[68497] in North American Network Operators' Group
Port 80 Navigation Problem (was:FW: hey had eric sent you)
daemon@ATHENA.MIT.EDU (Riley, Marty)
Fri Mar 12 23:52:10 2004
Date: Fri, 12 Mar 2004 22:44:49 -0600
From: "Riley, Marty" <Marty.Riley@afnnet.com>
To: <nanog@merit.edu>
Errors-To: owner-nanog-outgoing@merit.edu
This is a multi-part message in MIME format.
------_=_NextPart_001_01C408B5.EAFA6D24
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
My apologies to the list - I haven't slept in a day or two and
completely forgot to make a semi-intelligent subject line...
=20
mjr
-----Original Message-----
From: Riley, Marty=20
Sent: Friday, March 12, 2004 22:18
To: nanog@merit.edu
Subject: FW: hey had eric sent you
=09
=09
I'm running short on theories and options, so I thought I would
see if any other ISPs have seen this problem on your network(s). If so,
what was the cure?
=20
mjr
=20
=20
-----Original Message-----
=09
The Unknown problem.
=20
Symptoms: At random times dialup, dedicated, & internal network
users are unable to=20
pass TCP traffic to off network sites. ICMP and UDP
appears to be=20
uneffected by the outage which lasts anywhere from 2
to 5 minutes.
=20
The problem appears to be wide spread with similar
reports from WVNET=20
and other ISPS. nTelos is experiencing a similar
problem but we have=20
yet to confirm it is the same.
=20
Problem has changed in it's action but remained
similar enough to
consider it the same problem.
=20
=20
Effected Platforms: Windows 2000 Pro, XP Home, XP Pro, & 2003
Server.
=20
=20
Uneffected Platforms: Unix, MacOS (?)
=20
=20
History: During the week of 2/9/04 the call center started
recieving reports of=20
users being unable to connect to sites off the CityNet
network. Sites=20
hosted on the internal network are uneffected by the
outage. =20
=20
Initally it was thought to be a Internet Explorer
problem possably caused
by the KB832894 / IE SP1 or other updates but after
further investigation=20
it was found that Mozilla users were encountering the
same problem. =20
=20
After several days of testing it was determined that
during the outage any=20
TCP session started on any port would fail. TCP
sessions started before=20
the outage continue to work and show no ill effects
from the outage.
=20
After logging connection attempts at various intervals
on many machines
there appears to be no sort of pattern in the outages.
Most machines=20
encounter the problem, some more than others and a few
do not encounter
it at all. The duration and frequency of the outage is
very fluid.
=20
During an outage, we can verify that the packet does
seem to leave and reenter
the network:
=20
Mar 5 22:28:04 pittpa-chaswv-ds3 17083: SLOT 2:6d20h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3376) ->
216.41.224.3(80), 1 packet
Mar 5 22:28:09 pittpa-chaswv-ds3 17084: SLOT 1:6d20h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.14.174(3376), 1 packet
Mar 5 22:28:09 pittpa-chaswv-ds3 17085: SLOT 2:6d20h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3378) ->
216.41.224.3(80), 1 packet
Mar 5 22:28:09 pittpa-chaswv-ds3 17086: SLOT 1:6d20h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.14.174(3378), 1 packet
Mar 5 22:33:24 pittpa-chaswv-ds3 17089: SLOT 1:6d20h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.14.174(3378), 7 packets
Mar 5 22:33:24 pittpa-chaswv-ds3 17090: SLOT 1:6d20h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.14.174(3376), 17 packets
Mar 5 22:33:58 pittpa-chaswv-ds3 17092: SLOT 2:6d20h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3378) ->
216.41.224.3(80), 7 packets
Mar 5 22:33:58 pittpa-chaswv-ds3 17093: SLOT 2:6d20h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3376) ->
216.41.224.3(80), 18 packets
=20
Mar 5 00:58:30 pittpa-clarwv-ds3 16062: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3183) ->
216.41.224.3(80), 1 packet
Mar 5 00:58:30 pittpa-clarwv-ds3 16063: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3183), 1 packet
Mar 5 01:03:28 pittpa-clarwv-ds3 16067: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3217) ->
216.41.224.3(80), 1 packet
Mar 5 01:03:28 pittpa-clarwv-ds3 16068: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3217), 1 packet
Mar 5 01:03:34 pittpa-clarwv-ds3 16069: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3228) ->
216.41.224.3(80), 1 packet
Mar 5 01:03:34 pittpa-clarwv-ds3 16070: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3228), 1 packet
Mar 5 01:03:39 pittpa-clarwv-ds3 16072: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3239) ->
216.41.224.3(80), 1 packet
Mar 5 01:03:47 pittpa-clarwv-ds3 16073: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3183) ->
216.41.224.3(80), 74 packets
Mar 5 01:04:13 pittpa-clarwv-ds3 16075: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3183), 72 packets
Mar 5 01:08:46 pittpa-clarwv-ds3 16078: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3218) ->
216.41.224.3(80), 4 packets
Mar 5 01:08:46 pittpa-clarwv-ds3 16079: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3217) ->
216.41.224.3(80), 3 packets
Mar 5 01:08:46 pittpa-clarwv-ds3 16080: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3221) ->
216.41.224.3(80), 19 packets
Mar 5 01:08:46 pittpa-clarwv-ds3 16081: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3228) ->
216.41.224.3(80), 5 packets
Mar 5 01:08:46 pittpa-clarwv-ds3 16082: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3229) ->
216.41.224.3(80), 6 packets
Mar 5 01:08:46 pittpa-clarwv-ds3 16083: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3236) ->
216.41.224.3(80), 9 packets
Mar 5 01:08:47 pittpa-clarwv-ds3 16084: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3233) ->
216.41.224.3(80), 12 packets
Mar 5 01:08:47 pittpa-clarwv-ds3 16085: SLOT 2:5d22h:
%SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3239) ->
216.41.224.3(80), 21 packets
Mar 5 01:09:12 pittpa-clarwv-ds3 16087: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3239), 19 packets
Mar 5 01:09:12 pittpa-clarwv-ds3 16088: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3228), 4 packets
Mar 5 01:09:12 pittpa-clarwv-ds3 16089: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3217), 2 packets
Mar 5 01:09:12 pittpa-clarwv-ds3 16091: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3218), 3 packets
Mar 5 01:09:13 pittpa-clarwv-ds3 16092: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3221), 17 packets
Mar 5 01:09:13 pittpa-clarwv-ds3 16093: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3229), 5 packets
Mar 5 01:09:13 pittpa-clarwv-ds3 16094: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3236), 7 packets
Mar 5 01:09:13 pittpa-clarwv-ds3 16096: SLOT 1:5d22h:
%SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) ->
69.43.23.23(3233), 9 packets
=20
=20
Network analysis showed significant amounts of spoofed
multicast traffic and=20
odd arp traffic.
10:17:16.416222 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
278
10:17:16.421886 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
334
10:17:16.423873 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
262
10:17:16.426948 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
254
10:17:16.432095 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
298
10:17:16.435921 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
274
10:17:16.439959 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
328
10:17:16.445317 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
326
10:17:16.449688 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
330
10:17:16.463537 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp
322
=20
Steps were taken to elminiate the spoofed traffic on
the=20
routers and access servers in the form of ACLs and
filter lists.
Neither have eliminiated the problem... but to what
extent they might
