Hello everybody.
I have a mysterious problem with BlackIce Server Protection (3.6.cnz) on a
web server.
BlackIce keeps filling the blackd.log with the following event:
EX::Mon, 16 May 2005 16:14:17: Truncated packet seen. Not usable [1514:0:
The event seems to be related to outgoing packets. (This can be concluded
from the fact that if I
fetch a page that takes a few seconds to compute, the errors have the
timestamp of the returned
packets.) The value on the event line changes, and I think it is the frame
size, event though I'm not
sure about that.
The server is an IBM eSeries x225 (type 8649) running Windows 2003 Server
Web Edition, IIS &
DotNet and is equipped with two Broadcom NetXtreme Gigabit Ethernet nics.
The nics are
connected to separate networks (10/100 switches). The events appear on
both so this is probably
not a broken nic issue.
The pages load fine from the web server so no problem there - the real
problem is that the log file
gets huge in just a few days as the traffic grows and it fills the disk if
left unnoticed.
I'm a little clueless here, wondering if this could this be a gigabit
ethernet specific problem or other
network related syndrome. Could someone help me out?
-jm
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
