Random, inexplicable network error round 2

S

Sovereign

2[H]4U
Joined
Mar 21, 2005
Messages
3,098
I am having constant network problems. I’ve tried to iron them out but to no avail. Therefore, I’m basically posting this on every computer/tech site I frequent in the hopes that someone out there can tell me how to fix this extremely perturbing problem.

I have a small network consisting of the following:
-Linksys WRT54G rev. 1 w/DD-WRT firmware preinstalled
-One desktop hardwired into the router (nForce4 A8N32-SLI using the Marvell Adapter)
-Anywhere from one (usually) to three (maximum) laptops connected via Wireless-G
-One university RJ-45 port

Now, other students in other dorms have similar setups and none experience this problem. I can only describe the symptoms as I have no idea what the problem is. It happens to my desktop and laptop, anywhere on the University’s network (in my dorm, in the music building where I work, in the science building, in the library etc).

I’m browsing the internet minding my own business when suddenly I get an “Unable to connect” message from Firefox. There’s no indication that anything has gone “wrong,” indeed I am staring at said message on my desktop while my laptop (connected to the same router) has no problems accessing the internet. These messages are very random, but I usually see it at least twice a day in various places at various times. It doesn’t matter what sites I’m browsing, it can be Digg, Maximum PC, [H]ardForum, LegitReviews, Google News, the Economist, my University’s portal…

The only solution that I’ve found to work 100% of the time is to reboot the computer in question if I absolutely MUST have internet access on that machine. However, this is cumbersome and annoying.

Solutions I’ve Tried (NONE OF THEM WORK, so please for the love of all that’s holy do not suggest “try X again, just to be sure… if “X” is a solution that I’ve listed as NOT working!)
1.Reboot the router (when in dorm room)
2.Wait (usually if I wait at least twenty minutes my internet mysteriously starts working again)
3.Update drivers on the machines in question (no dice)
4.Renew IPs (doesn’t work, regardless of router or not, these “outages” always occur when ipconfig /all shows a valid DHCP lease)
5.Powercycle the offending network adapter by “disabling” it in the Device Manager, and then enabling it again
6.Reinstalling the router (just a pain for no gain)
7.Flush DNS Cache (don’t know what that has to do with anything but I tried it anyway)
8.Log off and log back on
9.Change MAC addresses via a MAC spoofer (MacMakeUp)
10.Router firmware is up-to-date, so it cannot be updated
11.Check Windows Update (nothing found relevant to my problem)
12.Disabling IPv6 entirely (I have Windows Vista on my computers)
13.Terminate and restart Explorer.exe
14.Use built-in Network Diagnostics (they always return a “Windows found a problem that cannot be repaired automatically”)

Just now, my desktop’s internet reinstated itself. What is notable is what happens when I cannot use Firefox (or Internet Explorer for that matter). That is, even though I cannot “access the web,” any downloads (HTTP) or connections to instant messaging services (e.g. AIM, Yahoo!, Google Talk, MSN) that are open before the “outage” occurs remain open and working! Further, I can still ping my router (192.168.1.1) during an “outage.” However, the computer that experiencing the “outage” can see, but not transfer files to or from any other computers on the network, but can be accessed BY other computers, e.g. my desktop has an “outage” and cannot communicate with my laptop. The laptop appears when I click the “Network” option in the Start Menu, but double-clicking results in a network error. I can use my laptop to root around in my desktop’s network shares, but the desktop claims the laptop doesn’t exist even though it shows up on the network map.

Usually, if one machine (desktop or laptop) experiences an “outage,” the other machine can still browse the internet. These “outages” do not seem to be linked between machines.

Does anyone have any idea what the heck is going on? I know that someone is going to post a solution that will have me saying “IT WORKS” and then a week later it’s going to stop working. Please, whoever you are who may post this “one-week” solution, take no offense, it is just that my networking equipment hates me…
 
Possible MTU problem

Are you allowed to use routers at your Uni?
 
Jay_oasis said:
Possible MTU problem

Are you allowed to use routers at your Uni?
Click to expand...

