Cisco 1720 - Slow Bandwidth 1

[ibadan]

We run a small Internet cafe with 512K Leased Line and from the last 6-7 days, the connection gets so slow that the customers start refusing to pay. At first I thought it was those worms/virus, we applied all the necessary patches etc. no help. 2days ago, I thought of just switching off the router and turn it on again, Immediately, the speed went back to the top speed, since then when it gets slow down again we just reboot the router, the problem fixed!!. IS there anyone that can be of help to point me in the right direction what could be causing this problem. It starts giging me nightmare already

Before this issue of rebooting the router, we use this router for almost 9months without any problem, even there was no change in the configuration. Please help

 

[ChrisAC]

Have you actually looked at the logging and interface stats on the router to see where this traffic is coming from? Is the increase in bandwidth upload or download? Try putting ACL's on the router and logging the traffic. This will tell you what is causing the high traffic loads.

You may well be able to put a lot of the bandwidth down to viruses/trojans etc.. When you reboot the router this cuts off all the connections but after a while they will be re-established. We had this problem on our network just last week. Turned out to be the Nachi worm!!

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[ibadan]

Hi Chris, thanks for your advice, the router is managed by my provider, I will explain your advice, in the meantime, I think I will use this time to check the our LAN here to clean the occurence of this virus. I will keep you posted, once again many thanks. By the way, do you have any link handy for the detection and removal of this Nachi.worm?

 

[ChrisAC]

This will kill it ....

http://vil.nai.com/vil/stinger/

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[ibadan]

Hi Chris, Many thanks, we did indeed found the virus in one of the PC and your hints was of great help and I'm currently on-site watching the situation. Once again, thanks for your help. I hope this is going to be the final fix.

Regards
Jones

 

[ChrisAC]

Good stuff. We had a single laptop infected with the Nachi worm that was pushing over 200Kbps of outgoing icmp traffic.

The owner of that laptop will never forget that day! Oh how we did make fun of him!

hehe..

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[ibadan]

Hi Chris, I think I can finally confirm it was indeed those worm(s) and the stinger thing was of great help. We do not any down bandwidth today, so I guess the problem is over (hopefully). I indeed appreciate your advice and help.