.255.255.255 127.0.0.1 127.0.0.1 1
10.255.255.255 255.255.255.255 10.10.10.3 10.10.10.3 1
10.255.255.255 255.255.255.255 10.10.10.101 10.10.10.101 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.168.0.230 255.255.255.255 127.0.0.1 127.0.0.1 50
224.0.0.0 240.0.0.0 10.10.10.3 10.10.10.3 1
224.0.0.0 240.0.0.0 10.10.10.101 10.10.10.101 1
255.255.255.255 255.255.255.255 10.10.10.3 10.10.10.3 1
255.255.255.255 255.255.255.255 10.10.10.101 10.10.10.101 1
Default Gateway: 10.10.10.254
===========================================================================
Persistent Routes:
None

H:\>

NaveedB:
Test results are:
dslreports.com speed test result on 2006-04-18 15:57:05 EST:
479 / 4211
Your download speed : 479 kbps or 59.8 KB/sec.
Your upload speed is much faster than down.. have you tweaked?

Your upload speed : 4211 kbps or 526.4 KB/sec.

PS: Welcome to dslreports.com! Run more tests! see

Notice I am timing out in pings:
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Request timed out.
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=5ms TTL=246
Reply from 72.14.207.99: bytes=32 time=5ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=8ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=8ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Request timed out.
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=8ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=7ms TTL=246
Reply from 72.14.207.99: bytes=32 time=6ms TTL=246
Reply from 72.14.207.99: bytes=32 time=13ms TTL=246

Help please.

To start: you have two default gateways listed:

Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.10.10.254 10.10.10.3 1
0.0.0.0 0.0.0.0 10.10.10.254 10.10.10.101 1

You will need to take one out. If you want to keep the mailserver as your default gateway, specify only on the NIC that is connected with mailserver and remove default gateway from the other NIC. If you need to connect to a Network on other NIC through second gateway, you can add static routes.

We will need more information on your networks structure, like the networks it is connected to and why it has two NICs etc.

ASKER

Thanks Naveedb
These NICS are from the same machine (10.10.10.3 and 10.10.10.101), right now when my clients browse to the internet undre there network connections they get the IP from DHCP, and the default gateway for them is 10.10.10.3 which is fine. I am not sure why it had two NICS. I can remove the default gateway from the other NIC i.e
the configuration of the NIC card 10.10.10.101 will become:
ip address 10.10.10.101
subnet mask: 255.255.255.0
defualt gateway:
DNS: primary 10.10.10.3
: Secondary 10.10.10.18
Is that fine?

Suggest disabling the 2nd NIC with 10.10.10.101 IP address on it...
That's why one of the first questions I asked was if it had 2 in it..

If this fixes all issues, then If 2x NIC's are requirement for resiliency we can work on a solution for you for that.

ASKER

ok Irmoore
I will just disable it and let you know if the issue is resolved.
Thanks

ASKER

Hi
Here is what i did:
I assigned static address to my machine and made my router as the default gateway i.e 10.10.10.254 and then tried pinging to 'www.google.ca' it times out after few seconds I wonder if the hardware problem lies somewhere on the switch or the router.
I disabled 10.10.10.101 then tried pinging 'www.google.ca' it times out after few seconds as well.
Help plz

Can you ping by IP address? Try pinging 198.6.1.2

What about your DNS? What IP are you setting for DNS resolution when you assign static IP?

ASKER

While pinging the IP it still times out
My DNS server is running on the same 10.10.10.3 machine. SO my DNS is 10.10.10.3 and secondary is 10.10.10.18

Can you ping your default gateway 10.10.10.254?
What kind of router is this? Have you tried rebooting it?

ASKER

yes I can ping my router 10.10.10.254
It is Cisco 2600, I rebooter my fibre optics to ethernet converter, router and the main switch (2900) last night, by pulling out the electric cords, but to no avail.

ASKER

correction:
>>>>>yes I can ping my router 10.10.10.254
It is Cisco 2600, I rebooted..............

ASKER

OK i pinged my internal router 10.10.10.254 and external ip address 'www.google.ca'. For some reason it only times out on the external address pings.

Do you have access to the router console?
Can you ping external addresses from the router?
Did you reboot the router <after> disabling the 2nd NIC on the server? It could be an ARP cache timeout issue with the router.

router>ping 198.6.1.2
Or manually clear arp cache:
router>enable
password:
router#clear arp *

ASKER

Yes Irmoore I can access the router console.
I will try pinging external addresses from the router and let you know.
which one is required:
-1- Did you reboot the router <after> disabling the 2nd NIC on the server?
-2-router#clear arp *
will one of them fix the arp or both of above points.

Try the manual clear arp first. That is much less intrusive that a complete reboot of the router.

ASKER

I cleared the arp cache from the router.
Pinging from the server and a client to check. Also running a speed test.
Will let you know in a minute
Right now my internet is painfully slow.

ASKER

ok I am still getting a time out on external website pings from the server and the client machine. From the router when I ping external website ip's they look fine.
In the morning I did a speed test by 'www.dslreports.com' and results were 393kbps down and 3640kbps up.
There is something going on with my internet speed which I have to figure out.
Help plz

can you post result of "show interface" from the router?

ASKER

Here is the most recent speed test:
dslreports.com speed test result on 2006-04-19 14:04:13 EST:
288 / 2811
Your download speed : 288 kbps or 36 KB/sec.
Your upload speed is much faster than down.. have you tweaked?

Your upload speed : 2811 kbps or 351.4 KB/sec.

PS: Welcome to dslreports.com! Run more tests! see forums
Thanks

ASKER

show interfaces
FastEthernet0/0 is up, line protocol is up
Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 5/255, rxload 5/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/34045 (size/max/drops); Total output drops: 16335
Queueing strategy: weighted fair
Output queue: 0/1000/64/16283 (size/max total/threshold/drops)
Conversations 0/44/256 (active/max active/max total)
Reserved Conversations 0/0 (allocated/max allocated)
5 minute input rate 2151000 bits/sec, 447 packets/sec
5 minute output rate 2133000 bits/sec, 444 packets/sec
682749253 packets input, 3536904373 bytes
Received 5498981 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
676265246 packets output, 718296331 bytes, 0 underruns
--More-- 0 output errors, 0 collisions, 8 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/0.10 is up, line protocol is up
Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
Description: Main CAMPUS VLAN
Internet address is 10.10.10.254/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 5/255, rxload 5/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 10.
ARP type: ARPA, ARP Timeout 04:00:00
--More-- FastEthernet0/0.801 is up, line protocol is up
Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
Description: CONNECTION TO BUR CAMPUS
Internet address is 10.10.11.254/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 5/255, rxload 5/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 801.
ARP type: ARPA, ARP Timeout 04:00:00
--More-- FastEthernet0/0.908 is up, line protocol is up
Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
Description: INTERNET VIA company
Internet address is x.x.x.x/30
MTU 1500 bytes, BW 1000000 Kbit, DLY 100 usec,
reliability 255/255, txload 5/255, rxload 5/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 908.
ARP type: ARPA, ARP Timeout 04:00:00

FastEthernet0/0.908 is up, line protocol is up
Hardware is AmdFE, address is 0002.4bd3.71c0 (bia 0002.4bd3.71c0)
Description: INTERNET VIA company
Internet address is x.x.x.x/30

What is upstream for the Internet access? Since these are all VLAN's and sub-interfaces, there must be something else upstream. Is this router doing NAT also? How many total systems are running through this?

Can you post result of "sho ip route"

Can you post your output from show log?

ASKER

show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is x.x.x.61 to network 0.0.0.0

x.x.x.0/30 is subnetted, 1 subnets
C x.x.x.60 is directly connected, FastEthernet0/0.908
10.0.0.0/24 is subnetted, 2 subnets
C 10.10.10.0 is directly connected, FastEthernet0/0.10
C 10.10.11.0 is directly connected, FastEthernet0/0.801
S* 0.0.0.0/0 [1/0] via 216.185.84.61
FH_2620#show ip log
^
% Invalid input detected at '^' marker.