No ;)

But seeing as I am the only one with the problem (I have a friend who works in IT who told me NO they cannot "tell" that you have a router, NO, the policy is not really enforced, and he's had a wireless system since day one freshman year with no problems whatsoever). Therefore, I would imagine the problem is on my end somewhere.
 
Sovereign said:
No ;)

But seeing as I am the only one with the problem (I have a friend who works in IT who told me NO they cannot "tell" that you have a router, NO, the policy is not really enforced, and he's had a wireless system since day one freshman year with no problems whatsoever). Therefore, I would imagine the problem is on my end somewhere.
Click to expand...
If they have switchport security on (presuming Cisco hardware), they can have it setup to shutdown the switchport(s) when multiple MACs are found on it. Very easy to do.

Even though you say it's random, there is an underlying issue here somehow, and something is triggering it. If it is port security, it should happen when you power on/connect the 2nd device. Have you noticed if this is the case at all?

Does this happen with this laptop when you're say, in the library on the wireless/wired net there?
 
Eulogy said:
If they have switchport security on (presuming Cisco hardware), they can have it setup to shutdown the switchport(s) when multiple MACs are found on it. Very easy to do.

Even though you say it's random, there is an underlying issue here somehow, and something is triggering it. If it is port security, it should happen when you power on/connect the 2nd device. Have you noticed if this is the case at all?

Does this happen with this laptop when you're say, in the library on the wireless/wired net there?
Click to expand...

This wouldn't be an issue if his router is doing NAT, the campus switch would only see 1 mac address.

Are you running vista? Disable IPv6. Check if you have a bad default route

command line: route print & post here.
 
Actually, I lied. We are allowed to have wired routers, so even if they can somehow count MAC addresses behind a NAT-ing router, I don't think it's a problem.

IPv6 is off (I think). I'll have to make entirely sure, because it still shows up in ipconfig /all... Maybe I just disabled part of it.

The router is doing DHCP.

The laptop does experience "random" drops on the wired or wireless network without the router (as in other areas of campus).

route print result

 
what happens if you turn of dhcp and let the campus routers give the computers ip's?
 
Depending on how you haev set it up they can tell if you use a router, all they have to look at is the MAC addresses on each port of their managed switch. They will see more than one MAC on your port and know.

edit

Just noticed this has been already said.. DOH!
 
archivalbackup said:
This wouldn't be an issue if his router is doing NAT, the campus switch would only see 1 mac address.

Are you running vista? Disable IPv6. Check if you have a bad default route

command line: route print & post here.
Click to expand...
Explain to me how NAT does this? That's a new one on me. Didn't know NAT would override switchport security!
 
Today, the laptop flipped out on University networks (no router) and Vista kept saying that a connection existed, but Network diagnostics said "Cannot connect to Microsoft.com, reset." I rebooted, problem went away...
 
Eulogy said:
Explain to me how NAT does this? That's a new one on me. Didn't know NAT would override switchport security!
Click to expand...

Think of a home cable modem setup. If you set up a router, you need to either call the cable company and tell them the MAC address of the router or you need to change the MAC address of your router.

MAC addresses only exist on one network segment I believe and his router will have 2 network adapters. So long as his router is set up correctly, his schools switch will only see the MAC of the router, not anything connected to it. To the school, they'll just see a lot of traffic from 1 IP / MAC.
 
..I don't know ..spyware or virus on both computers from taking them both to the same corner of the evil internets? :p



[F]old|[H]ard
 
Gambit said:
Think of a home cable modem setup. If you set up a router, you need to either call the cable company and tell them the MAC address of the router or you need to change the MAC address of your router.

MAC addresses only exist on one network segment I believe and his router will have 2 network adapters. So long as his router is set up correctly, his schools switch will only see the MAC of the router, not anything connected to it. To the school, they'll just see a lot of traffic from 1 IP / MAC.
Click to expand...
D'oh. Somehow I thought it went from Wall -> Switch -> PCs/laptops. Not Wall-Router-Stuff.
Don't read what I posted :p.
 
