Re: Internet slowdown. Is ISA being spoofed...

Hello Customer,

Thank you for posting here. Let's also thank Jim for the good input.

According to your description, I understand that you Internet connection
slowdown. If I have misunderstood the problem, please don't hesitate to let
me know.

First I want to explain that this is a performance issue, it is hard to
troubleshoot it in newsgroup. We may need spend more time on this issue.

Based on my research, the network performance issue refer to many factors:
ISP, router, SBS hardware (CPU, memory, NIC, driver), switch, client system
performance.

I suggest we try the following steps to see if we can resolve this issue:

1. Please connect your ISP to ensure the Internet connection is stable.

2. Please check the router to ensure it is set properly.

3. Please check the system performance on SBS and clients.

4. Try to change switch and cable to test.

We can do the following test to narrow down the network performance issue.

1. Please connect one client computer directly to router to bypass SBS, and
test the Internet connection performance. What's the result?

2. Does this network performance issue happen on all clients? Does this
issue happen on SBS?

Meanwhile, on SBS we run the CEICW to configure the ISA server 2004. By
default the ISA server has 22 rules. The rules are safe for your SBS 2003.

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
Thread-Topic: Internet slowdown. Is ISA being spoofed...
thread-index: AcjQeg7lIooonqXiQW2eF5yIxgaQTg==
X-WBNR-Posting-Host: 207.46.193.207
From: =?Utf-8?B?Y2s=?= <ck@xxxxxxxxxxxxxxxxxxxxxxxxx>
References: <79C10070-3F72-41F3-A1C8-F686D356436B@xxxxxxxxxxxxx>
<bv8f54lcrs4fmhjpu0p1mgbp4tkhd369rf@xxxxxxx>
Subject: Re: Internet slowdown. Is ISA being spoofed...
Date: Tue, 17 Jun 2008 06:00:03 -0700
Lines: 55
Message-ID: <5CDD8761-0577-44AD-AC46-921119E5812B@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
Newsgroups: microsoft.public.windows.server.sbs
Path: TK2MSFTNGHUB02.phx.gbl
Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:111966
NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
X-Tomcat-NG: microsoft.public.windows.server.sbs

Thanks Jim, false positives... Shall give it a read.

What concerning me more is the slow down the network is getting to the
external (internet). Plus the rapidshare thing has got my head scratching
as
if it's being poxy spoofed it's slow everything down so how do I detect
and
stop it!!

"Jim Behning SBS MVP" wrote:

There is an article by JimH about the port scan is a 99.99xx% false
report. What happens is connection shutdown in a way that confuses ISA
and ISA give a false port scan report. Forget my summary and read his
article.
http://technet.microsoft.com/en-us/library/cc512655.aspx

On Tue, 17 Jun 2008 03:40:02 -0700, ck <ck@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:

SBS2003 R2 Premium
ISA2004 SP3
BT2700 router

I've a bit confused on this, been getting some Internet slowdown. :(

However, I just so happened to be on rapidshare.com to downloading a
file
and noticed it keep stating that either the connection had exceeded it
limit
or IP was currently downloading a file.

Except the IP address it gave me is one that appears in the routers
Primary
Domain Name Server 194.xx.x.xx!!


Is there something open on ISA configuration or miss configured on my
router
to be allowing this.


If I check rapidshare.com again when the IP address appears or before
it
appears would running ISA logging show what


Under my alerts in ISA2004 I'm seeing 'ISA Server detected al all port
scan
attack from IP: 66.102.1.103, 64.233.169.99 and connection exceeded for
one
of my machines. If I run ISA's loggin would should I look out for?


How is this IP address being spoofed there isn't much I have changed
from
ISA configuration on IC wizard.


Any troubleshooting help is appreciated. :)
See what SBS support is working on
http://blogs.technet.com/sbs/default.aspx
Check your SBS with the SBS Best Practices Analyzer
http://blogs.technet.com/sbs/archive/tags/BPA/default.aspx



.

Relevant Pages

  • RE: Windows SBS 2003 SBCore shutdown
    ... Welcome to SBS newsgroup. ... I understand that you get an error "Windows Small ... 817876 The Internet Connection Firewall /Internet Connection Sharing ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA 2004 and the internet connection
    ... would you please help me confirm if the internet ... This newsgroup only focuses on SBS technical issues. ... |> Open the ISA Server management console, ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA 2004 and the internet connection
    ... would you please help me confirm if the internet ... This newsgroup only focuses on SBS technical issues. ... |> Open the ISA Server management console, ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA Server Management console fails to load
    ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... ISA Server Management console fails to load ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA 2004 and the internet connection
    ... I have tried all the ISA server setting, even changed it up to 400. ... When i connect any computer outside my sbs network directly to my switch the ... internet is super fast as soon as i connect inside the network its slow. ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)