FH_2620#show log
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
Console logging: disabled
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 143136 messages logged
Trap logging: level informational, 143140 message lines logged
--More--
Log Buffer (65536 bytes):
TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.45.129.4:9921) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.205.148.170:6348) sent 139 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (64.229.127.121:10318) sent 139 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.48.228.48:14616) sent 139 bytes
Apr 19 14:46:49: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.54.209.124(50902) -> 216.185.84.185(1097), 1 packet
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.170.80.128:40932) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (71.198.213.160:10711) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.169.222.43:6348) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.212.132.243:6348) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (207.134.181.91:6346) sent 0 bytes
Apr 19 14:46:49: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.13.228.176:2282) sent 0 bytes
--More-- 69:24399) sent 34 bytes -- responder (70.230.170.85:49591) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (64.180.13.29:46575) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.11.57:2666) sent 548 bytes -- responder (66.77.84.94:80) sent 17035 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.57.196.13:4906) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.248.112.253:2453) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (12.222.199.40:51818) sent 0 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (207.180.180.65:5588) sent 126 bytes
Apr 19 14:47:13: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.103.208.142:2396) sent 139 bytes
Apr 19 14:47:14: %SEC-6-IPACCESSLOGP: list 101 denied tcp 84.65.100.142(1823) -> 216.185.84.185(39044), 1 packet
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.120.17.40:34255) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.40.244.232:33081) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (207.75.32.93:28188) sent 0 bytes
--More-- Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.67.33.109:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.99.238.95:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (80.192.36.210:44449) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (196.206.146.206:60306) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.65.179.154:20038) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.214.92.55:19366) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.68.234.39:17194) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.30.16.95:27552) sent 61 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.96.167.65:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.67.33.109:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.186.161.20:6346) sent 0 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (128.196.239.178:35484) sent 129 bytes
--More-- Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 42 bytes -- responder (192.175.48.6:53) sent 119 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (124.121.33.63:50465) sent 139 bytes
Apr 19 14:47:14: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.71:3907) sent 126 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:15: %SEC-6-IPACCESSLOGP: list 101 denied tcp 207.46.18.30(80) -> 216.185.84.185(2791), 1 packet
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.98.129.145:7476) sent 102 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.236.157.49:21907) sent 138 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.193.60.154:15619) sent 131 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.71:6346) sent 29 bytes -- responder (67.169.75.37:6346) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (88.107.194.54:45017) sent 139 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (62.30.164.62:4166) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.73.209.75:3572) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.0.173.210:1176) sent 0 bytes
--More-- Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.193.214.113:3234) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (155.143.14.148:4854) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.46.41.68:32102) sent 0 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.110.134.222:39374) sent 139 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.139.129.3:30659) sent 139 bytes
Apr 19 14:47:15: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.119.158.105:12673) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (66.214.231.178:34292) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.110.210.8:10767) sent 99 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.188.116.214:30269) sent 116 bytes
Apr 19 14:47:16: %SEC-6-IPACCESSLOGP: list 101 denied udp 204.16.208.105(55135) -> 66.207.100.152(1026), 1 packet
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.128.240.82:43990) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.54.206.209:26010) sent 0 bytes
--More-- Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.112.84.193:45244) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.56.215.54:42146) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.251.101.173:14316) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (80.192.11.171:37011) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.83.84.242:12000) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.25.130.219:6348) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (59.92.242.152:32196) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.29.130.82:50673) sent 138 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.189.100.118:2474) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.138.224.143:45144) sent 0 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.126:1539) sent 545 bytes -- responder (199.212.18.76:80) sent 23693 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (211.31.86.221:29360) sent 139 bytes
--More-- Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (64.201.216.64:6346) sent 74 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.119.28.172:6346) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.86.137.195:41181) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (205.250.114.65:39611) sent 139 bytes
Apr 19 14:47:16: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.134:16165) sent 29 bytes -- responder (69.199.88.196:2112) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.134:23135) sent 29 bytes -- responder (142.104.165.19:6346) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.101.72.83:46164) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (12.152.162.91:29374) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.226.15.187:41767) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (59.167.189.12:6348) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.135.134.52:6346) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (142.162.199.230:6346) sent 0 bytes
--More-- Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.125.64.234:44084) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (128.211.235.34:33427) sent 126 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (207.199.209.101:51988) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.28.183.86:33710) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.170.28.202:21889) sent 0 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (209.33.101.154:14032) sent 116 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.20.132.168:7615) sent 98 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.37.66.65:51570) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.38.150.50:11009) sent 139 bytes
Apr 19 14:47:17: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.214.152.137:34418) sent 139 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.183.158.76:43793) sent 124 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.21.76.186:47912) sent 139 bytes
--More-- Apr 19 14:47:18: %SEC-6-IPACCESSLOGP: list 101 denied tcp 68.41.62.36(6348) -> 216.185.84.185(4736), 1 packet
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.165.50.100:49351) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.13.11.76:47634) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.47.174.99:21424) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.169.71.66:19374) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.24.184.131:10371) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.18.44.13:6348) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.188.93.23:6346) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.229.112.243:6346) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.14.74.13:34494) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.226.73.247:26630) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.27.127.211:21735) sent 0 bytes
--More-- Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.47.244.83:6346) sent 0 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (12.221.193.129:15040) sent 139 bytes
Apr 19 14:47:18: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.81.105.203:6346) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.142.104.211:19006) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.237.79.27:5708) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.139.221.116:10508) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.42.9.124:4652) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.137.204.146:9910) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.194.209.54:39805) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.171.30.223:31399) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.31.13.117:41294) sent 139 bytes
Apr 19 14:47:19: %SEC-6-IPACCESSLOGP: list 101 denied tcp 211.31.205.177(36280) -> 216.185.84.185(1205), 1 packet
--More-- Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (80.193.161.179:31942) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.132.94.150:27835) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.124.62.45:21189) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.76.64.19:15841) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.235.23.43:6349) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.170.68.137:4903) sent 0 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.141.41.246:6123) sent 139 bytes
Apr 19 14:47:19: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (156.34.195.140:10246) sent 139 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (129.1.223.90:34740) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (64.252.17.160:48820) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.164.198.177:13695) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.180.89.164:13565) sent 0 bytes
--More-- Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.236.160.176:6346) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.252.124.146:20460) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.12.99.252:6346) sent 139 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (83.184.229.96:55779) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.27.101.13:37353) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.145.90.205:33946) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (129.108.213.28:21453) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.230.54.239:9041) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.169.230.45:6349) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (80.7.234.5:3819) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.162.98.190:51586) sent 0 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.224.180.230:33927) sent 113 bytes
--More-- Apr 19 14:47:20: %SEC-6-IPACCESSLOGP: list 101 denied tcp 207.46.96.141(1863) -> 216.185.84.185(1201), 1 packet
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.147.211.28:23320) sent 121 bytes
Apr 19 14:47:20: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.37.22.214:30364) sent 139 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (35.11.162.87:56841) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.124.150.242:1631) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.89.17.115:64215) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (205.134.239.24:2207) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (75.3.93.23:51001) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.138:4812) sent 307 bytes -- responder (205.134.231.54:80) sent 469 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.171.9.219:48713) sent 139 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:4931) sent 102 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.86.120.98:34559) sent 99 bytes
