Messages for Disabled Hosts

ITS will notify the registered owner of a computer by email whenever the ability of the device to connect to the USC network has been disabled by ITS. The messages look similar to the sample below.

Sample Message

From: consult@usc.edu
Date: Wednesday, April 2, 2008 12:00 am
Subject: 1:23:45:67:89:ab disabled

Network access for 1:23:45:67:89:ab has been disabled at 
04/02/08 00:00:00:

Reason: Host was disabled
  Disabled because 1:23:45:67:89:ab is disabled: !disabled
Switch: jef-6000-1.usc.edu
Port: 1

For assistance in getting re-enabled, please contact the ITS
Customer Support Center at consult@usc.edu or at 213-740-5555.

There are a number of reasons why a machine may be disabled over the network, and the specific reason for the disable addressed by the email will be noted in the Reason field.

Common Causes for Disabled Hosts

Listed below are the most common reasons behind the disabled host messages that a user will receive, along with explanations and steps for solving the problems.

• Host infected with worm or virus
• Host using incorrect IP address
• Usage limit exceeded...sent too many DHCP requests
• Warning for guest-wireless singleclick port scan

Host infected with worm or virus

Your machine has been disabled because it is exhibiting traffic typical of that of a machine infected with a worm or virus that is trying to spread to other machines.

In order for us to re-enable your machine, you must find and remove the virus or worm that is causing this traffic and fix your machine (usually through the application of security patches for your operating system) so that the virus or worm cannot compromise your machine again.

In the event that a virus or worm cannot be found on a machine disabled for this reason, re-installation of the operating system may be necessary. Appropriate security patches should be applied to the machine after the re-installation has been completed. Machines that are re-enabled because no virus or worm could be found are usually disabled again for continuing to exhibit worm or virus activity.

ITS provides free antivirus software, which is appropriate for most common operating systems, on the ITS Software Download page. (You will need to log in.) After you have downloaded and installed the Symantec Antivirus software, go to Symantec's Security Response page to obtain current virus definitions so that your software will be able to detect new strains of viruses and worms.

ITS periodically publishes alerts related to new worm or virus outbreaks on the ITS home page.

Users are responsible for the Removal of worms and viruses. The entire process of cleaning and patching the operating system must be done while the machine is disconnected from the USC network. The ITS Customer Support Center (CSC) cannot re-enable machines unless they have been both cleaned and patched.

The CSC cannot take walk-ins or appointments to remove viruses or worms from users' machines.

Host using incorrect IP address

Your machine has been disabled because it is trying to use an IP address that no longer belongs to it.

Most machines on campus are configured to use Dynamic Host Configuration Protocol (DHCP), which allows a computer to obtain its connection automatically from the network. Under DHCP, a computer is issued an IP address for a limited amount of time (normally between one and four weeks), after which the computer must give up that IP address so that it can be reassigned to another user.

Machines that are disabled for a bad IP address have either been manually configured to use an incorrect IP address, or, if using DHCP, have not given up their IP address properly and are still trying to use it after it has been reassigned.

For help with manual configurations (not using DHCP), contact the ITS Customer Support Center at 213-740-5555 to obtain the correct settings for your machine.

For connections using DHCP, the steps for releasing a current connection setting will vary by operating system:

To fix this error, users will need to release their current IP address information. In Windows NT/2000/XP/Vista, this can be done by running ipconfig /release in a command window. Mac OS X users can switch their current configuration between DHCP and Manual and back to DHCP.

Usage limit exceeded...sent too many DHCP requests

Your computer attempted and failed to acquire an IP address more than 60 times in one hour.

This usage limit problem is most commonly seen on machines that are attempting to connect to the USC wireless network in areas of poor signal strength. To avoid being disabled over a wireless connection for this reason, power down your computer when traveling from location to location on campus or when you are in areas of campus with no network coverage. To see a map of USC Wireless network coverage, please see the Wireless Locations page.

If you are experiencing this usage limit problem on an Ethernet (wired) connection, this may indicate a problem with your jack, network cable or your computer’s network card. For assistance in determining what might be the cause of your wired connection problem, please contact the ITS Customer Support Center at 213-740-5555 or consult@usc.edu

Warning for guest-wireless singleclick port scan

Your laptop is running scanning software that interferes with the flow of traffic on the USC network.

This port-scanning message is seen on Dell laptops that that come pre-installed with Dell QuickSet and Dell Remote Access software. To avoid being disabled over a wireless connection for this reason, please click the links below and follow the instructions to disable the scanning features of these programs.

Disabling Dell QuickSet's Wi-Fi Catcher

Disabling Dell Remote Access

Last updated: Wednesday, September 16, 2009, 10:55AM PDT