TCP services stop working every morning

Question

Hello,
I have a relatively complex problem that has brought me to the limit of
my limited knowledge.
History: I have a BM 3.5 server running on NW 5.0. I am patched. It has
been running for years. I have a linux cluster running qmail. All traffic
from the internal network passes through the cluster and then through BM
to get to the internet (dedicated connection). BM is running NAT (static
and dynamic), firewall and proxy services.
Monday things changed. Now everyday I arrive in the morning and mail is
mounting up on the cluster. If I unload ipflt on BM nothing changes. I
can't telnet to any 25 or 80 port from the mail server. All services stop
that use TCP. I have a squid server in test right now. This server has a
statitic NAT address. That machine (and others) can ping addresses using
DNS on the internet (with ipflt unloaded) but can not browse or send mail.
I am monitoring my internet router (it is outside the BM server) via MRTG
and snmp (UDP) from a machine on the internal network. This does not stop
working.
The proxy on BM continues working perfectly.
Routing has not presented any noticible problem.
Summary: Every morning all TCP services running behind BM stop working.
UDP and ICMP continues. I have unloaded NAT and reloaded to no avail. The
only solution seems to be the restarting of BM. Once I do that everything
starts up again.
How do I trouble shoot a TCP problem on BM? This is probably the oddest
thing I have seen. Quite frankly I'm not sure if it is BM (NAT). This
maybe a basic Netware problem.
Any thoughts would be extremely appreciated.
Brian

Answer 1

Cat and Maximo,
> Let me try to get that straight. Your BM does static NAT for your
> mailserver (and other boxes), and suddenly UDP and ICMP from these
> natted servers through the BM still works, but TCP doesn't?
Yes. That's what it looks like.
> Can you still do TCP *to* the BM from the natted devices when that
> happens? As you say your proxy continues to work, it sounds as if TCP in
> general on the server continues to work, but does it also work from the
> mailserver?
Everyone browsing via BM proxy continues with no interuption.
The mail server can telnet to any other server on the internal LAN but
nothing past BM. DNS continues working for the mail server too.
> If really nothing changed, this might be a (succesful) DOS attack of
> some sort. I wonder if a LAN trace could reveal anything of interest.
Do you mean port scan the BM server?
I know that "nothing has changed" is a loaded statement. The only thing
(that I know of) that has changed relatively recently is the addition of
the Squid server. It has been running behind the BM server for about 3
weeks. Recently I added a filter exception allowing the Squid server to
access higher ports (dyn/tcp).
But, as I noted before, I think removing ipflt should eliminate any
doubts there. Is there some way Squid could be corrupting something there?
The problem was compounded this morning (saturday). I came in today so I
would have the network essentially to myself. But, to my surprise,
everything was ok.
Cat, You're right. This server is no spring chicken. It is an IBM
Netfinity 3000. Its probably 3 or 4 years old (maybe more). I will think
about this as a hardware problem but I just wish the thing would die
altogether and get it over with. :o)
Thanks,
Brian