--More-- Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.141:4294) sent 1904 bytes -- responder (64.233.163.104:80) sent 4195 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (165.190.89.160:47948) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (66.171.75.155:40413) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (66.108.62.0:21973) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (213.194.255.116:17270) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (87.7.149.177:7704) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.36.7.123:6348) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.121.172.70:6346) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (128.175.141.84:4181) sent 0 bytes
Apr 19 14:47:21: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.140.114.137:48456) sent 139 bytes
Apr 19 14:47:22: %SEC-6-IPACCESSLOGP: list 101 denied tcp 216.109.119.252(80) -> 216.185.84.185(1498), 1 packet
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.146.35.19:19327) sent 0 bytes
--More-- Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (138.234.126.220:17372) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.232.92.100:6346) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.157.106.153:13139) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.49.208.173:6346) sent 138 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.70.229.15:19749) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (200.232.255.65:6520) sent 102 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.137.51.79:43668) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 42 bytes -- responder (192.175.48.6:53) sent 119 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (87.97.107.104:11203) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.57.246.181:25859) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.66:1892) sent 129 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.189.57.23:23015) sent 0 bytes
--More-- Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (195.158.85.30:17975) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.180.239.109:14415) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.131.212.105:17141) sent 139 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.36.75.181:6348) sent 0 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.227.146.225:3742) sent 102 bytes
Apr 19 14:47:22: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.44.251.29:46775) sent 139 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.11.40:2222) sent 16 bytes -- responder (69.213.137.51:32297) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.67.25.250:29890) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (217.54.130.74:17199) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.190.165.130:15483) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.55.233.217:6348) sent 139 bytes
Apr 19 14:47:23: %SEC-6-IPACCESSLOGP: list 101 denied tcp 70.28.176.39(4284) -> 216.185.84.185(39044), 1 packet
--More-- Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.209.172.91:34295) sent 139 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.100.6.92:40945) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.193.226.17:22580) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.0.188.200:6346) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.65.131.187:4014) sent 0 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (62.166.22.234:45339) sent 132 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.2.242.28:19984) sent 139 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.142.54.73:9631) sent 126 bytes
Apr 19 14:47:23: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (194.54.230.17:28754) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.201.207.85:17209) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.77.125.152:50559) sent 126 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (216.51.235.169:7192) sent 125 bytes
--More-- Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (152.35.22.151:26838) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.186.202.14:51189) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.201.204.201:6346) sent 540 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.14.73.215:37984) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.40.96.78:18793) sent 138 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.59.1.197:3192) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.175.7.46:4126) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.30.189.72:1467) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.166.57.196:1142) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (151.57.208.137:40091) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (87.74.102.236:27096) sent 0 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.31.252.104:15057) sent 0 bytes
--More-- Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.124.233.143:6348) sent 139 bytes
Apr 19 14:47:24: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (59.167.150.74:27599) sent 133 bytes
Apr 19 14:47:25: %SEC-6-IPACCESSLOGP: list 101 denied udp 70.48.39.103(60000) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 44 bytes -- responder (192.52.178.30:53) sent 222 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (200.139.147.90:3067) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.65.44.72:3561) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.70.196.208:2270) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.194.62.110:4845) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (75.2.168.57:18182) sent 139 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 44 bytes -- responder (207.46.66.75:53) sent 79 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.143.80.232:41936) sent 139 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:1040) sent 81 bytes -- responder (192.175.48.6:53) sent 235 bytes
--More-- Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (85.66.87.248:6348) sent 74 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.14.195.25:41455) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (203.81.231.15:21832) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (88.233.81.136:45952) sent 138 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.23.22.81:11702) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (84.64.102.91:6348) sent 0 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:4938) sent 102 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.197.9.7:30481) sent 80 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 39 bytes -- responder (220.73.220.4:53) sent 318 bytes
Apr 19 14:47:25: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 38 bytes -- responder (65.203.234.28:53) sent 349 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 54 bytes -- responder (64.251.27.189:53) sent 99 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.30.93.181:55469) sent 120 bytes
--More-- Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:1040) sent 47 bytes -- responder (69.28.95.98:53) sent 92 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:1040) sent 48 bytes -- responder (62.58.50.220:53) sent 112 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 51 bytes -- responder (209.208.0.96:53) sent 231 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 47 bytes -- responder (69.8.2.162:53) sent 199 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 44 bytes -- responder (207.68.160.190:53) sent 79 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (142.157.203.157:2690) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.49.144.178:3160) sent 0 bytes
Apr 19 14:47:26: %SEC-6-IPACCESSLOGP: list 101 denied tcp 64.40.102.44(80) -> 216.185.84.185(3024), 1 packet
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.55.199.133:41374) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.96.220.165:26389) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 39 bytes -- responder (63.241.73.200:53) sent 318 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.70.240.138:6346) sent 139 bytes
--More-- Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 38 bytes -- responder (69.45.78.3:53) sent 349 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 38 bytes -- responder (65.55.238.126:53) sent 82 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.114.86.94:24578) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 105 bytes -- responder (208.172.91.5:53) sent 556 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.66.160.26:37624) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.118.96.135:43752) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (141.109.102.92:6348) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.41.8.109:2056) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.18:37981) sent 60 bytes -- responder (65.59.226.69:53) sent 251 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (202.131.172.227:28241) sent 0 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 57 bytes -- responder (206.25.8.69:53) sent 285 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 60 bytes -- responder (208.172.13.230:53) sent 251 bytes
--More-- Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.88.22.100:9117) sent 119 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.227.210.33:11058) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (142.177.185.59:6346) sent 139 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.108.153.86:46888) sent 138 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.131:3646) sent 446 bytes -- responder (216.239.59.104:80) sent 447 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.126:1521) sent 1386 bytes -- responder (132.156.10.87:80) sent 14310 bytes
Apr 19 14:47:26: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.126:1522) sent 3544 bytes -- responder (132.156.10.87:80) sent 80736 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.23.187.120:12390) sent 88 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.41.93.78:25774) sent 133 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.70.254.27:47365) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.237.23.213:6349) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.164.183.22:6348) sent 0 bytes
--More-- Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.179.255.233:6346) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.183.184.156:6346) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.150.224.101:6346) sent 139 bytes
Apr 19 14:47:27: %SEC-6-IPACCESSLOGP: list 101 denied tcp 213.224.176.96(62525) -> 216.185.84.185(24399), 1 packet
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.96.231.111:6348) sent 139 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (151.197.200.81:8374) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.39.131.7:6348) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.144.207.7:6348) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.104.18.91:4043) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.41.48.123:34334) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.47.76.135:32528) sent 0 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.49.223.218:13227) sent 139 bytes
--More-- Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.107.239.132:60389) sent 102 bytes
Apr 19 14:47:27: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.164.59.247:32209) sent 139 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.58:2793) sent 568 bytes -- responder (65.54.179.192:443) sent 2571 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.114.209.58:44873) sent 102 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.66:1902) sent 162 bytes -- responder (65.98.38.30:8001) sent 599 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.174.153.160:3653) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (85.147.58.154:65419) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.49.5.58:60296) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.227.205.150:35204) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.31.89.98:34354) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.166.26.178:28080) sent 0 bytes
Apr 19 14:47:28: %SEC-6-IPACCESSLOGP: list 101 denied tcp 200.94.173.105(1715) -> 216.185.84.185(24399), 1 packet
--More-- Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.218.107.79:25422) sent 139 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.231.60.170:39314) sent 139 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (62.119.80.168:20077) sent 131 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.141.15.170:50191) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (217.165.84.16:37378) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (210.49.95.135:19543) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.229.112.243:6346) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (144.96.32.220:6346) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.178.195.177:6346) sent 0 bytes
