Re: Flaky ADSL Connection/Disconnection Control

Nagy, Laci L wrote:

[snip]
> Thanks for that Ken,
> 
> We're not sure of any file sharing software being around as we tend to rebuild the students' pcs every couple of weeks using Ghost and this has occurred straight after the machines were rebuilt as well. However there could be something on one of the staff machines, we also have to share the internet connection with others outside the school, so we'll check their machines too as it is more likely that they have such software. is there any "easy" way of finding the culprit or do we need to visit each machine individually and search?
> 
> BTW what is considered "excessive"? we get spikes in the traffic graphs, but I'm not sure what is considered acceptable as none of the numbers seem large eg max rates are around the 16kb/sec mark and the highest we've seen is 40kb/sec; a far cry from the 1500kb download speed of the connections.
> 
> Could this problem be solved by moving SM onto a faster processing pc (in the plans anyway so that we can do some content filtering as well) or is it due to the sheer amount of data moving along the pipe rather than the firewalls ability to process it?
> 
> Regards,
> 
> Laci

Hi Laci

You didn't say if the spikes in the graphic were for uploads or 
downloads.  You also didn't state what kind of an uploads rate you have 
on your ADSL line. If your DSL line is similar to mine (i.e. a Bandwidth 
of 768kBits (approx 90 kbytes/sec) downstream & 128KBits upstream) then 
peaks of 16kbytes/sec for uploads is excessive where as downloads of 
16kbytes/sec is nothing much.

In order to control the this you could do one of two things

1.) Control on the graphic graphs the bandwidth over the last month for 
uploads i.e. the -K side of the Red Interface Log.

2.) You could control the amount of data that has been 
uploaded/downloaded on your line over the last month.  Run the following 
command from the root console of your smoothwall.
ipacsum -t "last month"
what your looking for is for high values i.e. several GB's in the
Incoming RED (PPP) Forward
Outgoing RED (PPP) Forward.

If this is the case then in order to find the culprit you could control 
all open connections.  There is a usefull perl script for this which can 
be found at
http://freshmeat.net/projects/conntrackviewer/
In order to control the NATed connection then use "conntrack-viewer.pl 
-m" (naturally without the "").  You should then see a list of all open 
connections including the IP's and Ports.  You just then need to go 
through the list for computers on your network which have a lot of open 
connections to different External IP'S.  There is then a high chance 
that these PC's are running file sharing software.

Ken
_______________________________________________
gpl mailing list
[email protected]
http://lists.smoothwall.org/mailman/listinfo/gpl

SmoothWall Stash - Buy Our Stuff! http://cafepress.com/smoothwall