We have a problem that keeps happening about once a week.
One of our nw6.5 servers will go down to a crawl for about a hour or so.
We think it is a user pounding at a volume with perhaps a virus (like a
denial of service).

This morning when it happened, there were very few users logged in.
We started PKTSCAN.NLM and captured a trace of what was happening on the
There definetly was a user most prominent in the trace.
Tried reading the trace in ethereal, but couldn't tell what was going on.
Does anyone know of a good tool to decode this type of trace?
TIA, Graham