Apr 19 14:47:28: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.31.4.91:4995) sent 139 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.230.164.243:3116) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.35.42.251:1905) sent 0 bytes
--More-- Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.216.221.152:50702) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.9.118.255:1854) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.47.185.31:33709) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.99.63.35:33694) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (211.28.105.112:17968) sent 0 bytes
Apr 19 14:47:29: %SEC-6-IPACCESSLOGP: list 101 denied udp 201.58.164.59(65074) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.235.233.163:51048) sent 140 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.161.180.3:62551) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.36.166.94:43031) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.111.59.197:22605) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (217.85.216.219:19587) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (200.121.178.198:18772) sent 0 bytes
--More-- Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.31.195.139:6348) sent 0 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.143.132.105:6348) sent 139 bytes
Apr 19 14:47:29: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (194.74.167.61:6346) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.227.159.101:6346) sent 432 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.16.213.232:11002) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (199.126.43.84:18946) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.151.134.182:20177) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (172.201.90.95:34321) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.87.197.104:22622) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (209.205.246.62:6348) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.45:3599) sent 1398 bytes -- responder (64.4.52.30:80) sent 3480 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.92:1896) sent 6895 bytes -- responder (207.46.115.12:80) sent 6190 bytes
--More-- Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.46.204.132:42748) sent 139 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (65.248.185.232:51222) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.170.40.23:41333) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (64.13.18.51:38966) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (88.109.241.223:28062) sent 0 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (194.165.126.177:21571) sent 0 bytes
Apr 19 14:47:30: %SEC-6-IPACCESSLOGP: list 101 denied udp 64.65.242.222(62574) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (60.50.138.199:19375) sent 128 bytes
Apr 19 14:47:30: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.33.87.248:49581) sent 139 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.56.81.19:3150) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.55.228.222:1535) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.39.53.114:1253) sent 0 bytes
--More-- Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (88.105.49.152:39295) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 30 bytes -- responder (192.26.92.30:53) sent 112 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (71.38.193.202:18731) sent 139 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 32 bytes -- responder (199.7.67.1:53) sent 266 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4378) sent 5669 bytes -- responder (83.85.241.130:6346) sent 15181 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.155.171.85:8964) sent 132 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 30 bytes -- responder (64.125.152.224:53) sent 192 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.203.210.238:43529) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.203.126.47:27184) sent 0 bytes
Apr 19 14:47:31: %SEC-6-IPACCESSLOGP: list 101 denied tcp 71.12.203.145(1768) -> 216.185.84.185(46545), 1 packet
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (83.115.136.8:23397) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.20.170.129:15965) sent 0 bytes
--More-- Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.1.3.130:14206) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.17.235.181:10979) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.2.195.140:6348) sent 0 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.131:6348) sent 29 bytes -- responder (68.60.70.231:41754) sent 84 bytes
Apr 19 14:47:31: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (217.164.49.114:36776) sent 139 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3872) sent 14793 bytes -- responder (24.61.172.220:14797) sent 35499 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.148.248.100:62941) sent 102 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.31.42.158:4228) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.47.165.165:4607) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (83.193.51.15:2995) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.133.125.91:1244) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.37.68.59:3932) sent 0 bytes
--More-- Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (12.205.49.207:33976) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (72.139.216.209:31445) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.180.229.165:2982) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.209.163.60:27381) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.144.160.132:6346) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.224.154.111:48997) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (217.42.3.143:11570) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (201.1.197.10:8650) sent 0 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 38 bytes -- responder (192.52.178.30:53) sent 267 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.101:36126) sent 38 bytes -- responder (65.98.38.26:53) sent 283 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.44.199.249:31892) sent 139 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (203.218.55.53:39003) sent 139 bytes
--More-- Apr 19 14:47:32: %SEC-6-IPACCESSLOGP: list 101 denied tcp 205.134.231.54(80) -> 216.185.84.185(4840), 1 packet
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.212.214.177:25339) sent 126 bytes
Apr 19 14:47:32: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.47.80.22:41811) sent 138 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:1264) sent 151 bytes -- responder (207.46.96.141:1863) sent 263 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (80.148.22.84:22448) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.244.190.253:7622) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.38.33.210:15045) sent 99 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.115.103.44:16254) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.77.26.245:51115) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.140.73.124:17044) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.213.250.4:6346) sent 0 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.71:3913) sent 4428 bytes -- responder (65.54.183.192:80) sent 6234 bytes
--More-- Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4579) sent 11609 bytes -- responder (66.222.201.137:6348) sent 18579 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.253.239.114:62949) sent 102 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.97.60.107:6348) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (201.124.252.167:8659) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (24.66.180.165:10350) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (71.122.28.172:6346) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (70.114.241.46:18109) sent 139 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (70.65.105.114:56128) sent 132 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.71:3908) sent 486 bytes -- responder (207.46.114.117:1863) sent 385 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3739) sent 17653 bytes -- responder (71.104.201.191:34871) sent 24811 bytes
Apr 19 14:47:33: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.82:46545) sent 23 bytes -- responder (141.151.180.233:47559) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (213.105.220.189:13946) sent 139 bytes
--More-- Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3731) sent 19512 bytes -- responder (84.64.13.124:6346) sent 54060 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4380) sent 9513 bytes -- responder (24.23.128.9:17429) sent 33885 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (217.164.150.174:50940) sent 0 bytes
Apr 19 14:47:34: %SEC-6-IPACCESSLOGP: list 101 denied tcp 24.45.113.11(6346) -> 216.185.84.185(1909), 1 packet
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (64.53.181.167:26056) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (84.64.57.72:6348) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (71.80.27.65:6348) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (66.232.213.238:6346) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.192.21.100:3148) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: http session initiator (10.10.10.85:3548) sent 325 bytes -- responder (207.142.131.202:80) sent 374 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (82.33.110.194:16253) sent 139 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (200.55.68.246:10280) sent 139 bytes
--More-- Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.13.135.100:42945) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.83.87.168:30234) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.143.58.87:21749) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (81.214.90.209:12471) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (68.186.165.22:6348) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (67.163.214.129:5341) sent 0 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.38.24.138:47791) sent 126 bytes
Apr 19 14:47:34: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:1139) sent 744 bytes -- responder (72.47.9.62:40903) sent 10006 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3773) sent 15664 bytes -- responder (72.137.13.54:6348) sent 22197 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (82.33.58.148:6346) sent 139 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:4604) sent 8275 bytes -- responder (24.12.113.121:41085) sent 14000 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.137.21.31:48866) sent 0 bytes
--More-- Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (69.119.153.182:30690) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.89.229.216:17727) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.29.132.207:28359) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (206.146.86.207:27640) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: tcp session initiator (10.10.10.69:3737) sent 22418 bytes -- responder (81.79.35.63:21666) sent 53544 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (216.248.67.127:17840) sent 124 bytes
Apr 19 14:47:35: %SEC-6-IPACCESSLOGP: list 101 denied tcp 68.42.170.33(39390) -> 216.185.84.185(1821), 1 packet
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (83.24.236.41:40193) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (172.201.215.104:34459) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (80.5.141.101:9544) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (86.138.119.197:6346) sent 0 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (220.22.254.67:6346) sent 0 bytes
--More-- Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (69.86.131.235:39801) sent 139 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (72.47.9.62:40903) sent 139 bytes
Apr 19 14:47:35: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.69:24399) sent 34 bytes -- responder (61.26.65.241:45777) sent 139 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (86.20.160.232:1669) sent 80 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.206.160.68:2335) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (65.191.53.161:60227) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (68.39.172.39:3948) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.42.234.125:4363) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (81.179.193.94:6348) sent 0 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.11.1:4942) sent 100 bytes -- responder (192.175.48.1:53) sent 12 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (67.177.186.254:6349) sent 139 bytes
Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) se

