> If I was troubleshooting this problem, I'd want to verify 
> that all the right network communications are able to occur.  
> I'd have 1 window for every interface that my packets are 
> going to be touching, and in every windows I'd be running 
> tcpdump with the appropriate options to show me the amanda 
> packets.  (If the machine times are in sync, it'll be a lot 
> easier to follow, too.)

I'm working on the time sync thing...I found a doc on how to sync this
linux box better.
> 
> I'd make the necessary changes to amanda so that _only_ the 
> troubled amanda client is attempted-- this would let me make 
> the attempt again and again during the day, w/o worrying 
> about messing up (or starting) other real backups.  (You 
> could even have a very small partition on the client get 
> backed rather than the "real" ones.)

I'm trying to test this client right now... with a smaller slice
> 
> Of course, if the two machines always have "normal" 
> communications going on anyway (like if the web server is 
> pulling data from a database on the amanda server), then 
> tcpdumps will need to be very selective.

Amanda server also serves up dhcp to the windows clients on that
network...but nothing's really happening at 2:30 am on any day of the
week, and it's not serving dhcp to any sol clients.
> 
> ====
> Here's my understanding of your setup, please correct where 
> wrong: amanda client---(10.1.10.x net)---Firewall---(10.1.8.x 
> net)---amanda server Your amanda client and the firewall are 
> both running solaris 6. Your amanda server is running RH 8.

Actually, firewall is running sol8, but the rest is correct. And I'm
running amanda 2.4.2p2...I said that way earlier in the ball game, I
didn't know if you were tuning in then or not.
> 
> Are there any other things that could account for an increase 
> in network traffic during the nighttime hours?  I've noticed 
> with our own CP firewall that quiet connections get timed out 
> much faster when there's lots of connections occurring than 
> when the network is not busy (eg. an ssh connection to my 
> home computer could be left all weekend with no I/O w/o any 
> problems, but monday morning if I left it for 1/2 hour, I'd 
> have lost the connection). 

There's really nothing happening on that box at that time. The oracle
server from which the website pulls data is on a completely different
box. So basically at that time it's just sitting there.