have helped has yet to be determined.
=20
The problem is still occuring, for some users the
duration of the outage=20
seems to have shortened other users notice no
difference. It is not yet
known if the filtering on the routers and access
servers or the conversion
to the 10.x.x.x network has made any difference. We
should have a better idea
in the upcoming days.
=20
What Doesn't help: Removing windows updates. =20
Turning off XP firewall.
Searching for malware. (SpyBot-SD, Adaware)
Virus scanning (Various softwares)
Specifying dns servers.
Reinstalling windows.
------_=_NextPart_001_01C408B5.EAFA6D24
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Message</TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR>
<STYLE>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</STYLE>
</HEAD>
<BODY lang=3DEN-US vLink=3Dpurple link=3Dblue>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D168594604-13032004>My apologies to the list - I haven't slept in =
a day or=20
two and completely forgot to make a semi-intelligent subject=20
line...</SPAN></FONT></DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D168594604-13032004></SPAN></FONT> </DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D168594604-13032004>mjr</SPAN></FONT></DIV>
<BLOCKQUOTE dir=3Dltr style=3D"MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
face=3DTahoma size=3D2>-----Original Message-----<BR><B>From:</B> =
Riley, Marty=20
<BR><B>Sent:</B> Friday, March 12, 2004 22:18<BR><B>To:</B>=20
nanog@merit.edu<BR><B>Subject:</B> FW: hey had eric sent=20
you<BR><BR></FONT></DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D098331304-13032004>I'm running short on theories and options, =
so I=20
thought I would see if any other ISPs have seen this problem =
on your=20
network(s). If so, what was the cure?</SPAN></FONT></DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D098331304-13032004></SPAN></FONT> </DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D098331304-13032004>mjr</SPAN></FONT></DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D098331304-13032004></SPAN></FONT> </DIV>
<DIV><FONT face=3D"Trebuchet MS" color=3D#000080 size=3D2><SPAN=20
class=3D098331304-13032004></SPAN></FONT> </DIV>
<DIV></DIV>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
face=3DTahoma size=3D2>-----Original Message-----<BR></FONT></DIV>
<DIV class=3DSection1>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">The Unknown=20
problem.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Symptoms: At random =
times dialup,=20
dedicated, & internal network users are unable to =
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
pass TCP traffic to off network sites. ICMP and UDP appears to =
be=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
uneffected by the outage which lasts anywhere from </SPAN></FONT><FONT =
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">2</SPAN></FONT><FONT =
face=3DArial=20
size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> to 5=20
minutes.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
The problem appears to be wide spread with similar reports from WVNET=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
and other ISPS. nTelos is experiencing a similar problem but we =
have=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
yet to confirm it is the same.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
Problem has changed in it's action but remained similar enough=20
to</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
consider it the same problem.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Effected Platforms: =
Windows 2000=20
Pro, XP Home, XP Pro, & 2003 Server.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Uneffected Platforms: =
Unix, MacOS=20
(?)</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">History: During the week =
of=20
</SPAN></FONT><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">2/9/04</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> the call=20
center started recieving reports of </SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
users being unable to connect to sites off the CityNet network. =
Sites=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
hosted on the internal network are uneffected by the =
outage. =20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
Initally it was thought to be a Internet Explorer problem possably=20
caused</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
by the KB832894 / IE SP1 or other updates but after further =
investigation=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
it was found that Mozilla users were encountering the same =
problem. =20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
After several days of testing it was determined that during the =
outage=20
any </SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
TCP session started on any port would fail. TCP sessions started =
before=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
the outage continue to work and show no ill effects from the=20
outage.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> =
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
After logging connection attempts at various intervals on many=20
machines</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
there appears to be no sort of pattern in the outages. Most =
machines=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
encounter the problem, some more than others and a few do not=20
encounter</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
it at all. The duration and frequency of the outage is very=20
fluid.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
During an outage, we can verify that the packet does seem to leave and =
reenter</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
the network:</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:28:04</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17083: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.14.174(3376) -> 216.41.224.3(80), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:28:09</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17084: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.14.174(3376), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:28:09</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17085: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.14.174(3378) -> 216.41.224.3(80), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:28:09</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17086: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.14.174(3378), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:33:24</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17089: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.14.174(3378), 7 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:33:24</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17090: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.14.174(3376), 17 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:33:58</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17092: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.14.174(3378) -> 216.41.224.3(80), 7 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">22:33:58</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-chaswv-ds3 17093: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.14.174(3376) -> 216.41.224.3(80), 18 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
00</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">:58:30=20
pittpa-clarwv-ds3 16062: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3183) -> 216.41.224.3(80), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
00</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">:58:30=20
