router is being flooded in the uplaod stream

[gadh]

suddenly all the internet is being blocked to inside users.
i see in the cisco 1605 router:
30 second input rate 0
30 second output rate 124000
(and the line is 128kbit FR)

i've disconnected all the computers from the LAN , one by one, but no use.
after a few hours , all returned back to normal for a few hours, and then again i've got flooded for half an hour and to normal operation again.
is the problem in the router itself ? hardware bug ?
cause i see in its serial output that he has some memory allocation errors sometimes
(MALLOCFAIL err)

Gad

 

[marsd]

sh proc: and see what is going on when this happens; clear your buffers.
I have seen this problem when logging to buffered memory
once or twice.

 

[jeter]

The last time I ran into this problem, it was caused by the hub!!! Check your ethernet setting 10/100 half or ful duplex. Jeter@LasVegas.com
J.Fisher CCNA

 

[yizhar]

HI.

I'm also having a similar problem.
The interfaces are at peak bandwidth (128kbps) in both directions. I don't know why and if it is a legitimate traffic since I'm not at the customer site, but it is like this for several hours and it seems like something is wrong here.

In the same time I get bad ping and tracert responses (3000-4000 ms or timeout) from the internet to the router.

I am planning to try reload the pix that is behind the router and also to reload the router or just shutdown and bring up interfaces first.

Here is more info about the router:

* Network.
The ISP is goldenlines in Israel (AS9116)
The connection type is leased line, 128kbps.
The router is connected to a pix515 firewall which protects a small LAN of single subnet (few servers and about 30 clients).

* show version:
IOS (tm) C805 Software (C805-Y6-MW), Version 12.0(7)T, RELEASE SOFTWARE (fc2)

* show run:
interface Serial0
description Line To Kavey-Zahav (33-280-9342)
bandwidth 128
ip address *******************
no ip directed-broadcast
no fair-queue

* show proc:
CPU utilization for five seconds: 2%/4%; one minute: 5%; five minutes: 5%


* sh int s0:
Serial0 is up, line protocol is up
Hardware is PowerQUICC Serial
Description: Line To Kavey-Zahav (33-280-9342)
Internet address is *******************
MTU 1500 bytes, BW 128 Kbit, DLY 20000 usec,
reliability 255/255, txload 249/255, rxload 139/255
Encapsulation HDLC, loopback not set
Keepalive set (10 sec)
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 35/40, 21240 drops; input queue 0/75, 0 drops
5 minute input rate 70000 bits/sec, 19 packets/sec
5 minute output rate 125000 bits/sec, 16 packets/sec
7531549 packets input, 449309182 bytes, 0 no buffer
Received 228255 broadcasts, 0 runts, 2 giants, 0 throttles
558 input errors, 63 CRC, 210 frame, 0 overrun, 0 ignored, 285 abort
7292593 packets output, 3992098228 bytes, 0 underruns
0 output errors, 0 collisions, 37 interface resets
0 output buffer failures, 0 output buffers swapped out
8 carrier transitions

* sh int e0:
Output queue 0/40, 0 drops; input queue 0/75, 0 drops
5 minute input rate 131000 bits/sec, 14 packets/sec
5 minute output rate 76000 bits/sec, 17 packets/sec
7018535 packets input, 4083551845 bytes, 2 no buffer
Received 3 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
7540556 packets output, 558544071 bytes, 0 underruns
74 output errors, 10287 collisions, 1 interface resets
0 babbles, 0 late collision, 58923 deferred
74 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out


What can you tell me about this?
(I have CCNA but only a little experience with routers).

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[jeter]

WOW, looking at your sh interfaces you have some problems.
What have you done to have the circuit checked out. What i think the prblem is is that your bandwidth is to low. Do a clear counters and check the router out during the day and monitor the activity of the lan. Jeter@LasVegas.com
J.Fisher CCNA

 

[yizhar]

HI.

It seems to me that my problem is caused by an email virus that has infected our client and send many emails, and I'll check further after the weekend.
Thanks
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[gadh]

yes !
i found it !
it was the LITMUS irc robot virus (trojan)
search for your PC's for litmus directory and delete it !
thanks to you all anyway.

Gad