>Apr 19 14:47:36: %FW-6-SESS_AUDIT_TRAIL: udp session initiator (10.10.10.129:37335) sent 34 bytes -- responder (24.206.160.68:2335) sent 0 bytes

Apparently you also have a bunch of VOIP phones? Skype phones? All the Voice traffic is contending for the Internet access . . .
And the VoIP traffic is on the same VLAN as the data traffic. . . not always a good thing.

Can you address my other questions? What else is out in front of this router?

ASKER

irmoore
This is all it has, no other interfaces. One cable coming from hte back of router goes into the cisco switch 2900, one cable coming out of the converter (fibre to ethernet) goes into the same switch, and then that switch feeds to one 3com switch and thats it.
I am feeding my two servers from this switch directly.

ASKER

How can I bann or stop these skype voip telephony from my network? May be from AD? etc

ASKER

Irmoore
In total I must have more than 100 users at one point (peak point), I am not sure if my router is doing NAT. I am running DHCP on a diff server, I only have 5mbps of connection from ISP. Please help me to ban all these VOIP things from my network.

We can apply acl on your router to ban VOIP Traffic. With AD, you will need to restrict users from installing software, for that you will need to remove software first.

Assuming it is VoIP, can you post your config from the router,

type show runn and post the output

Also, before posting, remove all your public IP Addressess, username/passwords.

ASKER

show run
Building configuration...

Current configuration:
!
! No configuration change since last restart
!
version 12.0
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname FH_2620
!
logging buffered 65536 debugging
no logging console

!
!
!
!
!
clock timezone EST -5
clock summer-time EDT recurring
ip subnet-zero
--More-- no ip source-route
ip host accpac.ggw.net 19.20
ip host switch 10.10.10.253
ip name-server xxxx.94
ip name-server xxxx138
ip name-server xxxx.134
!
ip inspect audit-trail
ip inspect name inter tcp
ip inspect name inter udp
ip inspect name inter ftp
ip inspect name inter http
ip inspect name inter smtp
ip inspect name inter tftp
ip inspect name inter cuseeme
ip inspect name inter h323
ip inspect name inter rcmd
ip inspect name inter realaudio
ip inspect name inter sqlnet
ip inspect name inter streamworks
ip inspect name inter vdolive
ip audit notify log
ip audit po max-events 100
--More-- !
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
no ip directed-broadcast
speed 100
full-duplex
fair-queue 64 256 0
!
interface FastEthernet0/0.10
description main CAMPUS VLAN
encapsulation dot1Q 10
ip address 10.10.10.254 255.255.255.0
no ip redirects
no ip directed-broadcast
ip nat inside
!
--More-- interface FastEthernet0/0.801
description CONNECTION TO BUR CAMPUS
encapsulation dot1Q 801
ip address 10.10.11.254 255.255.255.0
no ip redirects
no ip directed-broadcast
ip nat inside
!
interface FastEthernet0/0.908
description INTERNET VIA company
bandwidth 1000000
encapsulation dot1Q 908
ip address x.x.x.62 255.255.255.252
ip access-group 101 in
no ip redirects
no ip directed-broadcast
ip nat outside
ip inspect inter out
!
ip nat translation timeout 1600
ip nat pool inter x.x.x.185 x.x.x.185 netmask 255.255.255.248
ip nat inside source list 1 pool inter overload
ip nat inside source static tcp 10.10.10.101 82 66.x.x.x.x 82 extendable
--More-- ip nat inside source static tcp 10.10.10.101 83 66.x.x.x.x 80 extendable
ip nat inside source static tcp 10.10.10.101 82 x.x.x.x 80 extendable
ip nat inside source static tcp 10.10.10.101 81 .153 80 extendable
ip nat inside source static tcp 10.10.10.3 5336 189 5336 extendable
ip nat inside source static 10.10.10.101 189
ip nat inside source static 10.10.10.18 .187
ip nat inside source static 10.10.10.20 .186
ip nat inside source static 10.10.10.99 .190
ip nat inside source static 10.10.10.3 .188
ip nat inside source static tcp 10.10.10.20 8080 186 80 extendable
ip nat inside source static tcp 10.10.10.20 5336 .186 5336 extendable
ip nat inside source static udp 10.10.10.20 500 .186 500 extendable
ip nat inside source static 10.10.11.8 .157
ip classless
ip route 0.0.0.0 0.0.0.0 x.x.x.x.61
no ip http server
!
!
map-list nat
!
map-list ip
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.11.0 0.0.0.255
--More-- access-list 98 permit 24.244.193.6
access-list 98 permit x.x.x..126
access-list 101 permit tcp host x.x.x.x.20 any eq 135
access-list 101 remark Inbound Internet Access List
access-list 101 permit tcp host .126 host .62 eq telnet
access-list 101 permit tcp host .6 host .62 eq telnet
access-list 101 permit tcp host 179 host .62 eq telnet
access-list 101 permit tcp host .2 host .62 eq telnet
access-list 101 permit tcp any host .153 eq www
access-list 101 permit tcp any host .154 eq www
access-list 101 permit tcp any host .155 eq www
access-list 101 permit tcp any host .155 eq 82
access-list 101 permit tcp any host 157
access-list 101 permit tcp any host .189 eq 5336
access-list 101 permit esp any host 4.186
access-list 101 permit esp any host 4.187
access-list 101 permit ahp any host 4.186
access-list 101 permit ahp any host 4.187
access-list 101 permit tcp any host .186 eq www
access-list 101 permit tcp any host 186 eq 8080
access-list 101 permit tcp any host .186 eq 5336
access-list 101 permit udp any host .186 eq isakmp
access-list 101 permit udp any host 187 eq isakmp
--More-- access-list 101 permit tcp any host .187 eq smtp
access-list 101 permit tcp any host .187 eq www
access-list 101 permit tcp any host 187 eq 443
access-list 101 permit tcp any host .187 eq 8098
access-list 101 permit tcp any host 187 eq 8099
access-list 101 permit tcp any host .187 eq pop3
access-list 101 permit tcp any host 4.189 eq 1723
access-list 101 permit gre any host .189
access-list 101 permit tcp any host .189 eq www
access-list 101 permit tcp any host .189 eq smtp
access-list 101 permit tcp any host 189 eq pop3
access-list 101 permit tcp any host .189 eq 8080
access-list 101 permit tcp any host .189 eq 8383
access-list 101 permit tcp any host .189 eq 8181
access-list 101 permit tcp any host .189 eq 19815
access-list 101 permit tcp any host .189 eq 81
access-list 101 permit tcp any host .189 eq 82
access-list 101 permit tcp any host .189 eq 8093
access-list 101 permit tcp any host .188 eq ftp
access-list 101 permit tcp any host .190 eq www
access-list 101 permit ip any host 4.190
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 permit udp host 17.35 host 4.62 eq ntp
--More-- access-list 101 permit udp host .34 host 84.62 eq ntp
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any traceroute
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any ttl-exceeded
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any source-quench
access-list 101 permit icmp any any packet-too-big
access-list 101 deny ip any any log
banner motd ^CC

*** UNAUTHORIZED ACCESS IS PROHIBITED! ALL ACTIVITY IS LOGGED! ***

^C
!
line con 0
login
transport input none
line aux 0
--More-- line vty 0 3
logging synchronous
login
line vty 4
logging synchronous
login
transport input pad v120 telnet rlo

ASKER

May be this will Help:
I have two wireless access points (linksys WRT54GS) feeding these culprit users: may be I can stop any port on these routers??? instead of screwing the main cisco router. Do you agree?

Agree if you can't control users, control the traffic at the router.
The AP's probably don't have a way to filter the traffic, but you can easily block it at the router with an acl:

access-list 102 permit udp any any eq domain
access-list 102 deny udp any any
access-list 102 permit ip any any

interface Fast 0/0.10
ip access-group 102 in

Do you have access to the switch web interface? Look at the port statistics page and look for error counters at the switchport.

