RE: Very slow internet browsing
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Sun, 16 Feb 2003 19:40:17 -0600
Hi Sachin,
1. Check out http://isatools.org for something that might help with the
intraarray address problem
2. What log is generating the most traffic? You can reduce log size by
reducing the number of fields that are logged
3. Port scans may or may not be of concern. You'll have to check your
logs. You might also want to change the sensitivity for triggering the
alert.
HTH,
Tom
Thomas W Shinder
www.isaserver.org/shinder
ISA Server and Beyond: http://tinyurl.com/1jq1
Configuring ISA Server: http://tinyurl.com/1llp
-----Original Message-----
From: sachin vaish [mailto:sachin.vaish@xxxxxxxxxx]
Sent: Friday, February 14, 2003 8:08 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Very slow internet browsing
http://www.ISAserver.org
Well no not really. No big errors are showing as we can see.
I have some warnings and errors in the event viewer. Here are some that
may cause concern:
The description for Event ID ( 0 ) in Source ( RAINPlatformLog ) cannot
be
found. The local computer may not have the necessary registry
information
or message DLL files to display messages from a remote computer. The
following information is part of the event: [15/Feb/2003:01:54:40] (W!)
RainConnect: ISP 6 is UP
The <I>IntraArrayAddress</I> defined on this server is not in the Local
Address
Table (LAT). For more information about this event, see ISA Server Help.
ISA Server detected a well-known port scan attack from Internet Protocol
(IP) address xxx.xxx.xxx.xxx. A well-known port is any port in the range
of 1-2048. For more information about this event, see ISA Server Help.
We are getting a lot of port scan attacks with the same error message as
above.
We have also just started using the firewall client.
Another is the ISA Server logs we are generating are huge. We have
around
16GB in just a couple of weeks.
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
