Security

Ask something
Discussion Locked

Router dialing remote site.

0 helpful
3 replies

by robinarm 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am a Network Admin on a reasonable size WAN.
My main Router (the center of the star configuration) has just started dialing one of our other sites. At worst it dials (over public ISDN) every 5 or 10 minutes but some times it only dials 3 or 4 times a night. Its not meant to dial at these times as no users should be accessing the remote site (our development offices). I've telneted into the router and can watch as it dials up the number. To try and stop it I've checked all machines at the location its dialing from for installation of Netbeui - there are none. I tied switching off all non business critical machines and the dialing stoped. I then switched them back on one at a time but the dialing didn't happen again. Next night I left them all on and the dialing started again. There are no processes running, no shortcuts to the development site, no mapped drives or any other obvious reasons for the router doing what its doing. The managers are complaining since its costing them moneyfor the calls.

Any ideas?

3 replies

by frank.peeters

It could be caused by processes like server-to-server replication (domain controllers, WINS,...) or client-to-server connections such as mapped drives or application connections that send occasional 'keep alive' packets. If client machines could have leased IP addresses from a DHCP server from the development office, the dialing could be caused by DHCP lease renewal packets. However you seem to have ruled out most of these possibilities.

Were you sure that no one was logged in when you switched off all non-business critical machines? Because my primary suspect is a user leaving an application or a mapped drive open.

To isolate the problem, I suggest you set up a network monitor right behind the development office router. Filter out packets sent from the office router based on its hardware address. By analysing the data collected during the night you could learn more on the source and type of traffic that causes the router to dial.

by robinarm

I suspect that the problem was caused by something like a shorcut or mapping pointing to our dev server when the machine was setup and was not removed before the machine was shipped out to the other office. Probobly by another Techy - although no one is admitting to it. Unfortunatly the dialling has stopped without me finding out the cause so I couldn't setup a monitor or activly prevent it happening again. Thanks for your interest anyway. If nothing else it confirmed to me that I wasn't overlooking something really obvious (which I can do some Fridays). You can have another 500 points if you can suggest a believable exuse to give to my Bosses regarding why all that money went into the ISDN bill from the last quarter!

This discussion is closed to new replies.