Instead of going through the whole thing again, I'll reproduce below, a
couple of recent postings to comp.security.firewalls. Basically the
setup here is BI PCP 3.6 on XP SP1. Thanks! ... Vince
First post:
Here, the BI PCP 3.6 firewall frequently re-initializes itself ...
stopping most threads, reading the inifiles, et c. Just in the last
few hours, BLACKD.LOG shows several re-inits:
22:32:27 2003/09/05 22:32 56,079 blackd.log
22:32:42 2003/09/05 22:32 110,183 blackd.log
22:45:38 2003/09/05 22:45 165,557 blackd.log
22:51:54 2003/09/05 22:51 220,935 blackd.log
23:31:39 2003/09/05 23:31 276,313 blackd.log
23:52:55 2003/09/05 23:52 331,691 blackd.log
00:19:46 2003/09/06 0:19 387,069 blackd.log
00:23:02 2003/09/06 0:22 442,447 blackd.log
BLACKD.LOG itself shows the re-initializations ... threads stopping,
inifiles being read, adapters found, threads starting, et c., but gives
no clue as to why its happening.
I have seen other machines where this never happens. Here, it's
troublesome for several reasons. It just shouldn't happen. When it
does happen, BLACKD is very likely to leak another dozen thread handles
(right not it has about 100 open thread handles ... only needs/uses
about 12). And when one of these re-inits happens, EVD000.ENC gets
overwritten on the next intrusion. In the few days I have played with
BI, I have not been able to collect more than a few KB in an EVD file
because it keeps doing this.
Has anyone seen this? Does anyone know what causes it and how to fix
it?
Thanks.
Second post:
Let me try again. In the last hour, BLACKD has re-initialized itself 8
times.
11:41:42 2003/09/06 11:41 54,839 blackd.log
11:50:57 2003/09/06 11:50 110,231 blackd.log
11:53:48 2003/09/06 11:53 165,629 blackd.log
12:05:34 2003/09/06 12:05 221,031 blackd.log
12:35:04 2003/09/06 12:35 276,433 blackd.log
12:41:00 2003/09/06 12:40 331,835 blackd.log
12:43:00 2003/09/06 12:42 387,237 blackd.log
12:50:56 2003/09/06 12:50 442,639 blackd.log
12:51:46 2003/09/06 12:51 498,041 blackd.log
In BLACKD.LOG, the end of an initialization looks like this:
Sat, 06 Sep 2003 12:50:47:
\Device\{8242C50C-36A7-40C0-BE0B-B3CC705D3117}.run() threadstart 47
That device is my "Local Area Connection", an onboard "Intel(R)
PRO/1000 MT Network Connection".
The beginning of the next init (the very next line in BLACKD.LOG) looks
like this:
Sat, 06 Sep 2003 12:51:34:
/\Device\{8242C50C-36A7-40C0-BE0B-B3CC705D3117}run() THREADSTOP 47
This is followed by all threads stopping, inifiles read, and all
threads starting again.
So I must wonder what caused that thread to stop.
This happens frequently, and ramdomly. But there are a couple of
things I can do to make it happen:
(1) start or stop a VPN connection (to another XP machine which BLACKD
trusts). That's somewhat understandable since BLACKD discovers a new
interface (or discovers that it's gone), namely, \Device\NdisWanIp. Bl
ignores this device because of "adapter.enabled\Device\NdisWanIp=false"
and doesn't start a thread to monitor it but it does "find" it when
it's created and apparently becomes aware when it's terminated. Yet I
don't understand the need to re-initialize all adapters.
(2) when I start a remote desktop session (to the same trusted host
mentioned above), BLACKD will re-init. This one I don't understand; no
new interfaces/adapters appear. After termminating the RD session,
possibly after several minutes, BLACKD will re-init again.
Those are the two ways I can force a re-init but I'll say again that
the re-inits also happen randomly, when I'm not doing anything ... for
example, overnight, with no VPN's or RD sessions going.
As for the leaking of thread handles on every re-initialization (I'm up
to 66 right now according to ProcessExplorer), that's probably just a
programming error (not freeing the handle when it's no longer needed).
Memory usage suggests that there aren't really that many threads
running, just old, unfreed handles.
My biggest gripe about these re-inits is that when one occurs,
EVD000.ENC is over-written on the next intrusion.
I'd appreciate any info on this re-initialization business. And in
particular, I wonder if there are any settings that will make BI handle
VPNs and RD sessions more gracefully.
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
