@tom-elliott Thanks. I’ll try installing the new client and see if the issue stops.
On a side note, I’ve used FOG for a number of years to help image/manage a couple thousand machines, and I’ve always been very pleased with it. Support from the mods and developers appears to always be top-notch and timely. I want everyone to know that the work is appreciated.
@tom-elliott Thanks. I’ll try installing the new client and see if the issue stops.
On a side note, I’ve used FOG for a number of years to help image/manage a couple thousand machines, and I’ve always been very pleased with it. Support from the mods and developers appears to always be top-notch and timely. I want everyone to know that the work is appreciated.
@george1421 I don’t see any contact outside of our network. Each conversation is initiated by the client machine, and the smart installer requests are coming from the client to the FOG server. Everything is over port 80, exclusively.
Following the TCP stream in Wireshark (10.10.56.21 is FOG):
… followed by illegible characters for the most part.
I can get a capture file to you in a few hours once I’m back at my desk.
It’s a lot for this server, which, prior to the upgrade, wasn’t associated with much more than 1/10 of this traffic at idle.
A 10-second tcpdump on the FOG server yields nearly 70k TCP 80 packets, nothing on port 445. I can’t read much in the packets, but I catch fragments of what looks like GNU GPL here and there. I looked at a handful of TCP conversations, and they all start out with a “HTTP GET /fog/client/SmartInstaller.exe” request, followed by tons of TCP ACKs.
I just checked the Client Updater settings and it’s disabled. We’ve never had clients set to update. Is there another setting that has been changed somewhere during the upgrade that could cause this behavior?
I recently updated our FOG server to 1.5.9, running on CentOS 7, no OS update. After the FOG update, I noticed about 200 Mbps of network traffic outbound on the switch port that our server is connected to. This traffic is present even when there are no tasks scheduled in FOG.
Some packet captures revealed that what I was seeing appears to be TCP traffic from the FOG server to “random” client machines. The traffic has persisted across multiple days and sits right around 200 Mbps consistently. Reboots of the server have no effect, the traffic starts up again immediately after the machine boots.
Any ideas as to what may be happening? Thank you!