• RSS
  • Twitter
  • FaceBook

Exchange Server Forums

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

ISA logs "http://.com/" and 127.0.0.1 - What's the Deal??

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [Microsoft Exchange 2003] >> Installation >> ISA logs "http://.com/" and 127.0.0.1 - What's the Deal?? Page: [1]
Login
Message << Older Topic   Newer Topic >>
ISA logs "http://.com/" and 127.0.0.1 - What'... - 12.Mar.2004 7:56:00 PM   
pdkenterprises

 

Posts: 1
Joined: 12.Mar.2004
From: Woodbridge VA
Status: offline
I posted this over on www.isaserver.org, but the more I think about it it may be better posted here. It's an ISA problem, but it goes away when I stop Exchange.

Can anyone PLEASE please please explain to me what's going on here in my ISA WEBEXTD logs?

-----
#Software: Microsoft(R) Internet Security and Acceleration Server 2000
#Version: 1.0
#Date: 2004-03-11 00:00:05
#Fields: c-ip cs-username c-agent sc-authenticated date time s-svcname s-computername cs-referred r-host r-ip r-port time-taken cs-bytes sc-bytes cs-protocol cs-transport s-operation cs-uri cs-mime-type s-object-source sc-status s-cache-info rule#1 rule#2
192.168.16.2 PDK\ wininet Y 2004-03-11 00:00:05 w3proxy SRVR - .com - 80 9125 258 - http TCP GET http://.com/ - Inet 11004 0x5 Small Business Internet Access Protocol Rule 2 Allow rule
127.0.0.1 anonymous wininet N 2004-03-11 00:00:15 w3proxy SRVR - .com - 80 9125 134 - http TCP GET http://.com/ - Inet 11004 0x5 - -
192.168.16.2 anonymous wininet N 2004-03-11 00:00:15 w3proxy SRVR - .com - 80 - 134 2769 http TCP GET http://.com/ - - 407 - - -
192.168.16.2 anonymous wininet N 2004-03-11 00:00:15 w3proxy SRVR - .com - 80 - - 702 http TCP GET http://.com/ - - 407 - - -
192.168.16.2 PDK\ wininet Y 2004-03-11 00:00:24 w3proxy SRVR - .com - 80 9125 258 - http TCP GET http://.com/ - Inet 11004 0x5 Small Business Internet Access Protocol Rule 2 Allow rule
127.0.0.1 anonymous wininet N 2004-03-11 00:00:34 w3proxy SRVR - .com - 80 9125 134 - http TCP GET http://.com/ - Inet 11004 0x5 - -
192.168.16.2 anonymous wininet N 2004-03-11 00:00:34 w3proxy SRVR - .com - 80 - 134 2769 http TCP GET http://.com/ - - 407 - - -
192.168.16.2 anonymous wininet N 2004-03-11 00:00:34 w3proxy SRVR - .com - 80 - - 702 http TCP GET http://.com/ - - 407 - - -
192.168.16.2 PDK\ wininet Y 2004-03-11 00:00:43 w3proxy SRVR - .com - 80 9125 258 - http TCP GET http://.com/ - Inet 11004 0x5 Small Business Internet Access Protocol Rule 2 Allow rule
127.0.0.1 anonymous wininet N 2004-03-11 00:00:52 w3proxy SRVR - .com - 80 9141 134 - http TCP GET http://.com/ - Inet 11004 0x5 - -
192.168.16.2 anonymous wininet N 2004-03-11 00:00:52 w3proxy SRVR - .com - 80 - 134 2769 http TCP GET http://.com/ - - 407 - - -
192.168.16.2 anonymous wininet N 2004-03-11 00:00:52 w3proxy SRVR - .com - 80 - - 702 http TCP GET http://.com/ - - 407 - - -
-----

ISA Management Session Monitoring also shows two constant Web Sessions - "anonymous" at 127.0.0.1 and "PDK\" at 192.168.16.2. If I manually terminate them, they start right back up.

I've searched all over the net to find some kind of an answer but to no avail. All I've been able to figure out so far is that it has something to do with Exchange (if I stop all of the mail-related services it stops logging those connections). The above log entries are from when the server was disconnected from the LAN and had only an internet connection. I've tried disabling the HTTP redirector, as well as having it drop all SecureNAT packets, no luck there either.

We're running SBS2K3 and I've got all of the patches and updates installed for all of the apps to date.

Any help or insight would be appreciated - I'd love to be able to read my logs without having to keep skipping down the page to find the next connection.

Thanks in advance,
David Levine
General Manager
PDK Enterprises Inc
Post #: 1
RE: ISA logs "http://.com/" and 127.0.0.1 - W... - 4.May2005 10:40:00 AM   
ifstat

 

Posts: 5
Joined: 11.Jun.2004
From: Cyprus
Status: offline
did you ever find the solution to this problem because i am expriecing the same problem now.

(in reply to pdkenterprises)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [Microsoft Exchange 2003] >> Installation >> ISA logs "http://.com/" and 127.0.0.1 - What's the Deal?? Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


Follow TechGenix on Twitter