topic What is it mean? in Network Security

What is it mean?

Mohd Khairul Nizam — Tue, 12 Mar 2019 00:54:41 GMT

Hi, please see attach diagram.

My network always have connection problem everyday around 4.30 - 5.00 pm.

Attach are the screenshot i took photo of my ASA.

The place i highlighted, what does it mean actually??

We are trying to find the root cause of the connectivity problem??

Re: What is it mean?

Bart Kersten — Wed, 30 Jan 2013 20:35:02 GMT

Are you running a back-up to a external location? Which starts at the time you are saying?

Sent from Cisco Technical Support iPhone App

What is it mean?

Jouni Forss — Wed, 30 Jan 2013 20:38:53 GMT

Hi,

Seems to me that some host/hosts are generating alot of traffic from your LAN through the ASA to the Internet.

Is there some backups been taken of servers that use the Internet connection? I'm not familiar with the process of backing up servers but I'd assume you could configure it to work so that it cant hog so much bandwith even though used outside normal working hours.

If this traffic is not caused by some traffic that is "normal" I would suggest monitoring the active connections on the ASA and then determining the hosts generating this traffic and removing them from the network.

- Jouni

What is it mean?

Jouni Forss — Wed, 30 Jan 2013 20:43:08 GMT

Hi,

Seems actually according to the "connections per second" that there is probably only 1 or a very low amount of hosts on the network that could be causing this problem.

I would consider using the command

"show conn long"

Then looking at the output look for connections that have been active for a while and also connections that have so far transfered alot of data. As we can see the data rate is pretty high so the culprit host should be easy to determine.

- Jouni

What is it mean?

Mohd Khairul Nizam — Fri, 01 Feb 2013 07:36:40 GMT

Hi all,

Thank for the respone.

we dont have any backup to external.

Lately we are having problem during that specified time.

I want to catch / isolate the culprit

I attach some more pictures. i dont know to interpret the graph and data.

Pls help?

What is it mean?

Andrew Phirsov — Fri, 01 Feb 2013 08:36:21 GMT

172.27.17.8 sends bunch of traffic to 122.152.181.147.

You have to check what's 172.27.17.8 on your network and find out why it does that.

What is it mean?

Rudy Sanjoko — Fri, 01 Feb 2013 09:18:39 GMT

you can use shun command to shutdown/close the connection temporary for that particular ip, you can also use capture command to monitor/capture the traffic that is causing this, can you also provide the picture for top 10 services?

Re: What is it mean?

Mohd Khairul Nizam — Mon, 04 Feb 2013 06:31:13 GMT

i belive the top 10 services is HTTP and HTTPS.

Only web services but can generate so much traffic. I wonder??

What is it mean?

Jouni Forss — Mon, 04 Feb 2013 11:42:00 GMT

Hi,

As Andrew above said.

You should locate the host with the IP address of 172.27.17.8 behind the ASA that seems to be generating the highest amount of the connections. Then go through that host computer and see what is causing the high amount of connections.

If you only want to use the graphical user interface (ASDM) to troubleshoot this, I would recomment trying to use the real time logging in the ASDM to see what happens when the problem is on.

To view the logs in real time go to the following place in the ASDM

Monitor -> Logging -> View

You can then enter the source IP address and apply it as the filter and only see logs for it. Though I'm not sure how the ASDM works when the problem is on as the host on the LAN seems to push as much traffic to the Internet as the interface is able to transmit. This might make it impossible to use ASDM

I would also suggest configuring a Syslog server to the LAN if possible to store the log data for later reference.

On the ASA CLI you can issue the following commands to see the connections

"show conn"

"show conn long"

"show local-host 172.27.17.8"

If the host 172.27.17.8 is NOT a server you could try to remove it from the network temporarily and see if the problem appears again.

- Jouni