RE: CPF5140

[Frank.Kolmann@xxxxxxxxxx]

Thanks Fritz,

We have detected a problem with our firewall. In fact 2 problems.
Our secondary (backup) firewall was malfunctioning and generating 1000's of
ARPs /sec.
Our primary firewall was sending 1.5M data per minute to unknown IP
addresses.
Comms traces showed TCP 'RST' packets causing our devices to drop out.
Dont know the cause of the 'RST'.
We reset the secondary firewall.
We blocked the unknown IP addresses.
The Telnet devices are no longer dropping out.
We are working on identifying the source of the unknown IP addresses.
We suspect either the secondary firewall was the cause or some sort
of worm or virus attack.

Thanks for the advice.

PS.
Thanks also to Tod Kidwell for the TCP cfg tip.


Frank Kolmann



>This sounds a lot like a network issue, either with a hub or switch.
>Get the network gurus to check for collisions or some flakey network
>equipment.
>
>Best Regards
>
>Fritz Hayes
>NCS Tek
>503-768-4600