Yes! I have this issue too Juho. If anyone knows how to fix this let me know too!! I am having the same issue with one system. I am running BlackICE for Desktops ver. 7.0eoe. The blackd.log grows to 5GB within about a week. It repeats the truncated packet message over and over. I opened an incident with ISS a while back and they had no answer for me. They said it was a problem with my system not BlackICE.
MY config is a Compaq Server running Win2003 Server, IIS, .NET and it's primary function is SQL development. We have 10 other similar servers that do not have this problem. Currently, I wrote a script which I've automated and it goes out every morning, deletes blackd.log, stops and starts the blackice service and sends me an email telling me how big the log had become. If I don't do that then the HD fills up within a few weeks or so. Any ideas? David -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, May 18, 2005 4:04 AM To: [email protected] Subject: [ISSForum] Truncated packet seen (BISP) Hello everybody. I have a mysterious problem with BlackIce Server Protection (3.6.cnz) on a web server. BlackIce keeps filling the blackd.log with the following event: EX::Mon, 16 May 2005 16:14:17: Truncated packet seen. Not usable [1514:0: The event seems to be related to outgoing packets. (This can be concluded from the fact that if I fetch a page that takes a few seconds to compute, the errors have the timestamp of the returned packets.) The value on the event line changes, and I think it is the frame size, event though I'm not sure about that. The server is an IBM eSeries x225 (type 8649) running Windows 2003 Server Web Edition, IIS & DotNet and is equipped with two Broadcom NetXtreme Gigabit Ethernet nics. The nics are connected to separate networks (10/100 switches). The events appear on both so this is probably not a broken nic issue. The pages load fine from the web server so no problem there - the real problem is that the log file gets huge in just a few days as the traffic grows and it fills the disk if left unnoticed. I'm a little clueless here, wondering if this could this be a gigabit ethernet specific problem or other network related syndrome. Could someone help me out? -jm _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
