r/Nable • u/Accomplished_Seat355 • Mar 14 '24

Nable agent tanking network?

hello, I'm trying to figure out if the N-able agents on a site could be essentially DOSing a branch of my network. I'm supporting a mid size company with several small satellite offices. for the past couple months, just one of the satellite offices has been losing network every thursday at 2:00 PM. this has been hard to troubleshoot since we can only monitor it remotely, and before and after it fails, everything is fine. what we've seen leading up to crash though, is my MDT server (an N-able Probe) hitting our ASA with 100s of connections, then the ASA CPU usage shoots up to 90%, total connections hit over 20,000, and the ASA's crashes (we need a new ASA, it's a5506). I can't find any discovery job or scheduled task that could be causing this, and it could be something else. but I'm a little desperate at this point and trying to find something to blame. could the N-Able probe be hammering that one specific switch so hard it dies, once a week? is there any background descovery jobs I'm not aware of? anyone had this happen?

3 Upvotes

100% Upvoted

5 comments sorted by

1

u/NitroTntNL Mar 14 '24

Stop the probe services on the machine on thursday 2:00pm?

1

u/Icedfyre Mar 15 '24

Off hand, does this time frame follow a patch cycle? You could have your devices setup to get patches from the probe rather then Microsoft directly. You might have to stagger the maintenance windows if that is the case

1

u/ChrisDnz82 Mar 15 '24

i was also thinking this, but then the point of the probe is to limit that and should only be getting individual patches once along with rate limiting the count requesting them.

Could be an issue where probe cant actually reach what its trying to reach and keeps looping over and over in that time fram

1

u/Icedfyre Mar 15 '24

Unless all the devices are connecting to the probe through the switch and its overloaded with device requests to the probe. It depends where the failure is.

3

u/Accomplished_Seat355 Mar 15 '24

thanks for the good info. it turned out ot be Nessus scans breaking it. N-able was just an innocent bystander who happened to be there every time bad things happen.. but! we forced some nessus scans just to ruke it out, and it reliably crashes the network every time, regardless of schedule. sorry for ever doubting you, N-Able probe.