Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: Peter on September 02, 2003, 06:51:02 PM

Title: Unexplained dialups
Post by: Peter on September 02, 2003, 06:51:02 PM

I would be interested to know if anyone has experienced this. Recently I've found the SME server has been dialed up for up to 6 hours at a time (3 x 7200 mins) in the evening when no-one is using the network. The start times are always on the hour?

Is there anything in the logs that could tell me the IP address of a machine that might be left on in the evening and doing things under it's own control (gulp).

Thanks

Title: Re: Unexplained dialups
Post by: Gary on September 02, 2003, 08:51:36 PM

Have you got a NTP server set in the time config?

Title: Re: Unexplained dialups
Post by: Dave Liquorice on September 02, 2003, 08:53:41 PM

Start times on the hour is probably mail collection. Look in /etc/crontab to see what is scheduled to happen on the hour.

With the state of the net after the recent worms some parts have been very slow, internet protocols are very tenacious and will keep trying and trying to successfully do what they are trying to do. This means an apparently unused dialup link can be  kept up even without any user activity.

Cheers
Dave.

Title: Re: Unexplained dialups
Post by: John Helms on September 03, 2003, 12:58:46 AM

I experienced something like this a few years ago. It turned out to be a copy of Windows Messenger that was loaded on my wifes Win98 system. For whatever reason Windows Messenger was contacting big brother Bill at microsoft.com in the early morning hours. I discovered it by running "karpski" in Linux and watching my wifes system. Caught it in the act so to speak. You can guess what happened to Windows Messenger as a result. Problem went away after Windows Messenger went away. These days none of our systems are running Windows. :)

Title: Re: Unexplained dialups
Post by: Peter on September 03, 2003, 12:17:00 PM

Thanks everyone for your suggestions.  I'll check for an NTP server but I'm still wondering if there is a log I can examine which might tell me which machine is connecting (if any at all) by looking at the ip addresses.

Title: Re: Unexplained dialups
Post by: Ray Mitchell on September 03, 2003, 12:43:50 PM

Look in /var/log/messages and other log files in the same place. You can view these in server manager

Ray

Title: Re: Unexplained dialups
Post by: Ray Mitchell on September 03, 2003, 12:46:33 PM

Also look in diald/accounting.log for dial up connection details
Ray