Unusual URL Requests from NX Servers

Completed

Permanently deleted user

September 30, 2022 01:49 Edited

Hi Team,

I've received the below email from the IT department of one our customers:

I am seeing an unusual URL request that seems to be coming from one of the NX servers. Is this something that NX Witness Generates? Seems weird it is only from one server. Seems to occur around 7PM at night for a couple of minutes.

Could you please advise if this is a normal occurrence from Nx Witness?

Site is running v4.2.0.32840 across 2 servers, with only one server reporting the above.

Please let me know if you need further information/clarification.

Thanks, Chris.

0

• 

  Norman

  • Network Optix team

  October 05, 2022 07:22 Edited

  Hi @...,

  The information that they shared with you is too limited to tell.

  I would ask them to capture the communication with Wireshark/tcpdump and share this file, so we can see who is addressing what to which IP address.

  Multiple minutes sound like something unexpected, for sure the server might phone home if Sending Anonymous Usage and Crash Statistics was enabled, and if the device is connected to the Nx Cloud, for sure there is communication between the system and our cloud instances, but we're talking about kB which should take milliseconds and will occur many times during the day.

  0
• 

  Permanently deleted user

  October 04, 2022 23:44

  Thanks Norman, I'll go back to them requesting further info and will come back to you with what provide.

  0
• 

  Norman

  • Network Optix team

  December 22, 2022 11:18

  We have not heard back from you in a while, so we are going to assume your question has been resolved and set this topic to 'Completed'.

  0
• 

  Permanently deleted user

  January 09, 2023 02:06

  Hi Norman.

  Sorry for not getting back to you, we never heard back from the client so we'll take the same assumption that they have resolved the issue themselves.

  Thanks again for your help.

  0

Post is closed for comments.