GV-1240 - Network slowdown and disconnects. Hacked?

[photys 0]

UPDATE: Hacked? Logs show someone trying to log into my system 3 or 4 times a minute with old user/password.

Switched 1201 to 1202, but still having problems.

 

 

GV-1240 - Network slowdown and disconnects.

Within 2 minutes of starting the webserver, the speed drops to about a 1/6th of normal.

 

XP Home SP2

GV-1240

Dedicated Geovision specification computer, no other applications except an anti virus.

V8.1, also upgraded V8.11.

Ran multiple virus and spyware scans. (Mcaffee, NOD32, Adaware, spyware doctor ect)

 

 

Noticed this on two different recent Geovision installs.

Remote viewing works great LAN and WAN for a couple of days, then I get slow connections and occasional client side application crashes.

Nothing in the Geovision computers Event viewer.

 

Temporary solution:

Restart Geovison softwear.

This resolves the issue for about 20 minutes.

 

Any ideas?

Edited May 26, 2007 by Guest

[photys 0]

EDIT:

Pulled the auto-log in account and replaced by new one.

Still having problems

 

Almost like someone was logging in automatically and sucking up the bandwidth....

 

Security check time.....

Edited May 26, 2007 by Guest

[CollinR 0]

You might also choose h.264 for WAN streaming, this will drop some bandwidth usage.

[photys 0]

Thanks CollinR.

Yes im using h.264.

 

Problem is that withing 2 minutes of starting the web server the bandwith dies.

Whether im connected or not.

I can still get remote access and still view images, but at about 1/6th of the speed.

 

I have changed all usernames and passwords.

Will watch and see if the problem re-occurs.

[photys 0]

Update.

 

Now the logs are showing something trying to log in 3 or 4 times a minute with the old user/pass.

Its been hammering for 4 hours now.

[CollinR 0]

Do you have any other GV applications on the LAN?

 

TwinDVR, Multicast, Control Center, Command Center, even Multiview.

 

 

Do your router logs show the requests coming from the outside?

 

Owners/ Supervisors with remote access?

[photys 0]

Apps running: Webcam and CCS is running remote view log.

 

They are external IP´s. Tracerouted to this local area.

Using a two day old supervisor password.

 

It appears Remote view retrys every 10 seconds.

That would account for the frequency of the hammering

 

This company also runs a WPA enabled wireless LAN.

Maybe some local smartarse.

 

Im whitelisting my IP. For the moment its quiet.