Re: Trouble in the network

From: Herb Martin (news_at_LearnQuick.com)
Date: 11/29/04


Date: Sun, 28 Nov 2004 22:07:26 -0600


> So I would like to scan my network of "unnatural behavior". Like if there
> is many TCP packed that is slowing down my internal network.
> Not sure if you understand, but its hard to explane when am not sure what
am
> gonna scan for.

Well the canonical answer to that is some sort of
Intrusion Detection System (IDS) like the free Snort.
(Snort.org or WinSnort) but takes a bit of experience
using it before you are likely to know what to look
for and how to interpret the results.

Don't let that stop you but rather just recognize that
even if it doesn't solve this problem it may help
next time....

-- 
Herb Martin
"Arne And" <kjellhoy@start.no> wrote in message
news:codhts$hrv$1@troll.powertech.no...
> Hmm well. My CPU is going "bananas". When NS service is running, the CPU
is
> 100 %. When I termenate it, it gos back to normal around 15%.
>
> This is kind of stupid question, but am not sure what am gonna "scan" for
> hehe.
>
> The last few days some users have been complaining about "slow" network.
> They say that is takes a loong time to get some files from a fileserver
etc.
> I allso use NetOp to remote controll my server from a workstation. And I
> have lost the connection to this exact  server. (The TCP/IP connection
where
> lost it says)
>
> I have never been infected by any virus. Am running all Windows 2000
server
> / pro on workstation. Everyone is fully patch and with the lates SP. Allso
> running anti-virus on everthing.
>
> My fear is that I have been infected with a worm of somekind, but not
sure.
>
> So I would like to scan my network of  "unnatural behavior". Like if there
> is many TCP packed that is slowing down my internal network.
> Not sure if you understand, but its hard to explane when am not sure what
am
> gonna scan for.
>
> -regards
>
> -AA-
>
>
> "Herb Martin" <news@LearnQuick.com> skrev i melding
> news:e53IaLZ1EHA.1860@TK2MSFTNGP15.phx.gbl...
> > "Arne And" <len-rol@online.no> wrote in message
> > news:b_pqd.19184$Km6.236460@news4.e.nsc.no...
> > > Hi
> > >
> > > I was just woundering if there is any good programs that can scan my
> > > internal network for overload.
> >
> > Depends on what you mean by "scan".
> >
> > If you wish to see the bandwidth usage, the built
> > in server (might need install) NetMon or free programs
> > like Ethereal can show you this.
> >
> > > The last time I have encounter that many of my computers has been slow
> > when
> > > accessing some of my file servers etc. Am running all win2000 domain
> > > (server - workstations with the lates sp and patches)
> >
> > Usually this is something else, unless you have many clients
> > on the same network(s).
> >
> > -- 
> > Herb Martin
> >
> >
> > >
> > > Regards
> > >
> > > -AA-
> > >
> > >
> >
> >
>
>


Relevant Pages

  • Re: Still having firewall issues
    ... Microsoft CSS Online Newsgroup Support ... How many subnets are in your SBS internal network? ... |> 4) Click Add Adapter and then select Server Local Area Connection. ... |> to the same internal default gateway address as the ISA Server computer. ...
    (microsoft.public.windows.server.sbs)
  • Re: Still having firewall issues
    ... How many subnets are in your SBS internal network? ... > 4) Click Add Adapter and then select Server Local Area Connection. ... No default gateway difined. ... > to the same internal default gateway address as the ISA Server computer. ...
    (microsoft.public.windows.server.sbs)
  • Re: WM 5.0 and Sprint 6700 PPC-cant sync in cradle but can through EVDO
    ... the external address won't ever work on the internal network. ... ActiveSync 4.x Troubleshooting Guide - ... SBS Server 2003 SP1 ... I can WIRELESSLY sync to the server with the 6700 PPC using the Sprint ...
    (microsoft.public.pocketpc.activesync)
  • Re: preventing username enumeration on NT4
    ... it appears as though the attacker did nothing more ... You shouldn't be running a server that provides external Web Services ... attached to your internal network. ... Why are you sharing drives across the Internet? ...
    (comp.security.misc)
  • Re: Gurus: server on perimeter vs. corporate advice
    ... But if you put the Sharepoint in the "DMZ", you would need to open various ... ports to allow communication from the DMZ to the Internal network (I think ... When you "open" such ports for a server that resides in the DMZ, ...
    (microsoft.public.security)

Loading