davidclmi.org
Date: Wed May 18 2005 - 17:08:23 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Yes! I have this issue too Juho. If anyone knows how to fix this let me
know too!! I am having the same issue with one system. I am running
BlackICE for Desktops ver. 7.0eoe. The blackd.log grows to 5GB within
about a week. It repeats the truncated packet message over and over. I
opened an incident with ISS a while back and they had no answer for me.
They said it was a problem with my system not BlackICE.

MY config is a Compaq Server running Win2003 Server, IIS, .NET and it's
primary function is SQL development. We have 10 other similar servers
that do not have this problem. Currently, I wrote a script which I've
automated and it goes out every morning, deletes blackd.log, stops and
starts the blackice service and sends me an email telling me how big the
log had become. If I don't do that then the HD fills up within a few
weeks or so.

Any ideas?

David

-----Original Message-----
From: issforum-bouncesiss.net [mailto:issforum-bouncesiss.net] On
Behalf Of juho.musakkatietokoura.com
Sent: Wednesday, May 18, 2005 4:04 AM
To: issforumiss.net
Subject: [ISSForum] Truncated packet seen (BISP)

Hello everybody.

I have a mysterious problem with BlackIce Server Protection (3.6.cnz) on
a
web server.

BlackIce keeps filling the blackd.log with the following event:

EX::Mon, 16 May 2005 16:14:17: Truncated packet seen. Not usable
[1514:0:

The event seems to be related to outgoing packets. (This can be
concluded
from the fact that if I
fetch a page that takes a few seconds to compute, the errors have the
timestamp of the returned
packets.) The value on the event line changes, and I think it is the
frame
size, event though I'm not
sure about that.

The server is an IBM eSeries x225 (type 8649) running Windows 2003
Server
Web Edition, IIS &
DotNet and is equipped with two Broadcom NetXtreme Gigabit Ethernet
nics.
The nics are
connected to separate networks (10/100 switches). The events appear on
both so this is probably
not a broken nic issue.

The pages load fine from the web server so no problem there - the real
problem is that the log file
gets huge in just a few days as the traffic grows and it fills the disk
if
left unnoticed.

I'm a little clueless here, wondering if this could this be a gigabit
ethernet specific problem or other
network related syndrome. Could someone help me out?

-jm

_______________________________________________
ISSForum mailing list
ISSForumiss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforumiss.net

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________
ISSForum mailing list
ISSForumiss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforumiss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]