• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

UDP Flooding + LOG Size

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Firewall] >> General >> UDP Flooding + LOG Size Page: [1]
Login
Message << Older Topic   Newer Topic >>
UDP Flooding + LOG Size - 6.Apr.2009 5:59:15 AM   
zzz343

 

Posts: 764
Joined: 19.Feb.2002
From: World's 7th Nuclear Power
Status: offline 		Dear All,

I have Windows 2003 with SP2. ISA 2004 standard edition with SP3.
AD and ISA Server on same machine.All users are logged on domain.

I am facing this issue that my Firewall Log size getting Huger day by day , after analyzing logs, I see following entries (probably Flooding) all over log. Each day log size reaches upto 1GB.

Howto get rid of this problem ?


LOG sample =====================================

KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.62:2881, 192.168.2.4:88, 192.168.2.62, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.39:4141, 192.168.2.4:88, 192.168.2.39, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 10172, 10172, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.39:4461, 192.168.2.4:88, 192.168.2.39, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, 15, 15, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.1.2:40574, 203.99.163.240:53, 192.168.1.2, Local Host, External, Establish, 0x0, Allow DNS from ISA Server to selected servers, DNS, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.62:2563, 192.168.2.4:88, 192.168.2.62, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 14968, 14968, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.62:2882, 192.168.2.4:88, 192.168.2.62, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.93:3411, 192.168.2.4:88, 192.168.2.93, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 21765, 21765, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.93:3902, 192.168.2.4:88, 192.168.2.93, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.66:4072, 192.168.2.4:88, 192.168.2.66, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 19438, 19438, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.66:4552, 192.168.2.4:88, 192.168.2.66, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.37:1594, 192.168.2.4:88, 192.168.2.37, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 21734, 21734, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.37:2090, 192.168.2.4:88, 192.168.2.37, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.107:2629, 192.168.2.4:88, 192.168.2.107, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.65:4803, 192.168.2.4:88, 192.168.2.65, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 17547, 17547, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.65:1315, 192.168.2.4:88, 192.168.2.65, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.39:4144, 192.168.2.4:88, 192.168.2.39, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 10171, 10171, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.39:4464, 192.168.2.4:88, 192.168.2.39, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.66:4075, 192.168.2.4:88, 192.168.2.66, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 19437, 19437, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.39:4145, 192.168.2.4:88, 192.168.2.39, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 10187, 10187, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.66:4555, 192.168.2.4:88, 192.168.2.66, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.39:4465, 192.168.2.4:88, 192.168.2.39, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.37:1597, 192.168.2.4:88, 192.168.2.37, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 21719, 21703, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.37:2093, 192.168.2.4:88, 192.168.2.37, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.62:2564, 192.168.2.4:88, 192.168.2.62, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 15078, 15078, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.62:2885, 192.168.2.4:88, 192.168.2.62, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.107:2632, 192.168.2.4:88, 192.168.2.107, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.93:3414, 192.168.2.4:88, 192.168.2.93, Internal, Local Host, Terminate, 0x80074e23, AR, UDP Outbound, -, 0, 0, 0, 0, 21828, 21828, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.2.93:3905, 192.168.2.4:88, 192.168.2.93, Internal, Local Host, Establish, 0x0, AR, UDP Outbound, -, 0, 0, 0, 0, 16, 16, -, -, -, -, -, -, -, -, -, -, -
KHIC-NETSERVER, 4/6/2009, 14:44:53, UDP, 192.168.1.2:42776, 203.99.163.240:53, 192.168.1.2, Local Host, External, Establish, 0x0, Allow DNS from ISA Server to selected servers, DNS, -, 0, 0, 0, 0, -, -, -, -, -, -, -, -, -, -, -, -,

_____________________________

Regards,
Syed Jahanzaib

Email : aacable@hotmail.com
Post #: 1
RE: UDP Flooding + LOG Size - 6.Apr.2009 11:52:42 AM   
Dumber

 

Posts: 278
Joined: 21.Mar.2008
Status: offline
quote:

ORIGINAL: zzz343

Dear All,

I have Windows 2003 with SP2. ISA 2004 standard edition with SP3.
AD and ISA Server on same machine.All users are logged on domain.



I would say, remove ISA from the DC and install a separate server with ISA.

_____________________________

Marcel
Netherlands

MCTS, MCITP (SA,EA) MCP, MCSA:Security, MCSE:Security, CCNA, CCSA, CCSE, CCSE+
No matter how secure, there is always the human factor.
http://www.phetios.com/

(in reply to zzz343)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Firewall] >> General >> UDP Flooding + LOG Size Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts