2 Replies Latest reply on Nov 21, 2013 1:00 AM by mzrrg

    Wavelink Licenseserver spamming other servers on port 1820 and 2001

    Rookie

      Hello,

       

      in the security eventlog. It is Windows Filterring Platform that blocks a packet from 2 servers on which Wavelink Licenserver is installed. The event happens every 2. Minut.

       

      IP: 10.XXX.XXX.165/166 (IPs of Wavelink servers) port 2001 and port 1820. If I look at these 2 ports, they are used by “LicenseServer.exe”. It Is startet by the “Wavelink Client License Server” service.

       

      pic1.png

       

      I can read from the configuration file that Port 1820 is used for contact to other licenseserver. (I have created a DNS entry for both servers)

      So it could be possible that Wavelink is pulling other servers than the one specified in the configuration file for a license?

       

      Example on one server. In 2 days there are 96.877 security event. 38.082 of them are event ID 5152, and almost all of the are Autir Failure events from the Wavelink Client License Server service, installed the 2 servers above.

       

      pic2.png

       

       

       

      Here is the configuration file, maybe something should be set up different?

      ######################################
      #  License Server Configuration File
      ######################################


      LicenseAddress = 0.0.0.0:1820


      HttpAddress = 0.0.0.0:4420


      Username = "XXX"
      Password = "YYY"

       


      # "OtherServer" lines allow you to specify the addresses of other additional license servers.
      # These servers can then be kept synchronized if they have the same username and password specified.
      # You can use multiple OtherServer lines if you have multiple license servers besides this one.
      # Use the format "OtherServer = address:port" for each line.
      # If the port value is not specified, port 1820 is assumed.
      #
      # The License Server will always try to detect other servers on the same network section.
      # This option is only needed to detect servers on other sections of the network.

      #OtherServer = corporateserver7:1820
      OtherServer = wavelink02


      ServerSiteId = 0


      ShowAllLicenses = TRUE


      SiteIdForUnassignedDevices = 0


      ReassignDays = 14


      LogLevel = INFO


      LogSize = 1000000


      LogBackups = 3

       

       

      ---------------------------------------------

      Here are some entries from the Wavelink log on one of the servers. Dosnt look right to me. Can you tell me what this error means?

       

      +142378125 2: No "TelnetCE Maintenance" licenses available for MAC Address 002368D60AFE, Site ID 0

      +142383375 2: No "TelnetCE 7.0 VT" licenses available for MAC Address 002368D57C93, Site ID 0

      +142383375 2: No "TelnetCE 7.0 VT/IBMHOST" licenses available for MAC Address 002368D57C93, Site ID 0

      +142383375 2: No "TelnetCE 7.0 VT/IBMHOST/WEB" licenses available for MAC Address 002368D57C93, Site ID 0

      +142383375 2: No "TelnetCE Maintenance" licenses available for MAC Address 002368D57C93, Site ID 0

      +142383407 2: No "TelnetCE 7.0 VT" licenses available for MAC Address 002368D60AFE, Site ID 0

      +142383407 2: No "TelnetCE 7.0 VT/IBMHOST" licenses available for MAC Address 002368D60AFE, Site ID 0

      +142383407 2: No "TelnetCE 7.0 VT/IBMHOST/WEB" licenses available for MAC Address 002368D60AFE, Site ID 0

      +142383407 2: No "TelnetCE Maintenance" licenses available for MAC Address 002368D60AFE, Site ID 0

      +142388625 2: No "TelnetCE 7.0 VT" licenses available for MAC Address 002368D57C93, Site ID 0

      +142388625 2: No "TelnetCE 7.0 VT/IBMHOST" licenses available for MAC Address 002368D57C93, Site ID 0

      +142388625 2: No "TelnetCE 7.0 VT/IBMHOST/WEB" licenses available for MAC Address 002368D57C93, Site ID 0

      +142388641 2: No "TelnetCE Maintenance" licenses available for MAC Address 002368D57C93, Site ID 0

      +142388672 2: No "TelnetCE 7.0 VT" licenses available for MAC Address 002368D60AFE, Site ID 0

      +142388672 2: No "TelnetCE 7.0 VT/IBMHOST" licenses available for MAC Address 002368D60AFE, Site ID 0

       

      Any help appriciated. Thank you