OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: DUP packet replies at tvguide.com
From: Bob (bobCAVU.COM)
Date: Wed Mar 15 2000 - 10:49:05 CST

Simon wrote:

> Could this be WLBS (Windows Load Balancing Service) in all it's glory?

Oh, I strongly suspect that that it is a case of misconfigured WLBS.
I would bet that this is user error, though.

> Since Windows ping doesn't report the extra replies, it would have gone
> unnoticed by many.

This DEFINITELY is the case. When I was on the phone to their technical
types reporting the problem they confirmed that their windows ping did not
show the problem. I *pleaded* with them to try a UNIX or Linux ping or use
a LAN analyzer, clearly to no effect.

> Next time I have WLBS setup in our lab I'll test for
> this and let the list know.

> Perhaps ping needs to be setup as a 'balanced' service to prevent all the
> pooled servers from responding...

My tcpdump analysis showed that the problem also occurs on TCP
traffic to port 80, their web server. (One of their technical people
said that ping "was supposed to be disabled".)

> Simon Gales
> SGalesOnSphere.com

Bob Toxen
http://www.cavu.com
Fly-By-Day Consulting, Inc.

-----Original Message-----
...