Probably a good idea to ignore "thekevin" (wonder who "theotherkevin" is?) in general. Time to start with some perf counters. Specifically, any ISA or network counters that deal in "backlogged" or "queue". -----Original Message----- From: Ball, Dan [mailto:DBall@xxxxxxxxxxx] Sent: Thursday, June 30, 2005 8:11 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Strange Problem... http://www.ISAserver.org I've had this slowdown happen several times today, and haven't figured out what is going on yet. Traffic passing through the server drags to a halt (RDP continues to work fine though), VPN connections drop, then a few minutes later everything is running smoothly again. Reviewing the logs shows nothing out of the ordinary, the only things curious are a few entries similar to the below entries. How do I troubleshoot this? Regardless of thekevin's thoughts, I'm not going to "FDISK" my server to fix it. Heck, I can't even remember the last time I used FDISK, repartioning has been part of the OS installation for many years now. Not to mention all my servers have RAID arrays, not a good thing to use on them... ________________________________ From: Ball, Dan [mailto:DBall@xxxxxxxxxxx] Sent: Wednesday, June 29, 2005 12:14 PM To: [ISAserver.org Discussion List] Subject: [isalist] Strange Problem... http://www.ISAserver.org Had a major slowdown of all web traffic this morning, so I logged into the ISA server and checked out the logs. There was a large amount of NetBIOS traffic being logged, so I captured several seconds of it from the firewall log, and restarted the server. The problem has since disappeared. Here are two entries that kept repeating themselves: Original Client IP Client Agent Authenticated Client Service Server Name Referring Server Destination Host Name Transport MIME Type Object Source Source Proxy Destination Proxy Bidirectional Client Host Name Filter Information Network Interface Raw IP Header Raw Payload Source Port Processing Time Bytes Sent Bytes Received Result Code HTTP Status Code Cache Information Error Information Log Record Type Log Time Destination IP Destination Port Protocol Action Rule Client IP Client Username Source Network Destination Network HTTP Method URL 24.213.58.250 GATEWAY - UDP - - 137 0 0 0 0xc0040030 FWX_E_OUTBOUND_PATH_THROUGH_DROPPED 0x0 0x0 Firewall 6/29/2005 9:07 10.6.8.72 137 NetBios Name Service Denied Connection 24.213.58.250 Local Host Internal - WAN Network - - 10.20.3.22 GATEWAY - UDP - - 137 0 0 0 0xc0040030 FWX_E_OUTBOUND_PATH_THROUGH_DROPPED 0x0 0x0 Firewall 6/29/2005 9:07 10.6.8.72 137 NetBios Name Service Denied Connection 10.20.3.22 Local Host Internal - WAN Network - - 24.213.58.25 is one of our Public IP addresses 10.20.3.22 is a DHCP lease that was supposedly currently in use by the ISA server, for VPN clients 10.6.8.72 is a workstation on one of our subnets. There were no VPN connections in session at the time. Anyone else seen something like this? ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: dball@xxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned.