RE: Wierd Issue
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 9 Apr 2003 15:48:17 -0500
Hi JP,
Run network monitor on the ISA Server and you'll find out exactly what's
going on pretty fast.
HTH,
Tom
Thomas W Shinder
www.isaserver.org/shinder
ISA Server and Beyond: http://tinyurl.com/1jq1
Configuring ISA Server: http://tinyurl.com/1llp
-----Original Message-----
From: JP [mailto:picalily@xxxxxxxxxxx]
Sent: Wednesday, April 09, 2003 10:51 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Wierd Issue
http://www.ISAserver.org
Using ISA between Web Servers and the world - no internal users behind
it just the Web servers. Did set up integrated, but not using proxy.
Somehow, it appears one particular individual comes in as a Firewall
Service user and browses dating/singles websites. I noticed the problem
because I started getting Web Proxy errors in the Event log -- "says ISA
couldnt create packet filter for XXX. XXX.XXX.XXX where the Xs were
external IPs" -- acting like they should have been in the LAT. I looked
in regular logs - which got real big starting last weekend... with
entries for www.yahoo.com and other external websites.
Have had 41 unique users in the last week. I've tried forcing
authentication for all outbound traffic. The one big user, I kick out
and he's back in five minutes for more??? I don't think it is spamming
-- they aren't smtp-ing, I don't have SMTP on the ISA, they show up as a
firewall client in the logs and in the sessions (when I catch them on).
Any ideas?
Thanks
Janet Pickel
______________________________________________________
Get Paid... With Your Free Email at
http://www.zwallet.com/index.html?user=picalily
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