Eulogy said:
Explain to me how NAT does this? That's a new one on me. Didn't know NAT would override switchport security!
Click to expand...

NAT is based upon the idea that you only have 1 routable IP and a number of computers that need to share the access. With NAT setup in the most common fashion (Overload PAT) all of your computers end up using the Routers outside IP and MAC address. The router keeps track of what traffic goes to who by using Port Address Translation; or simply computer A sends out a web request, the router sends it out with a source port of 1028. When a reply comes back to the router with a destination port of 1028, the router forwards it to computer A.

Simply the router keeps a table of the internal IP, and port number that was used, so it can map traffic back to the correct host.

The whole time this is happening, anything on the outside/WAN side of the router will ONLY see 1 host, 1 IP and 1 MAC address. It simply looks like all traffic is originating and going back to a single host, thus switchport security only sees 1 MAC address provided NAT PAT is setup (which is the default on any home router). This is also why home routers give you the option to "Clone" or change the WAN MAC address, so if your ISP required you to register a specific MAC address, or if Port Security is setup to only allow a specific MAC address, you can manually change/spoof the appropriate MAC to get you access.

Hopefully that is a good high level overview, however, here are some more resources:
http://www.cisco.com/warp/public/556/nat-cisco.shtml

edit: This is also why NAT is referred to as a 'security' feature, because it in essence operates just like a non-statefull firewall. Traffic is only allowed into the network if there was an originating request from inside the router, which caused a port mapping to be active.
 
archivalbackup said:
NAT is based upon the idea that you only have 1 routable IP and a number of computers that need to share the access. With NAT setup in the most common fashion (Overload PAT) all of your computers end up using the Routers outside IP and MAC address. The router keeps track of what traffic goes to who by using Port Address Translation; or simply computer A sends out a web request, the router sends it out with a source port of 1028. When a reply comes back to the router with a destination port of 1028, the router forwards it to computer A.

Simply the router keeps a table of the internal IP, and port number that was used, so it can map traffic back to the correct host.

The whole time this is happening, anything on the outside/WAN side of the router will ONLY see 1 host, 1 IP and 1 MAC address. It simply looks like all traffic is originating and going back to a single host, thus switchport security only sees 1 MAC address provided NAT PAT is setup (which is the default on any home router). This is also why home routers give you the option to "Clone" or change the WAN MAC address, so if your ISP required you to register a specific MAC address, or if Port Security is setup to only allow a specific MAC address, you can manually change/spoof the appropriate MAC to get you access.

Hopefully that is a good high level overview, however, here are some more resources:
http://www.cisco.com/warp/public/556/nat-cisco.shtml

edit: This is also why NAT is referred to as a 'security' feature, because it in essence operates just like a non-statefull firewall. Traffic is only allowed into the network if there was an originating request from inside the router, which caused a port mapping to be active.
Click to expand...
I know what and how NAT/PAT work, I wasn't questioning that. See above posts.
 
Sovereign said:
Actually, I lied. We are allowed to have wired routers, so even if they can somehow count MAC addresses behind a NAT-ing router, I don't think it's a problem.

IPv6 is off (I think). I'll have to make entirely sure, because it still shows up in ipconfig /all... Maybe I just disabled part of it.

The router is doing DHCP.

The laptop does experience "random" drops on the wired or wireless network without the router (as in other areas of campus).

route print result

Click to expand...

What on earth is your persistent default route to 5.0.0.1 ??? a default metric (20) will cause your computer to constantly try to use this as a default route. Is this Himachi, and why would you have a default route to Himachi, instead of just the 5./8 network.

Remove it by (administrative command line):
route DELETE 0.0.0.0 MASK 0.0.0.0 5.0.0.1 (you may need the -P option for persistent route).

Also, you do have IPv6 enabled, which if you are not using, should be disabled.
 
I've uninstalled Hamachi, as I no longer use it.

I also did this:
Code: 
netsh int tcp set global autotuninglevel=disabled
I got this tip from an "expert" at Experts-Exchange.com.

