I am hoping this is in the right spot.
We have an issue that I have not been able to track down for some time, hoping someone can give me an idea or point me in the right direction.
To summarize: Occasionally, a computer in our network will cause our web server to become unresponsive. The only error messages we see are in the HTTPErr log. We see hundreds of Connection Dropped errors for the computer in question about the same time the servers stop responding. It appears it is dropping every port sequentially. For example, lets say computer 192.168.1.110 has an issue with the website hanging, within a few seconds the server has stopped serving web requests, in the HTTPErr log there are Connection Dropped entries for 192.168.1.110:2500 and :2501, :2502, :2503 for several hundred entries all at moment the user first noticed the issue. One iisreset later, everything is back to normal.
For some background, these computers (Windows XP, IE8) are part of our call center that uses our web servers all day long. This issue rears its ugly head only once every month or so on seemingly random computers. This makes it very hard to track down. The only error that appears on the XP machine as Event ID 4226 "TCP Connection Limit: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts". I am at a loss.
Details
Webserver:
Windows Server 2003
IIS6
ASP.NET application/website written in C#
Client:
Windows XP sp3
IE8
These computers don't have access to anything but our webserver and our mail server. I highly doubt it's any kind of malware issue, as they have AV with nightly scans.
Also, every other log file I can think of has been checked (Event viewer, W3SVC, nothing extraordinary on load or memory usage during the issue, etc). I really hope someone out there has an idea of what I can look for since I haven't been able to find anything on this particular issue. It's the first time I'm seeing it as well.
Thanks everyone!