Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 2 subscribers
  • Views 2827 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Licenses exceeded -110%

cash082
I have been running SOPHOS home use for years, with no issues.
All of the sudden I'm getting warnings that it's exceeding the 50 user license limit...with 56052 IP's on my home network, and going up...
No, my home doesn't have that devices on it..
This just came out of left field.
It appears to be registering every IP in 10.89.0.0 - 10.90.0.0 or at least trying to.
Just looking for a quick solution for this. Not sure what happened.
Further, looking to remove those 10.89's/10.90's if there is something I can do to fix this. A reboot seems to be clearing the license table, cause the alarm doesn't trigger for hours as it seems to find these new IP's.. Is there any better way?


This thread was automatically locked due to age.
Parents
  • 0
    Upon searching past 7 days in the firewall I see that my laptop was IP scanning that range on 4-23, probably cause I had SolarWinds looking. Packets were being accepted for some reason. It wasn't showing up in a network scan, however. 
    FW Log of an event:
    /var/log/packetfilter/2014/04/packetfilter-2014-04-23.log.gz:2014:04:23-11:46:40 omega ulogd[5122]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="2" initf="eth0" outitf="eth0" srcmac="84:3a:4b:a7:13:fc" dstmac="0:c:29[:D]:b:62" srcip="10.0.0.205" dstip="10.89.237.81" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="60084" dstport="445" tcpflags="SYN"

    This traffic stopped many days ago. 

    Is it possible I'm chasing around something that was fixed days ago? Nothing in the past 2 days has a 10.89.x.x or a 10.90.x.x

    Further, I made a new rule to deny that kind of stuff.

    Sorry, Just trying to go through every step of troubleshooting
Reply
  • 0
    Upon searching past 7 days in the firewall I see that my laptop was IP scanning that range on 4-23, probably cause I had SolarWinds looking. Packets were being accepted for some reason. It wasn't showing up in a network scan, however. 
    FW Log of an event:
    /var/log/packetfilter/2014/04/packetfilter-2014-04-23.log.gz:2014:04:23-11:46:40 omega ulogd[5122]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="2" initf="eth0" outitf="eth0" srcmac="84:3a:4b:a7:13:fc" dstmac="0:c:29[:D]:b:62" srcip="10.0.0.205" dstip="10.89.237.81" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="60084" dstport="445" tcpflags="SYN"

    This traffic stopped many days ago. 

    Is it possible I'm chasing around something that was fixed days ago? Nothing in the past 2 days has a 10.89.x.x or a 10.90.x.x

    Further, I made a new rule to deny that kind of stuff.

    Sorry, Just trying to go through every step of troubleshooting
Children
No Data