• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

What are the WPAD entries in my ISA2004 logs?

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting >> What are the WPAD entries in my ISA2004 logs? Page: [1]
Login
Message << Older Topic   Newer Topic >>
What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 10:26:59 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		I get thousands of entries like this in my ISA2004 server's web access logs...what are they?

192.168.1.4 anonymous - N 2006-03-18 16:20:27 w3proxy ISACOMPUTER - 192.168.1.7 192.168.1.7 0 2968 60 2569 http TCP GET http://192.168.1.7/wspad.dat - Inet 10061 0x0 Allow traffic from Internal network to local host - Internal Local Host 0x40 Failed


Thanks!

Arch
Post #: 1
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 10:37:10 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline 		They are FWC attempting to autodetect.  If they are being denied, you probably have not applied SP1 and SkipAuthenticationForRoutingInformation.
http://support.microsoft.com/default.aspx?scid=kb;en-us;885683

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 2
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 11:01:11 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		That was fast...thanks! I am running ISA 2004 with SP2. Also, I did what it said in the KB, rebooted the computer and the entries are still appearing.

Any ideas?

Arch

(in reply to LLigetfa)
Post #: 3
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 11:08:29 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline 		Have you enabled WPAD on port 80?

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 4
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 11:14:06 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		I hate to be a dipstick but how would I check (I can't remember)??

Arch

(in reply to LLigetfa)
Post #: 5
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 11:17:17 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline 		The simplest would be to type that URL in your browser.  It is enabled under the Network property in ISA.

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 6
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 11:24:14 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		If I put http://192.168.1.7/wspad.dat in a browser, it pops back with






The page cannot be displayed

Explanation: The Web server refused the connection, possibly because a service on the upstream server is inactive.

Technical Information (for support personnel)
    Error Code 10061: Connection refused
    Background: When the gateway or proxy server contacted the upstream (Web) server, the connection was refused. This usually results from trying to connect to a service that is inactive on the upstream server.

(in reply to LLigetfa)
Post #: 7
RE: What are the WPAD entries in my ISA2004 logs? - 18.Mar.2006 11:37:27 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline 		Then it sounds like it's not enabled.

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 8
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 2:07:27 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		In reading an article on this, I found that DNS points at port 80 and DHC points at whatever port ISA is using. We use port 8080 so why is all the traffic going to port 80?

If this is not fixable, is there any way to tell it to stop logging that one request?

Thanks,

Arch

(in reply to LLigetfa)
Post #: 9
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 3:50:56 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline 		I don't get what you're after.  Do you want to fix the reason for the error or do you just want it not to log?  If you fix it, then it will log success instead of failure, so the second obective would never be reached.  If you don't want to see it in the log, just set a filter to hide it.

Why did you change to WPAD port from 80 to 8080?  How are you serving up WPAD, by DNS or DHCP?  Are you actually using WPAD or is this just accidental?

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 10
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 4:08:42 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		I'd love to fix it! The only reason I mentioned the logging part was - if it was not fixable- I wanted to turn off logging of the probem.

With that said, I have the DHCP thingy turned on (252) and pointing to port 8080. I did find an entry DNS that was set a logn time ago. I just killed the DNS entry after reading it can only point at port 80.

Also, if it means anything, none of the XP machines do this....only the Server 2003 (SP1) machines make the inquiry. 

Arch

(in reply to LLigetfa)
Post #: 11
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 4:16:24 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline
quote:

only the Server 2003 (SP1) machines make the inquiry

ugh

FWC should not be installed on servers.  Is the server getting its IP from DHCP?  If not, it will not get the WPAD URL.

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 12
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 4:20:31 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		They are teminal servers and one domain contoller. Their IP's are static and the FWC has been told not to autodetect the ISA server....is name is entred manually.

(in reply to LLigetfa)
Post #: 13
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 4:28:28 PM   
LLigetfa

 

Posts: 2187
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline 		OK, I absolve your sin on the Terminal Server.

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to Arch Willingham)
Post #: 14
RE: What are the WPAD entries in my ISA2004 logs? - 19.Mar.2006 4:39:45 PM   
Arch Willingham

 

Posts: 70
Joined: 15.Oct.2001
From: Chattanooga, TN 37404
Status: offline 		I'll be honset, I never heard you were not supposed to put it on a contoller!

(in reply to LLigetfa)
Post #: 15

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting >> What are the WPAD entries in my ISA2004 logs? Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts