Inoc 6 strange behaviour

[Donkey1]

We have inoc6 running on our servers and workstations in a win2k environment. Our DC acts as the admin server for inoc and supplies sig updates for our network - this works fine.

I have noticed that around lunch time every day our DC is trying to connect via the internet to IP address 0.0.0.10 via port 42510 (this will obviously not work as this is not valid IP address). The reason I suspect inoc6 to be the culprit is that inoc IP net discovery is done via ports in that range.

Has any one else encountered such a problem before? If so could you suggest a way of fixing it please?

Thanks...Andy.

 

[Virusbaba]

Hey,

That's a pretty funny name that you have there as your handle. Anyway, here's the thing. Port 42510 is a listening port. Check out this URL and find for 42510 on this page. This is self explainatory.

http://support.ca.com/techbases/ilnt_6/inoc6_faq.html

Port 42510 is the port for Inoculan for listening. The IP address 0.0.0.10 is not a valid IP address. See if you can ping this IP address that you have. Check also for the signature download options in the download settings inside the incoming tab. See if you have ftpav.ca.com as the ftp server that you are downloading the signatures from.

Take care then. Cheers!
Virus Baba

Baba counting starts now..........

 

[Donkey1]

Thanks very much for the post, I think I understand what is going on now. I have been looking for ages to find out what port 42510 was being used for!

However, I still can't understand the 0.0.0.10 business. I have pinged that address with no success. I if read the this correctly, our admin server is trying to communicate with 0.0.0.10 on port 42510 because it has violated the group policy and the server is trying to correct it.

Obviously 0.0.0.10 doesn't exist as such, so I have set alert to send me a message when any machine violates the set policy and see if it ties in with our admin server trying to locate 0.0.0.10

If I have any joy I will let you know.

Working at a place that looks after Donkeys, what would you expect me to call myself?

 

[Virusbaba]

Hi there,

I still don't see a reason for you to have that as your Handle. Anyway, here's the thing. This is something you can check and look for. Go to the Administrator's view after launching InoculateIT and expand the subnets. See how many subnets you have. Click in each of the subnet and right click and edit the subnet. Look for the IP address as 0.0.0.10 in the subnet. This is a guess, but if you are seeing this IP address, I'm sure it's got to be there somewhere. Check it out. Won't hurt..... Cheers!
Virus Baba

Baba counting starts now..........

 

[Donkey1]

Hi again. Have checked out the subnet and no sign of the 0.0.0.10. I have even deleted the subnet and started again but it was still trying to get to 0.0.0.10 even when the subnet wasn't there. The thing that stops it is if I stop the admin server service.

By the way, the reason why I know that it is trying to get to 0.0.0.10 is that it keeps putting an entry into my firewall log.

Very confussed! Will not worry about it too much as it is Friday afternoon - would like to know what is going on though!