ASKER

irmoore
OK agreed.
I am not that good with routers acl, please mention in steps:
what are the opening commands and what are the closing ones.

which interface to open first?

access-list 102 permit udp any any eq domain (which domain my domain or skype?)
access-list 102 deny udp any any
access-list 102 permit ip any any

interface Fast 0/0.10
ip access-group 102 in

which commands are closing commands

ASKER

Yes I can access the switch:
do you want to see sh interfaces? or anything else let me know the command please

router#config term
router(config)#access-list 102 permit udp any any eq 53 (allow dns domain resolution)
router(config)#access-list 102 deny udp any any
router(config)#access-list 102 permit ip any any
router(config)#interface Fast 0/0.10
router(config-if)# ip access-group 102 in
router(config-if)#end
router#

That will stop skype users in their tracks.

On the switch, "show interface fast 0/xx" where xx = interface connecting to Public Internet feed

ASKER

irmoore
-which line is blocking skype?
-does it matter to have access-list 102 as mine say 101?

show interfaces
VLAN1 is up, line protocol is down
Hardware is CPU Interface, address is 0006.28ab.1580 (bia 0006.28ab.1580)
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 1000 bits/sec, 1 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
80774 packets input, 8570578 bytes, 0 no buffer
Received 80714 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
54 packets output, 3933 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
--More-- VLAN10 is up, line protocol is up
Hardware is CPU Interface, address is 0006.28ab.1580 (bia 0006.28ab.1580)
Internet address is 10.10.10.105/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA
ARP type: ARPA, ARP Timeout 04:00:00
--More-- FastEthernet0/1 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1581 (bia 0006.28ab.1581)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 22:39:33, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1 packets input, 64 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
11 packets output, 2024 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/2 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1582 (bia 0006.28ab.1582)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 90000 bits/sec, 48 packets/sec
5 minute output rate 431000 bits/sec, 60 packets/sec
3343416 packets input, 930121494 bytes
Received 97198 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 7 ignored
0 watchdog, 58159 multicast
0 input packets with dribble condition detected
3901412 packets output, 2205781228 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/3 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1583 (bia 0006.28ab.1583)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 22:39:38, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1 packets input, 64 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
7 packets output, 1240 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/4 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1584 (bia 0006.28ab.1584)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 2000 bits/sec, 2 packets/sec
5 minute output rate 15000 bits/sec, 5 packets/sec
46615 packets input, 17227632 bytes
Received 453 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 37 multicast
0 input packets with dribble condition detected
127370 packets output, 34700564 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/5 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1585 (bia 0006.28ab.1585)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:01, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 42000 bits/sec, 16 packets/sec
1102913 packets input, 611446168 bytes
Received 9126 broadcasts, 0 runts, 0 giants, 0 throttles
13 input errors, 0 CRC, 13 frame, 0 overrun, 0 ignored
0 watchdog, 6 multicast
0 input packets with dribble condition detected
2189797 packets output, 680041524 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/6 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1586 (bia 0006.28ab.1586)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 41000 bits/sec, 16 packets/sec
5 minute output rate 9000 bits/sec, 6 packets/sec
1787054 packets input, 665118959 bytes
Received 21583 broadcasts, 0 runts, 0 giants, 0 throttles
3 input errors, 0 CRC, 3 frame, 0 overrun, 2 ignored
0 watchdog, 54 multicast
0 input packets with dribble condition detected
963004 packets output, 536256504 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/7 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1587 (bia 0006.28ab.1587)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 22:39:42, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1 packets input, 64 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
7 packets output, 1240 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/8 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1588 (bia 0006.28ab.1588)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 240000 bits/sec, 22 packets/sec
5 minute output rate 21000 bits/sec, 18 packets/sec
1428929 packets input, 760448542 bytes
Received 2955 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
1547732 packets output, 327016383 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/9 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1589 (bia 0006.28ab.1589)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 22:39:44, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1 packets input, 64 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
7 packets output, 1240 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/10 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.158a (bia 0006.28ab.158a)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 633000 bits/sec, 64 packets/sec
5 minute output rate 78000 bits/sec, 39 packets/sec
6317717 packets input, 3851888302 bytes
Received 102292 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 2 ignored
0 watchdog, 94985 multicast
0 input packets with dribble condition detected
3649201 packets output, 431566509 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
--More-- 0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/11 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.158b (bia 0006.28ab.158b)
Description: Trunk to Router
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 252/255, txload 2/255, rxload 2/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:25, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 860000 bits/sec, 124 packets/sec
5 minute output rate 885000 bits/sec, 143 packets/sec
12916991 packets input, 1460368320 bytes
Received 1368 broadcasts, 625265 runts, 0 giants, 0 throttles
625265 input errors, 0 CRC, 0 frame, 0 overrun, 26 ignored
0 watchdog, 1359 multicast
0 input packets with dribble condition detected
14197033 packets output, 1673265181 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
--More-- 0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
--More-- FastEthernet0/12 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.158c (bia 0006.28ab.158c)
Description: Connection to Media Converter
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:01, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 226000 bits/sec, 63 packets/sec
5 minute output rate 660000 bits/sec, 84 packets/sec
6363988 packets input, 1885396156 bytes
Received 250947 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 11 ignored
0 watchdog, 224022 multicast
0 input packets with dribble condition detected
9076769 packets output, 310500242 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
--More-- 0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

ASKER

irmoore
how to undo the above mentioned commands, in case the router does not cooperate

ASKER

Also my existing 101 access list is applied onto .908 internet via company interface and we are going to apply it on 0/0.10 Main campus will that matter?
Sorry to ask you so many questions before doing this, just want to make sure.
Thanks

access-list 102 permit udp any any eq domain <== this line allows DNS
access-list 102 deny udp any any <== this line will block Skype calls (until they tunnel over tcp 80)
access-list 102 permit ip any any <== this line permits everything else

Yes, it must be a different acl number than your current acl 101
101 is applied inbound on your "wan" interface
A new acl to block skype calls must be applied inbound to the local LAN interface

FastEthernet0/11 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.158b (bia 0006.28ab.158b)
Description: Trunk to Router
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:25, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 860000 bits/sec, 124 packets/sec
5 minute output rate 885000 bits/sec, 143 packets/sec
12916991 packets input, 1460368320 bytes
Received 1368 broadcasts, 625265 runts, 0 giants, 0 throttles
625265 input errors, 0 CRC, 0 frame, 0 overrun, 26 ignored <== I'm concerned about these high numbers of input errors
0 watchdog, 1359 multicast
0 input packets with dribble condition detected
14197033 packets output, 1673265181 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets <== no output errors here is good news!
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

>we are going to apply it on 0/0.10 Main campus will that matter?
Yes, it will matter. Please don't apply same acl to two different interfaces...

ASKER

irmoore
=====>625265 input errors, 0 CRC, 0 frame, 0 overrun, 26 ignored <== I'm concerned about these high numbers of input errors
-This is the port in which the router is going in.Do you think these errors are coming from the port next to it which is the converter (fiber to ethernet) is going in?? Should I get my converter checked?
-ok I will apply the acl 102 to 0/0.10 for blocking the skype.

before you do anything, do this

on the router type

clear counters

then wait few hours and check again.

Yes, I'd get the fiber converters checked out.
Are these converters full-duplex capable?

ASKER

naveedb:
what would clear counter do?
Should I apply the acl after the clear counters?

Irmoore
Yes it is a full duplex capable (Etherwan Xpresso media converter)

Thanks

it will reset the counters and then we can see how many errors are seen during certain time.

You can do it anytime, ACL is a seperate issue, this is only to narrow down on errors.

ASKER

IC I will do it right away.

ASKER

I cleared the counters on the Switch (not the router) and now when I checked the same interface 'fastethernet 0/11 trunk to the router' has 798 errors (it was 65 thousand something), this interface has a router cable going in.
Suggestions?
Thanks

ASKER

naveedb
The input errors are now 25000 (increasing).
can you please also tell me how and where in the Active directory I can block VOIP and chat programs like skype, yak etc.
Thanks

Can you also do the same on router and see if we see the errors count?

