RE: How I spent my Christmas vacation

  • From: "Ball, Dan" <DBall@xxxxxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Tue, 3 Jan 2006 13:21:55 -0500

I'm looking at the logs right now, there are some 10,000+ DNS queries
that have passed through in the last 24 hours.  Trying to track down a
pattern.

 

One thing I did notice that the "wrong" server is querying the ISP DNS
server most of the time.  I had originally set it up so that all queries
fall back to one server in our domain, and if that one can't resolve it
THEN go to the ISP.  However, the "alternate" DNS server seems to be the
one doing all the work instead.

 

________________________________

From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] 
Sent: Tuesday, January 03, 2006 1:08 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: How I spent my Christmas vacation

 

http://www.ISAserver.org

Hi Dan,

 

Why not use the ISA logs? If not the logs, you could use MRTG.

 

Tom

 

Thomas W Shinder, M.D.
Site: www.isaserver.org <http://www.isaserver.org/> 
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7 <http://tinyurl.com/3xqb7> 
MVP -- ISA Firewalls
**Who is John Galt?**

 

         

        
________________________________


        From: Ball, Dan [mailto:DBall@xxxxxxxxxxx] 
        Sent: Tuesday, January 03, 2006 11:58 AM
        To: [ISAserver.org Discussion List]
        Subject: [isalist] RE: How I spent my Christmas vacation

        http://www.ISAserver.org

        That does lead me down another avenue of investigation...  My
number of NDRs isn't exceedingly high, and there isn't all that much in
the SMTP queue.  I'm wondering about Amy's mention that her problem was
due to an upstream DNS server.  Is there any other way than the Firewall
Logs to see how much DNS traffic is passing through the ISA server?

         

        
________________________________


        From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] 
        Sent: Tuesday, January 03, 2006 12:48 PM
        To: [ISAserver.org Discussion List]
        Subject: [isalist] RE: How I spent my Christmas vacation

         

        http://www.ISAserver.org

        Hi Amy,

         

        You bet! The DNS stuff can drive you crazy. That's one nice
thing about the Exchange SMTP service, that you can disable NDRs. You
can't do that with the IIS SMTP service. I'm hoping that the Longhorn
IIS SMTP service will allow for the same functionality.

         

        Thomas W Shinder, M.D.
        Site: www.isaserver.org <http://www.isaserver.org/> 
        Blog: http://spaces.msn.com/members/drisa/
        Book: <http://tinyurl.com/3xqb7> http://tinyurl.com/3xqb7
        MVP -- ISA Firewalls
        **Who is John Galt?**

         

                 

                
________________________________


                From: Amy Babinchak
[mailto:amy@xxxxxxxxxxxxxxxxxxxxxxxxxx] 
                Sent: Tuesday, January 03, 2006 11:41 AM
                To: [ISAserver.org Discussion List]
                Subject: [isalist] RE: How I spent my Christmas vacation

                http://www.ISAserver.org

                I agree. Most of the ISA problems can be explained by
poor DNS and/or IIS configuration. I spent some of my "holiday" chasing
down DNS issues for 2 clients. In both cases it turned out that the ISP
DNS was sluggish and was causing email problems for my clients. Exchange
wasn't able to use the smart host with any efficiency. Messy stuff
trying to explain smart hosts and DNS resolution in plain english. Maybe
I should forward the article on to the ISP's! If only their staff could
read.

                 

                I've had to turn off NDR for two servers. I hated to do
it but the queues of NDR's in Exchange were just beyond reason. You
wouldn't believe the amount of junk mail that Travel Agencies and Real
Estate firms receive.

                 

                Amy

                 

                Harbor Computer Services

                Small Business Computer Specialists

                 

                Client Blog: http://smalltechnotes.blogspot.com/

                Tech Blog: http://isainsbs.blogspot.com/

                Website: http://www.harborcomputerservices.net/

                 

                 

                
________________________________


                From: Ball, Dan [mailto:DBall@xxxxxxxxxxx] 
                Sent: Tuesday, January 03, 2006 12:26 PM
                To: [ISAserver.org Discussion List]
                Subject: [isalist] RE: How I spent my Christmas vacation

                 

                http://www.ISAserver.org

                Good article Tom!  Gave me another thing to check next
time things turn sluggish!

                 

                
________________________________


                From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] 
                Sent: Tuesday, January 03, 2006 11:39 AM
                To: [ISAserver.org Discussion List]
                Subject: [isalist] How I spent my Christmas vacation

                 

                http://www.ISAserver.org

                Here's an interesting story on Internet performance
issues:

                 

        
http://spaces.msn.com/members/drisa/Blog/cns!1p9yz6owxXl-uIlyqIZXkCrg!39
0.entry
<http://spaces.msn.com/members/drisa/Blog/cns!1p9yz6owxXl-uIlyqIZXkCrg!3
90.entry> 

                 

                Thomas W Shinder, M.D.
                Site: www.isaserver.org <http://www.isaserver.org/> 
                Blog: http://spaces.msn.com/members/drisa/
                Book: <http://tinyurl.com/3xqb7>
http://tinyurl.com/3xqb7
                MVP -- ISA Firewalls
                **Who is John Galt?**

                 

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
dball@xxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx 

Other related posts: