Topic: SME Server suddenly consuming my DSL bandwidth -- Solved

[olivers]

I have a SME Server 6.0.1 that shares a 800K DSL line with a separate Dlink router for the rest of my home network. The server is mainly used for mail and a photo gallery.    Both router and SME Server have static IPs and access the DSL modem via a 5 port switch.  This configuration has run satisfactorily for a couple of years or so.  I use Clamav and Spamassassin per Jesper's howtos.

Since yesterday, when my SME server is online, all other machines time out when trying to ping my local ISP's gateway through the Dlink router and hence fail to find their DNS servers.   When the  SME server is not running, PCs inside the router can access the ISP DNS very easily with ping time of ~22ms.

When the SME Server is online alone, it can ping the gateway with times around 3-7 seconds.  This is none too impressive and out of character for a 2.4G Athlon with 512M RAM -- not that that would affect ping times much!

I cannot find anything unusual in the logs except lots of DNS servfail errors.  
For example in the dnscache log, I have lots like:
2005-12-11 21:56:01.188424500 servfail gte.net. input/output error
2005-12-11 21:56:01.188426500 sent 128845 25
2005-12-11 21:56:03.998141500 query 129025 c0a864fe:8841:6e2d 1 mx01-dom.earthlink.net.
2005-12-11 21:56:03.998144500 tx 0 1 mx01-dom.earthlink.net. . c0702404 c1000e81 803f0235 c6290004 ca0c1b21 c620400c c0cbe60a 8009006b c021040c c0249411 c00505f1 80080a5a c03a801e
2005-12-11 21:56:06.198123500 servfail mx01-dom.earthlink.net. input/output error
2005-12-11 21:56:06.198128500 sent 128846 40

This problem occured suddenly 24 hours ago when the network got really slow.  I naturally rebooted the DSL modem, router and switch.   Unfortunately on about the third time, I evidently blew the the DSL modem power supply when disconnecting it to reboot.   I have since replaced it and it is now working OK

I have confirmed the ISP's network and servers are OK via tests with their technical support.  So far I have substituted the cable modem for an identical model, changed the switch for a hub and tried another router to no avail.  I have powered down the whole network for a few minutes and rebooted but have yet to change the NIC.  The symptoms are always the same so I suspect the SME Server is the problem somehow.

I have run a clamscan and the machine is clean of viruses, nor does not run any filesharing software.

I suspect some DNS lookup problem.

Any ideas would be gratefully appreciated.
- Oliver

[CharlieBrady]

I cannot find anything unusual in the logs except lots of DNS servfail errors.  
For example in the dnscache log, I have lots like:
2005-12-11 21:56:01.188424500 servfail gte.net. input/output error
...

That usually indicates a lack of returning DNS reply packets. You logs show queries being sent, but no replies being received.

Before you pull all your hardware apart, you should determine what network traffic is leaving your box and what is coming back.

[olivers]

Thanks Charlie.

Any tips on where to start? Could this problem originate outside my box as I have not knowingly changed anything?  
 
Would you start with Snort (or the like) on the SME or some sort of traffic sniffer between the SME Server and the switch?

Sorry it's still all questions my end.

Best,
Oliver

[irian]

I dont think it is a hardware problem.
Are your pcs clean from viruses and spyware?

Irian

[olivers]

Ok -- Problem fixed

I installed Ethereal on my laptop and monitored the server's connection to the DSL modem via a hub.  Ethereal showed lots of attempts to communicate with two mail servers.  

With a bit of help from Google and the following article from APLawrence, I cleaned out the outbound mail queue and restarted.

http://aplawrence.com/SME/largenewsletter.html

The problem was an (inadvertantly sent) large Publisher document (15MB) that our server could send, but that one of the recipients evidently couldn't receive,  so it bounced back and forth in the ether.   I must have have 30 copies in the outbound message queue!

My wife has promised to check the size of attachments before she sends them in future.

Thanks guys.