How is the router connected to switch, cat5e? Can you change the cable? and see if errors keep increasing?

AD, will address after we have worked on the errors.

ASKER

naveedb
Router interfaces have no errors, its on the switch only.
I think its a cheaper cable (I can go right now and buy a good one, should I get cat 5 e ?)
ok
Thanks

ASKER

I checked the labels it says UTP cat 5

Do you have a spare lying around that you can try?

Also, can you plug it into another port on the switch and see if errors continue. It is very strange to see errors only at one end and not the other. We are sue looking at the right port?

ASKER

Yes I do have one spare I will change it right now
Yes its the right port on the switch.

ASKER

ok I cleared the counters and changed the cables and checked interfaces,
the errors started right away now they are 271

And you are positive that they are not showing on the router?

Can you post running config from switch?

ASKER

naveedb
I have checked again the router interfaces and all of them are clean.

Current configuration of SWITCH:
!
version 12.0
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname NAME OF SWITCH
!
enable
!
!
!
!
!
!
ip subnet-zero
!
!
!
interface FastEthernet0/1
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/2
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/3
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/4
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/5
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/6
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/7
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/8
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/9
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/10
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/11
description Trunk to Router
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,10,801,908,1002-1005
switchport mode trunk
spanning-tree portfast
!
interface FastEthernet0/12
description Connection to Media Converter
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 908
switchport trunk allowed vlan 1,10,801,908,1002-1005
switchport mode trunk
spanning-tree portfast
!
interface VLAN1
no ip address
no ip directed-broadcast
no ip route-cache
shutdown
!
interface VLAN10
ip address 10.10.10.105 255.255.255.0
no ip directed-broadcast
no ip route-cache
!
ip default-gateway 10.10.10.254
snmp-server engineID local XXXXXXXXXXXXXXXXX
snmp-server community private RW
snmp-server community public RO
!
line con 0
exec-timeout 0 0

loggi

transport input none
stopbits 1
line vty 0 4

logging synchronous
login
line

logging synchronous
login
!
end

Quick look, I do not see anything wrong, except that you are trunnking some VLANS which are not configured on the router 1002-1005 which can be removed.

What about "show diagnostic "

ASKER

_2912#show diags ?
addr-move Show learned address movement count and rate
link-flap Show link up/down count and rate

naveed which command you need?

ASKER

_2912#show diags

FernHill_2912#show diags addr-move
Interface Total Last Min
-------------------- ---------- ----------
FastEthernet0/2 431 0
FastEthernet0/4 1 0
FastEthernet0/10 503 0

_2912#show diags link-flap
Interface Total Last Min
-------------------- ---------- ----------
FastEthernet0/2 1 0
FastEthernet0/4 4 0
FastEthernet0/5 3 0
FastEthernet0/6 4 0
FastEthernet0/8 1 0
FastEthernet0/10 1 0
FastEthernet0/11 8 0
FastEthernet0/12 1 0
_2912#

Before we do anything, can you connect the router to a different port, just reconfigure it with trunk settings same sa fa 0/11

I just want to eliminate all things that can cause input errors.

ASKER

naveedb
I am not good with routers. Give me the commands and which interface to apply them, and I will switch the router port to different one.
Thanks

Don't do anything with the router, the changes need to be made on the switch.

Which port can you use on the switch for testing. Right now it is connected on fa 0/11 can we test on fa 0/10? You will need to disconnect what is connected there to do the testing. Once testing is done, we will need to reverse the changes.

ASKER

Naveedb
I can use port 7 or 8 on the switch for testing. Right now there is nothing on them. Sure with your help I can revert the changes.
This might help:
Since we are using the VLAN to our other branch, do you need to see the interfaces or show run from that switch as well?
THanks

Maybe latter, lets do one step at a time. So, login to the switch and type the following commands in order

enable
config term
inteface fa 0/7
description Trunk to Router-TEST PORT
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,10,801,908
switchport mode trunk
end

You should now be able to connect the router to port 7, wait 2-3 minutes before it comes up.

Then clear counter and show interface fa 0/7 to see if errors show up again.

ASKER

Thanks Naveed
PLease also let me know how to undo it (if in case I do something wrong) .
I will be able to do all the commands on Monday (I will be away from the office for sat and sun).
I will do and let you know.

Sure, after you have tested it for few hours, you can either power cycle the switch (do not save changes with copy run start) OR log back into the switch and issue the following commands.

enable
config term
inteface fa 0/7
no description Trunk to Router-TEST PORT
duplex auto
speed auto
no switchport trunk encapsulation dot1q
no switchport trunk allowed vlan 1,10,801,908
no switchport mode trunk
switchport access vlan 10
spanning-tree portfast
end

After you are done, type show run and see if fa 0/7 look like this to confirm:

interface FastEthernet0/7
switchport access vlan 10
spanning-tree portfast

interface FastEthernet0/12
description Connection to Media Converter
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 908 <== I'm wondering if this is interfering with routing.....

Setting a switchport to native vlan other than 1 disables vlan tagging for that vlan.
The router configured with a sub-interface .908 requires the vlan tag for that interface.

Is there a particular reason that fa0/12 is set to native vlan 908 ?

Try removing that from this interface and see if it makes any difference..

interface fast 0/12
no switchport trunk native vlan 908

ASKER

naveeb I changed the port for router to f 0/7, after a while the input errors started look under please:

FastEthernet0/1 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1581 (bia 0006.28ab.1581)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 5d16h, output hang never
Last clearing of "show interface" counters 00:00:06
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/2 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1582 (bia 0006.28ab.1582)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 2/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:00:07
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 367000 bits/sec, 209 packets/sec
5 minute output rate 823000 bits/sec, 222 packets/sec
367 packets input, 71851 bytes
Received 2 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
481 packets output, 403970 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/3 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1583 (bia 0006.28ab.1583)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 5d16h, output hang never
Last clearing of "show interface" counters 00:00:07
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/4 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1584 (bia 0006.28ab.1584)
MTU 1500 bytes, BW 0 Kbit, DLY 0 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 3d17h, output hang never
Last clearing of "show interface" counters 00:00:07
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/5 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1585 (bia 0006.28ab.1585)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:00:07
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 26000 bits/sec, 1 packets/sec
5 minute output rate 86000 bits/sec, 38 packets/sec
205 packets input, 198245 bytes
Received 2 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
569 packets output, 135732 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/6 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1586 (bia 0006.28ab.1586)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:00:07
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 77000 bits/sec, 34 packets/sec
5 minute output rate 7000 bits/sec, 4 packets/sec
381 packets input, 101042 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
49 packets output, 10543 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/7 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1587 (bia 0006.28ab.1587)
Description: Trunk to Router-Test Port
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 240/255, txload 2/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:19, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:00:08
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 766000 bits/sec, 154 packets/sec
5 minute output rate 801000 bits/sec, 177 packets/sec
2184 packets input, 1962102 bytes
Received 0 broadcasts, 324 runts, 0 giants, 0 throttles
324 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
2612 packets output, 2060616 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/8 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.1588 (bia 0006.28ab.1588)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:00:08
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 640000 bits/sec, 182 packets/sec
5 minute output rate 267000 bits/sec, 174 packets/sec
144 packets input, 25711 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
171 packets output, 28192 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/9 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.1589 (bia 0006.28ab.1589)
MTU 1500 bytes, BW 0 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex , Auto Speed , 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 5d16h, output hang never
Last clearing of "show interface" counters 00:00:08
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/10 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.158a (bia 0006.28ab.158a)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Auto-duplex (Full), Auto Speed (100), 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:00:09
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 638000 bits/sec, 69 packets/sec
5 minute output rate 83000 bits/sec, 42 packets/sec
926 packets input, 987439 bytes
Received 10 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 10 multicast
0 input packets with dribble condition detected
591 packets output, 193247 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/11 is down, line protocol is down
Hardware is Fast Ethernet, address is 0006.28ab.158b (bia 0006.28ab.158b)
Description: Trunk to Router
MTU 1500 bytes, BW 0 Kbit, DLY 0 usec,
reliability 236/255, txload 131/255, rxload 143/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:05:23, output 00:04:55, output hang never
Last clearing of "show interface" counters 00:00:11
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 369000 bits/sec, 39 packets/sec
5 minute output rate 381000 bits/sec, 47 packets/sec
0 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
FastEthernet0/12 is up, line protocol is up
Hardware is Fast Ethernet, address is 0006.28ab.158c (bia 0006.28ab.158c)
Description: Connection to Media Converter
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 2/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:00:21
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 460000 bits/sec, 125 packets/sec
5 minute output rate 940000 bits/sec, 149 packets/sec
3169 packets input, 1655640 bytes
Received 78 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 68 multicast
0 input packets with dribble condition detected
3762 packets output, 3226905 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