pittpa-clarwv-ds3 16063: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3183), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:03:28</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16067: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3217) -> 216.41.224.3(80), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:03:28</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16068: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3217), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:03:34</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16069: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3228) -> 216.41.224.3(80), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:03:34</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16070: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3228), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:03:39</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16072: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3239) -> 216.41.224.3(80), 1 =
packet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:03:47</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16073: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3183) -> 216.41.224.3(80), 74 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:04:13</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16075: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3183), 72 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:46</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16078: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3218) -> 216.41.224.3(80), 4 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:46</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16079: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3217) -> 216.41.224.3(80), 3 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:46</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16080: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3221) -> 216.41.224.3(80), 19 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:46</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16081: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3228) -> 216.41.224.3(80), 5 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:46</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16082: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3229) -> 216.41.224.3(80), 6 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:46</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16083: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3236) -> 216.41.224.3(80), 9 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:47</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16084: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3233) -> 216.41.224.3(80), 12 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:08:47</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16085: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 =
permitted=20
tcp 69.43.23.23(3239) -> 216.41.224.3(80), 21 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:12</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16087: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3239), 19 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:12</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16088: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3228), 4 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:12</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16089: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3217), 2 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:12</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16091: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3218), 3 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:13</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16092: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3221), 17 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:13</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16093: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3229), 5 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:13</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16094: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3236), 7 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Mar 5 =
</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">01:09:13</SPAN></FONT><FONT=20
face=3DArial size=3D2><SPAN style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">=20
pittpa-clarwv-ds3 16096: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 =
permitted=20
tcp 216.41.224.3(80) -> 69.43.23.23(3233), 9 =
packets</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
Network analysis showed significant amounts of spoofed multicast =
traffic and=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
odd arp traffic.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.416222 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 278</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.421886 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 334</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.423873 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 262</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.426948 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 254</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.432095 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 298</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.435921 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 274</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.439959 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 328</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.445317 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 326</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.449688 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 330</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"> 10:17:16.463537 IP =
192.168.1.1.1900 > 239.255.255.250.1900: udp 322</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
Steps were taken to elminiate the spoofed traffic on the =
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
routers and access servers in the form of ACLs and filter=20
lists.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =
=20
Neither have eliminiated the problem... but to what extent they=20
might</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =
=20
have helped has yet to be determined.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
The problem is still occuring, for some users the duration of the =
outage=20
</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
seems to have shortened other users notice no difference. It is =
not=20
yet</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
known if the filtering on the routers and access servers or the=20
conversion</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
to the 10.x.x.x network has made any difference. We should have =
a better=20
idea</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
in the upcoming days.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">What Doesn't help: =
Removing=20
windows updates. </SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =
=20
Turning off XP firewall.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =20
Searching for malware. =
(SpyBot-SD, Adaware)</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =
=20
Virus scanning (Various softwares)</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =
=20
Specifying dns servers.</SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"> =
=20
Reinstalling =
windows.</SPAN></FONT></P></DIV></BLOCKQUOTE></BODY></HTML>
=00
------_=_NextPart_001_01C408B5.EAFA6D24--
