-
XP Internet problems
Hey all, I'm having some really annoying internet difficulties. A bit of background, my internet always worked perfectly fine before. But a couple of days ago, my harddrive died and I had to get a new one. My old system was running Windows98, but I decided to make the jump to WindowsXP... :eek:
The Symptoms:
-Need to reboot router on computer start in order to get internet working (Windows will say my IP is 163.xxx.xxx.xxx or something instead of 192.168.a.b until the router reboot), I've never had this problem before
-After internet starts working, it will slowly slow down and then jerk to full speed then slow down further and keep doing so until it finally cuts out, after which another router reboot is needed. Again, never had this problem before.
-Other computer running Windows98 doesn't cause these problems, but is still affected when the router needs a reboot.
My thoughts:
-Is it possible that I damaged my network card or motherboard when installing the harddrive? But then, the router knows that I'm connected to it and the network card's green lights flash anyways, it's just that I can't access the router or the internet from my computer, even though the other computer can.
-I updated the router's firmware, no improvement and maybe it got worse even... :(
-I was unable to install some "mainboard utility" drivers or something, because they seem incompatible with WindowsXP or something (installing will trigger XP to detect other hardware which need drivers, and after drivers are installed, it asks to install the same drivers after the reboot, etc.). Is this potentially the problem?
-I installed a Windows2000 driver for my DLink network card to replace the RealTek(?) driver... but it wasn't officially guaranteed to be compatible, could this be a problem? I mean, I thought Win2K drivers should work...
SO, basically, I'm looking for any insights into why my internet isn't working, and how to fix it. Any suggestions? :confused:
-
What happens when you plug your PC directly into the modem?
-
Sorry, I haven't tried that yet, since my network cable goes: in a vent, up the wall and across the roof into another room, down into a closet, down the wall, across the floor and up to the router, and is just barely long enough to reach the router (closer to the cable than the DSL), and then I don't have the connecting program on hand at the moment either.
But I did notice this:
In the router's log, I noticed that there are about 99999 of this:
Code:
2003/09/18 16:12:46 Dial On Demand (PPPoE): forward to dst 192.169.119.172
2003/09/18 16:12:46 Dial On Demand (PPPoE): forward to dst 192.169.119.173
2003/09/18 16:12:46 Dial On Demand (PPPoE): forward to dst 192.169.119.173
and mixed in between, a few of this:
Code:
2003/09/18 16:14:30 ** TCP SYN Flooding ** <IP/TCP> 192.168.2.14:4574 ->> 192.169.154.172:135
The latter message has a few variations in the 1st port number and the second IP/port number, but 192.168.2.14 is my computer's (the problem computer) LAN address. Do these messages mean anything to you?
**EDIT**
And, after further observation, these bursts of logged activity seem to coincide with the internet stoppages :eek: What IS dial on demand??
-
>>TCP SYN Flooding
This is where a TCP connection is started but never fully established. You remember the 3-way handshake for a TCP connection? Well, SYN attacks are where the attacking PC initiates part 1, the target PC responds as part 2, but the attacking PC nevers completes part 3. The result is the target PC allocates and wastes resources by waiting for connections to finish establishing, when they never actually will. Flood a PC with SYNs, and it'll eventually die.
Now, port 135 is MS's RPC port, so from your message here:
192.168.2.14:4574 ->> 192.169.154.172:135
it looks like 2.14 is trying to attack the second computer.
I'd recommend a good virus scanner, and spyware check. Then hope over to windowsupdate.microsoft.com and make sure you've got all the latest patches to fix those nasty buffer overflows.
-
-
>>You remember the 3-way handshake for a TCP connection?
Actually, no :rolleyes: I've never actually read up on how TCP works... I guess I should.
>>it looks like 2.14 is trying to attack the second computer.
Funny, because the second computer doesn't exist (or at least to the best of my knowledge). All the computers on the network are 192.168.2.X, and besides, no computers have suddenly died on my network as of yet...
>>I'd recommend a good virus scanner, and spyware check.
Ack, already? This is a new harddrive, i.e. shouldn't have viruses, unless you mean I got attacked within a few minutes of installing Windows? :eek:
Also, I read the link you posted and I didn't see anything about "dial on demand". Is that just a synonym for PPPoE?
**EDIT**
Wow Hammer, you were right :eek: I had a worm of some sort, that targets specifically WindowsXP computers.
-
EDIT: For reference the dialling on demang message means that the router is basically trying to reconnect to the ISP. The ISP is probably dropping the connection because you are attacking it.
More router message meanings:
http://groups.google.com.au/groups?h...TNGP09.phx.gbl
-
Yes, the virus scan did it :rolleyes: It was Win32.Marchia.Worm or something, targets XP computers. Removing it resulted in instantaneous improvement, and stopped the crazy DSL modem flickering.
-
Probably Welchia. Good that you got rid of it. You might want to get the RPC patch from http://windowsupdate.microsoft.com/
-
Yeah, that was the one :) The name slipped me earlier. I just downloaded and installed a whole bunch of security updates/patches with AutoUpdate (every update that it found), I hope that covers the RPC patch. I was meaning to download all the updates before, but my internet was going so slow ( :rolleyes: ) that the updates wouldn't download.
Thanks everyone!
