Topic: Unexplained dialups

[Peter]

I would be interested to know if anyone has experienced this. Recently I've found the SME server has been dialed up for up to 6 hours at a time (3 x 7200 mins) in the evening when no-one is using the network. The start times are always on the hour?

Is there anything in the logs that could tell me the IP address of a machine that might be left on in the evening and doing things under it's own control (gulp).

Thanks

[Gary]

Have you got a NTP server set in the time config?

[Dave Liquorice]

Start times on the hour is probably mail collection. Look in /etc/crontab to see what is scheduled to happen on the hour.

With the state of the net after the recent worms some parts have been very slow, internet protocols are very tenacious and will keep trying and trying to successfully do what they are trying to do. This means an apparently unused dialup link can be  kept up even without any user activity.

Cheers
Dave.

[John Helms]

I experienced something like this a few years ago. It turned out to be a copy of Windows Messenger that was loaded on my wifes Win98 system. For whatever reason Windows Messenger was contacting big brother Bill at microsoft.com in the early morning hours. I discovered it by running "karpski" in Linux and watching my wifes system. Caught it in the act so to speak. You can guess what happened to Windows Messenger as a result. Problem went away after Windows Messenger went away. These days none of our systems are running Windows.

[Peter]

Thanks everyone for your suggestions.  I'll check for an NTP server but I'm still wondering if there is a log I can examine which might tell me which machine is connecting (if any at all) by looking at the ip addresses.

[Ray Mitchell]

Look in /var/log/messages and other log files in the same place. You can view these in server manager

Ray

[Ray Mitchell]

Also look in diald/accounting.log for dial up connection details
Ray