Network Problem

[vti]

Hi all
I am having really silly problem that our company has a few branches and they connected by using 64K Leased line modem .They usually use 20K-25K of 64K but these days they use 60-62K and it's normally impossible even they would busy too much.It can't be an iis probblem cause they don't have any ,but i am having a suspicion that they use IExplorer 5,01 and higer version.Do you think is there any bug ?

Thanks fo any help

 

[pmkincaid]

If you have been only seeing this for the past couple of days, I would point to the Nimda virus. Even if you are not vulnerable and/or are completely protected, other hosts that have already been compromised are scanning networks for vulnerabilities.







My home account, which does not have IIS anywhere near it, has gotten more than 21000 requests for cmd.exe alone from nearly 300 unique IPs.







I would sniff the traffic going across your network to see what it is - you can get an idea, even if it isn't Nimda, as to what the traffic is by sniffing it.

If it is severely affecting network performance (which it sounds like it is) talk to your upstream provider about blocking cmd.exe, msadc and readme.eml at their routers.

Hope this helps,
Paul