ASKER

guys
what is the meaning of the lines above my show run in router:

hostname FH_2620
!
logging buffered 65536 debugging
no logging console
enable !
!
!
!
!
clock timezone EST -5
clock summer-time EDT recurring
ip subnet-zero
no ip source-route
ip host accpac.ggw.net x.x.x.x <--------we are using accpac its the accpac external ip here?
ip host switch 10.10.10.253<---I can access my switch with 10.10.10.105 instead of this ip, so should it be 10.10.10.105?
ip name-server x.x.x.x<-------this is fine
ip name-server x.x.x.x<------------I am not sure about these server External Ip what should go here
ip name-server x.x.x.x<------------I am not sure about these server External Ip what should go here
!
ip inspect audit-trail <-------------------------what is this?
ip inspect name inter tcp <-------------------------what is this?
ip inspect name inter udp <-------------------------what is this?
ip inspect name inter ftp <-------------------------what is this?
ip inspect name inter http <-------------------------what is this?
ip inspect name inter smtp <-------------------------what is this?
ip inspect name inter tftp <-------------------------what is this?
ip inspect name inter cuseeme <-------------------------what is this?
ip inspect name inter h323 <-------------------------what is this?
ip inspect name inter rcmd <-------------------------what is this?
ip inspect name inter realaudio <-------------------------what is this?
ip inspect name inter sqlnet <-------------------------what is this?
ip inspect name inter streamworks <-------------------------what is this?
ip inspect name inter vdolive <-------------------------what is this?
ip audit notify log
ip audit po max-events 100
!
!
Thanks

The "ip host xxx " entries are nothing more than an internal hosts file for the router itself to use.
Example:
router#switch <== this command will attempt to telnet to host named "switch" which is 10.10.10.253
Or router#ping switch
ping 10.10.10.253

The "ip inspect name xxx <protocol>" is the firewall feature set of the router. This inspect list creates temporary access-lists for outgoing connections to allow the reponses back in. Each protocol has a set behavior pattern and the inpsect makes sure that behavior conforms to the rules.

The error counters on the switchport interface could be a result of the vlan tagging issue I raised in my previous post.

Easy question!

Hostname is just used to map an IP Address with hostname on the router (just like hosts file on Windows/Unix machines). Localized to router so will not effect anything else. You can not use this hostname/ip mapping except when you are on the router itself.

ip-name server is DNS server.

ip-inspect statements are used for Context-Based Access Control. Normally your router will inspect the protocols to verify they have not been tampered with to avoid like Denial of Service attacks.

None of these statements will create errors on the port.

Not easy question:

So, we have elimiated cable, port on switch. Now that leaves the configuration and router port.

Can you post your output from the following commands on router and switch

show vlan

ASKER

irmoore
thanks, sure I can remove the tag from the switch. If something does't work properly .....can I get my switch to go back to original settings by simply restarting the switch?

Yes, as long as you don't save the config with "write memory" or "copy run start", then a reboot will always go right back where it was.

ASKER

naveed
FH_2620#show vlans from router:

Virtual LAN ID: 10 (IEEE 802.1Q Encapsulation)

vLAN Trunk Interface: FastEthernet0/0.10

Protocols Configured: Address: Received: Transmitted:
IP 10.10.10.254 33517709 20717422

Virtual LAN ID: 801 (IEEE 802.1Q Encapsulation)

vLAN Trunk Interface: FastEthernet0/0.801

Protocols Configured: Address: Received: Transmitted:
IP 10.10.11.254 4040769 3680817

Virtual LAN ID: 908 (IEEE 802.1Q Encapsulation)

vLAN Trunk Interface: FastEthernet0/0.908

Protocols Configured: Address: Received: Transmitted:
IP Our router external IP 22372267 34746425

show vlan from switch:

_2912#show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
10 VLAN0010 active Fa0/1, Fa0/2, Fa0/3, Fa0/4,
Fa0/5, Fa0/6, Fa0/8, Fa0/9,
Fa0/10
801 VLAN0801 active
850 Halton active
851 Halton_ASAP active
908 VLAN0908 active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 1002 1003
10 enet 100010 1500 - - - - - 0 0
801 enet 100801 1500 - - - - - 0 0
850 enet 100850 1500 - - - - - 0 0
851 enet 100851 1500 - - - - - 0 0
908 enet 100908 1500 - - - - - 0 0
1002 fddi 101002 1500 - 0 - - - 1 1003
1003 tr 101003 1500 1005 0 - - srb 1 1002
1004 fdnet 101004 1500 - - 1 ibm - 0 0
1005 trnet 101005 1500 - - 1 ibm - 0 0

ASKER

Irmoore:
*************
interface FastEthernet0/12
description Connection to Media Converter
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 908 <== I'm wondering if this is interfering with routing.....

Setting a switchport to native vlan other than 1 disables vlan tagging for that vlan.
The router configured with a sub-interface .908 requires the vlan tag for that interface.

Is there a particular reason that fa0/12 is set to native vlan 908 ?

Try removing that from this interface and see if it makes any difference..

interface fast 0/12
no switchport trunk native vlan 908
**************************************

I removed it from this interface: here is the show run from the switch, the network got disconnected from the Internet, so I have to restart the swicth and everything came back:

interface FastEthernet0/12
description Connection to Media Converter
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,10,801,908,1002-1005
switchport mode trunk
spanning-tree portfast
!
interface VLAN1
no ip address
no ip directed-broadcast
no ip route-cache
shutdown
!
interface VLAN10
ip address 10.10.10.105 255.255.255.0
no ip directed-broadcast
THanks

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

Thanks Irmoore for your help. I will get someone to fix it, I really appreciate the time you took looking into my problem.

I hate that we can't get you going here. I just went onsite with a customer that had very similar issues where the whole network ground to a crawl and we kept seeing error counters on the firewall interfaces that were 'other' errors.
Went in looking for a network problem or switch loop. What I found was a dns loop that was causing so much network traffic that it took down the whole network. Primary dns server listed proxy server as forwarder, proxy server listed remote site dns servers as forwarders. Primary dns server did not have remote secondary dns servers in the list of servers that it would exhange zone files with so they weren't getting the zone information at all. Fixed that in 5 minutes flat and the network was humming right along faster than ever with a bunch of happy people.

Error packets ended up being dual-homed server NIC teaming heartbeats which did not affect the network.

Network issues are not always solved by just looking at the primary symptoms.

Hope you get someone good to help you out!

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

OK guys
Your suggestions with DNS tempted me to check DNS event viewer. I am getting lots of Event Id: 4515 saying the zone 'ourdomain' was previously loaded...........................
may be this is causing the intermittence in the internet connection??
Help