4+ a day outage on the weekends

[fbohab]

Experiencing quite a bit of outage on the weekends. I know my server isn't physically crashing as my services (once connection is restored) show no down-time, however, the network just disconnects from the machine.

Basically the behavior is that I lose server connection (on a program called TeamSpeak) along with everyone else who uses the program, for about 5 minutes, then I can reconnect. I've checked Teamspeak's error logs for errors to make sure it's not the software and there's nothing listed.

Anyone else experienced this? My server is Windows 2003 and I have shut off all services for troubleshooting but it still occurs. Seems to happen more frequently on Friday/Saturday/Sunday than on the week days.

Thanks!

[MQ-James]

I doubt it is the network, when the TS server goes down can you rdesktop the server?

[mikron15]

No outages past this weekend..Are u on the VDS or dedicated server?
Do u have MRTG installed? if yes, is there any unusual bw pattern?

[ChronoCross]

Remember if you windows freezes, even if for 10 seconds then recovers you will get disconnected from most network connectiong that are streaming.

[MQ-James]

if the drop outs are regular, maybe a program is causing the problem.

[faqall]

do you have any software based firewall running or any type of virus programs running?

[MQ-James]

or, it could be a NIC issue when it reaches so many connections, I had a mobo the other day ina pc I was ubuilding where the onboard nic had 60% loss to the hub, but popped in a PCI card and it worked fine.

[fbohab]

Hi guys,

Thanks for the replies. There's no firewall running or MTRG. Good to know no one else was experiencing this, probably something on my end I'm running. I haven't disabled the DNS service I'm running so I'll try that next I suppose. Thanks!

[mikron15]

try setting up mrtg too, that will help u decide, if u were Ddosed or not.

[MQ-James]

also, run the command:

iftop

in SSH, you may need to install it. (http://www.ex-parrot.com/~pdw/iftop/)

[faqall]

if your using windows you should be using firedaemon tools (useually its a given)

here is a helpful link for mrtg on windows:
http://www.firedaemon.com/HOWTO/MRTG/

[MQ-James]

I posted some links to do with mrtg in the general comments section, I run on my home system, DUMeter it tells you in real time your upload and download statistics as well as daily, and monthly totals. Good tool.

[psyxakias]

Actually, I think fbohab means the Level3 issues we all have been noticing mostly at weekends as most attacks are coming at weekends and messup the Level3 router. Don't you think?

The good thing is that the packetloss doesn't last long and from what bummer said on another thread, we'll be moved to another Level3 router in 22-23rd of this month that handles multiple OC-192 connections.

mikron15, I don't know about you but my logs (verified from sharktech and non-sharktech servers) are showing these 2 problems past weekend that were caused due to packet loss in Level3's router:
[11th Dec 2004] 03:24-03:30 GMT => 60-80% packet loss
[11th Dec 2004] 05:04-05:14 GMT => 90-95% packet loss

Let's hope all these issues will be solved once Yipes/Level3 switches FDC to a better router. :)

On the other side, if fbohab's server gets DoS/DDoS'ed then this surely be an extra reason for short outages that will affect just his server. :(

[ChronoCross]

I think it has become quite aparent that anyone on at least the IRC side of things should be using a professional firewall on their servers, and I would recommend it for use on peoples web servers as well. you can really never be to careful in this day and age. The packetmonkeys and hackers are getting younger and younger.

[MQ-James]

it is so sad that people lower themselves to this level for revenge, or just "respect" and you only earn the respect of people even lower than you. If you have the knowledge, then put it to good use, if you can hack any linux, windows, unix or whatever box, then you could be paid loads as a security person...

[faqall]

coouldnt help but notice rizon.net in your sig, heheh that place is growing like mad.

[mikron15]

hmm.. what position u got on Rizon Chrono? does the nick CjB rings a bell?

[blenard]

Force the NIC to 100 Mbps FD
Had the same issue on my Linux box.

[ChronoCross]

hmm.. what position u got on Rizon Chrono? does the nick CjB rings a bell?

hahaha CJB was the owner of mircx irc network. I used to hang out there before I came to rizon. I don't have a position on rizon I'm just a big fan of the network. I mainly do technical support in chat channels and whatnot. when I'm online that is.

Too bad the script kiddie bastards dossed mircx out of existence that was sucha good network too.

[mikron15]

Ahh.. well..Cjb is on BA now.. moved his channel over here past 1 year..and has some mirror channels on diff network too