I can't tell whether this fixed my laptop yet, though. I only had one "outage" issue yesterday and I bet if I had hit "Refresh" the University's homepage would have loaded, because the office computer (which never has this problem) also said "Cannot display page" on the first try, but worked after hitting "Refresh." Let's just leave it that the University server overloads when registration rolls around :(

However, I did not hit "Refresh," I assumed I had to restart so I could use my laptop for registration. However, if that "outage" was actually a fluke (i.e. related to the University's server) then I think the netsh command might have fixed it...

I'll have to report in next week as I am leaving for home (where there are no problems) today for Thanksgiving Break.
 
Ok, I was curious, and for others viewing -
Vista (unknown to me) has a TCP auto-tuning mode that tries to adjust / tune TCP parameters such as window size, routing path selection, route fall back, wireless and some other stuff.

http://technet.microsoft.com/en-us/library/bb878127.aspx
Receive Window Auto-Tuning enables TCP window scaling by default, allowing up to a 16 MB window size.
Click to expand...
Receive Window Auto-Tuning continually determines the optimal receive window size by measuring the bandwidth-delay product and the application retrieve rate, and adjusts the maximum receive window size based on changing network conditions.
Click to expand...

I am going to take a bit of a stab here, and say that the Auto-Tuning may be pushing your window size beyond the capability of the network devices or peers in your path, and causing your route fall-back to try and use the second default route to Himachi.

I am still a bit confused, since windowing, congestion avoidance etc, are already part of the TCP/IP protocols ... is this windows 'enhancement' aka break something that already works to the OSI modle.

Ha! Silly window syndrome: http://www.tcpipguide.com/free/t_TCPSillyWindowSyndromeandChangesTotheSlidingWindow.htm

I guess this is to avoid problems where hosts get stuck sending tiny windows, thus more acks & network traffic ... it's just that it's a Microsoft product and doesn't quite work yet.

Learned something new!
 
I thought my home network was trouble-free... Guess again! As soon as I got home and logged on, my dad lost his Contivity VPN connection to his employer's network AND lost his ability to access the internet. When my computer sits idle for a while, and he connects, but I go to use the internet, I get cut off. Again, AIM connections remain open, but I can't browse the internet.

I've tried turning Auto-Tuning off, but there have been no changes in network problems, and Windows has actually told me that "Network performance enhancing settings should be turned on" through the Network Diagnostics Framework.
 
I have the exact same problem as the OP.
Everything was cool before, then I got my new rig with a Asus maximus extreme, which comes with Marvell Yukon 88E8056 PCI Express Gigabit Ethernet Controller (2 of them actually lol), plug it in, and everything worked well.

Until I realized that I couldn't browse the web anymore sometimes (about twice a day).
My downloads are still going, my laptop still has access to the internet. And everything goes back to normal after a reboot.

I don't know what to do :(.
 
I went onto some other forums and peeps suggested to try checking / unchecking the QOS Packet Scheduler, but it didn't do anything for me.

It happened to me yesterday again:
I was playing COD4 online, everything was fine with my connection since I was still playing, then my internet went down (but only the web browsing since I was still playing COD4 Multi player), and nothing would fix it but a restart.

No idea what is going on...
 
Same here pretty much. ASUS Rampage with Marvell Yukon 88E8056 PCI Express Gigabit, Windows Vista 64bit. PING works great, nslookup is fine, traceroute is fine. No IE 32bit, no Firefox 32bit, no file shares, no online games. BUT, IE 64bit works great. Weird!

First thing I suspected was broken QOS so I disabled it. Nothing. Then I disabled IPv6. Nothing. So, I started disabling TCP/UDP checksum offloading on the NIC. Nothing. After searching a little I found the command to disable autotuning and that did not work. So, I am stuck. I reinstalled my PCI NIC and everything is working fine with that card. Still, I need tha PCI slot for my X-Fi. Oh well, I give up for now. Has to be a Vista thing. My browsing with the 64bit IE was perfectly fine (except for the fact that there is no 64bit version of th Flash player).
 
You must log in or register to reply here.
Back
Top