Loosing Connection To Internet

[sky-knight]

The load? over 30! For exactly 30 seconds. Removed the Clam module and now it only hits 15 or so.

If I lower the load limit, won't that allow stuff to hit mail mail server unscanned? I'm spoiled... the spam booster does such a great job I don't want the junk in my inbox... I'd rather deal with a box loading up randomly.

[wtangle]

Originally Posted by sky-knight

Clean that box and see if the problem goes away. One good torrent hound can do this by itself.

The system is clean now, but what was detected as a trojan was actually a file from a folder that I put on the computer with a utility I used some months ago... don't know, might have gotten infected or was a false positive. Anyway, yesterday when my compute lost web browsing, this computer seems to have been working okay. It was never recorded in the attack blocker event log the whole of yesterday. In fact at the time I lost connectivity, nothing showed up in attack blocker event log.

[mrunkel]

Originally Posted by sky-knight

If I lower the load limit, won't that allow stuff to hit mail mail server unscanned? I'm spoiled... the spam booster does such a great job I don't want the junk in my inbox... I'd rather deal with a box loading up randomly.

If it's set to fail closed it will just reject the mail forcing the sending server to resend at a later time, hopefully when the box isn't loaded.

Sending servers will usually retry for 24 hours with an increasing back off time.

[dmorris]

beware if the outages are load related that hitting refresh on the eventlog can contribute to the problem.

If its load related I would expect it to happen to everyone on the network at the same time though...

[wtangle]

Originally Posted by dmorris

If its load related I would expect it to happen to everyone on the network at the same time though...

This is why I find this strange, it doesn't happen to everyone. It appears that the tcp connection times out, I think. Is it recommended to configure the Untangle's Ext IP as a secondary gateway on the computers? Will this help keep all connection active and at the same time be able to establish new connections without having the problems we are having?

[richgill]

I have the same issue. The Untangle (7.4) runs in bridged mode behind a firewall.
I am running Phish Blocker, Spyware Blocker, Webfilter, Virus Blocker, Intrusion Prevention, Protocol Control, Ad Blocker, Attack Blocker and Reports. The average load is low (~0.3)

For a very short period (~30 seconds) tcp traffic is effectively blocked. I have tested with http and ftp and monitored the traffic on my PC. My PC will send a SYN and about 2ms later receives a RST, ACK. I am assuming this reset comes from the Untangle box.

This will affect a single PC rather than the whole network. (ie one person will complain of browsing issues, not everyone).

I have now turned off Attack Blocker to see if that changes anything.

[tbeck1983]

I have had the same exact problems and symptoms as richgill. See http://forums.untangle.com/networkin...nectivity.html

I ran 2 tcpdumps
tcpdump -i eth0 -S -s 0 port 80 and host 192.168.1.55 (no packets captured)
tcpdump -i eth1 -S -s 0 port 80 and host 192.168.1.55 (packets captured attached)

Running Spyware Blocker, Web Filter, Virus Blocker, Intrusion Prevention, Protocol Control and Reports on Untangle 7.4. Average 1-min Load (0.03)

Also, completely reloaded Untangle box and symptoms persist.

[tbeck1983]

Any ideas on why the packets are getting reset?

[dmorris]

I would start a new thread. This is probably not related to the OP's issue.