Dial-Up/VPN Swap file

[cisco2]

Someone just stopped by and asked me what could be causing his Win2k notebook PC to generate a huge temp file whenever he logs in via dial-up using a VPN. Doesn't happen when he's standalone or plugged into our LAN with his ethernet adapter. He said the file size got as large as 15gb.

I haven't heard of this before, don't really know any more details. About the only thing I can think of is maybe the dial up adapter is running in promiscuous mode. Not that I ever heard of a promiscuous mode dial up adapter. In any case 15gb is a huge amount of traffic to store, particularly over a phone line.

I'm going to ask him to bring the notebook in so I can check it out, any ideas about what could cause this?

[confus-ed]

I had to reply to this .... just to see someone offer up an explanation for 'promiscuous mode' .... isn't that what we all hit after too much 'pop' on a Friday after work ???

If you give us the name of the 'errant' log file perhaps we can tell you what to 'un-tick' to stop it being generated in the first place .... perhaps ....

[cisco2]

Nice to see someone chime in!

Promiscuous mode references the ability of a network interface controller to "snoop" in on network traffic. A promiscuous mode NIC can pull all the packets off the network and store them for review and analysis. They are normally used for network traffic problem diagnosis and optimization. If you have any Network General Sniffer consoles they will use promiscuous mode NICs and drivers.

Not all NICs support promiscuous mode and while I don't see any reason that a dial up adapter couldn't run in promiscuous mode, neither have I ever heard of one doing so. In any case I think that's pretty unlikely, its just all I could think of. I'm hoping someone else might have some clue as to what could be causing this to happen.

I haven't gotten my hands on the PC yet so I'm not aware of the name of the tmp file. I'll work on that though.

[confus-ed]

Indeed, after a 'google' (rather than a drink!) ... 'promiscuous mode' is - Where a node on a network accepts all packets, regardless of their destination address.... now isn't this entirely pointless with a dial up connection .... since the only stuff 'coming' down the line is meant for that pc & that pc only ... anyway ?

There's lots of different logs you can generate via dial up ... for 'troubleshooting' purposes ... so you are gonna have to find the file name ! If this was 9x I'd just say 'stuff it' & add/remove DUN that'd reset it ... its not that simple in 2k 'cos dialup networking is more 'entrenched' & you can't just remove the components & add them back ?

[Matridom]

"promiscuous mode" is easy to enable on almost any network card. If you can set and administrative mac adress, you can set this. just change the mac addy to "FF:FF:FF:FF:FF:FF:FF:FF" and you'll pick up everything down the wire. Whati find odd about this is why is the swap file on 2k not limited in size? I mean, there is a minimum size and a mzximum size, if the swap file is exceeding this, i'd say there is an oissu with the OS more then anything else...

[cisco2]

The file isn't the virtual memory swap file maintained by the OS. I mistyped the subject line, it should have read Dial-Up/VPN tmp file.

I haven't seen or heard back from this customer yet anyway. I was expecting he'd bring the PC by for me to look at. If he does then I'll try to divine the source by the temp file name and proceed from there.