firewall problem. please help

[tigoluxa]

I have a sonicwall TZ170 firewall with intrusion prevention, email attachment filtering and gateway antivirus. It's been working just fine in my network for about 8 months.

recently, the LAN indicator of the firewall started blinking very fast in an unusual manner. after a little while, all light indicators on the network of all the devices (switches, hubs, NIC's) did the same blinking behavior in the same fashion. I have noticed that when the firewall is disconnected, the behavior of the network is usual and peaceful. But, bringing back the firewall into the network would cause everything to blink so wierd and some times it even causes the network printers not to print and some client-server applications to fail some tasks.

I use Norton Antivirus Corporate edition which detects all the viruses usually and cleans them up. I used it in addition to AVG and stinger and made sure all the computers are virus-clean. However, the weird behavior of the network/firewall still persists. Sonicwall sent me a replacement unit of the firewall which worked fine for one hour only, and then started that weird light indicator behavior. I'm about to have a heart attack here because of this mystery. It's so confusing and unpleasant. I don't know exactly what's causing this problem. Especially that I disconnected all the computers from the network but the firewall light doesn't want to stop blinking like crazy anymore.

Does anyone have any useful comment/suggestion/knowledge of this issue? Help is highly appreciated.

[kc0arf]

Hello,

The only way to be sure what the network traffic is doing is to do a packet sniff of the network. This will require sniffer software. If you have Linux, you might already have a package in there called ethereal, which is a free sniffing utility. You might also find other products out there for Windows / Mac.

Without knowing what the packets are doing, we have no idea where to start looking at the source of the problem. It could be something simple -- a windows network having a browser election, or it could be something far more devious, like one computer trying to attack another.

If you really want to know what is going on, a sniffer will tell you. BE SURE, however, to have the sniffer hooked up with a hub... not a switch... as switches isolate traffic, and the sniffer could be bypassed.

Christian

[tigoluxa]

Thank you for the great suggestions. I tried Ethereal and I found out that the firewall was looking for the reporting server. For some reason it wasn't able to find it on the LAN, so, it kept sending packets like "who has 192.168.168.126?". Stopping this feature on Sonicwall fixed the problem. I need to worry about the reporting server later... Thank you!

I connected the laptop directly to the firewall, but it only sniffed on the laptop's NIC. Do you suggest that hooking up the laptop to a hub then to the firewall will let me sniff any NIC (knowing that all the computers are hooked to a switch)?