Thread: XP Internet problems

  1. #1
    Carnivore ('-'v) Hunter2's Avatar
    Join Date
    May 2002
    Posts
    2,879

    XP Internet problems

    Hey all, I'm having some really annoying internet difficulties. A bit of background, my internet always worked perfectly fine before. But a couple of days ago, my harddrive died and I had to get a new one. My old system was running Windows98, but I decided to make the jump to WindowsXP...

    The Symptoms:
    -Need to reboot router on computer start in order to get internet working (Windows will say my IP is 163.xxx.xxx.xxx or something instead of 192.168.a.b until the router reboot), I've never had this problem before

    -After internet starts working, it will slowly slow down and then jerk to full speed then slow down further and keep doing so until it finally cuts out, after which another router reboot is needed. Again, never had this problem before.

    -Other computer running Windows98 doesn't cause these problems, but is still affected when the router needs a reboot.

    My thoughts:
    -Is it possible that I damaged my network card or motherboard when installing the harddrive? But then, the router knows that I'm connected to it and the network card's green lights flash anyways, it's just that I can't access the router or the internet from my computer, even though the other computer can.

    -I updated the router's firmware, no improvement and maybe it got worse even...

    -I was unable to install some "mainboard utility" drivers or something, because they seem incompatible with WindowsXP or something (installing will trigger XP to detect other hardware which need drivers, and after drivers are installed, it asks to install the same drivers after the reboot, etc.). Is this potentially the problem?

    -I installed a Windows2000 driver for my DLink network card to replace the RealTek(?) driver... but it wasn't officially guaranteed to be compatible, could this be a problem? I mean, I thought Win2K drivers should work...


    SO, basically, I'm looking for any insights into why my internet isn't working, and how to fix it. Any suggestions?
    Just Google It. √

    (\ /)
    ( . .)
    c(")(") This is bunny. Copy and paste bunny into your signature to help him gain world domination.

  2. #2
    C++ Developer XSquared's Avatar
    Join Date
    Jun 2002
    Location
    Ontario, Canada
    Posts
    2,718
    What happens when you plug your PC directly into the modem?
    Naturally I didn't feel inspired enough to read all the links for you, since I already slaved away for long hours under a blistering sun pressing the search button after typing four whole words! - Quzah

    You. Fetch me my copy of the Wall Street Journal. You two, fight to the death - Stewie

  3. #3
    Carnivore ('-'v) Hunter2's Avatar
    Join Date
    May 2002
    Posts
    2,879
    Sorry, I haven't tried that yet, since my network cable goes: in a vent, up the wall and across the roof into another room, down into a closet, down the wall, across the floor and up to the router, and is just barely long enough to reach the router (closer to the cable than the DSL), and then I don't have the connecting program on hand at the moment either.

    But I did notice this:
    In the router's log, I noticed that there are about 99999 of this:
    Code:
    2003/09/18 16:12:46  Dial On Demand (PPPoE): forward to dst 192.169.119.172
    2003/09/18 16:12:46  Dial On Demand (PPPoE): forward to dst 192.169.119.173
    2003/09/18 16:12:46  Dial On Demand (PPPoE): forward to dst 192.169.119.173
    and mixed in between, a few of this:
    Code:
    2003/09/18 16:14:30  ** TCP SYN Flooding **  <IP/TCP>  192.168.2.14:4574 ->> 192.169.154.172:135
    The latter message has a few variations in the 1st port number and the second IP/port number, but 192.168.2.14 is my computer's (the problem computer) LAN address. Do these messages mean anything to you?

    **EDIT**
    And, after further observation, these bursts of logged activity seem to coincide with the internet stoppages What IS dial on demand??
    Last edited by Hunter2; 09-18-2003 at 04:39 PM.
    Just Google It. √

    (\ /)
    ( . .)
    c(")(") This is bunny. Copy and paste bunny into your signature to help him gain world domination.

  4. #4
    End Of Line Hammer's Avatar
    Join Date
    Apr 2002
    Posts
    6,231
    >>TCP SYN Flooding
    This is where a TCP connection is started but never fully established. You remember the 3-way handshake for a TCP connection? Well, SYN attacks are where the attacking PC initiates part 1, the target PC responds as part 2, but the attacking PC nevers completes part 3. The result is the target PC allocates and wastes resources by waiting for connections to finish establishing, when they never actually will. Flood a PC with SYNs, and it'll eventually die.

    Now, port 135 is MS's RPC port, so from your message here:
    192.168.2.14:4574 ->> 192.169.154.172:135
    it looks like 2.14 is trying to attack the second computer.

    I'd recommend a good virus scanner, and spyware check. Then hope over to windowsupdate.microsoft.com and make sure you've got all the latest patches to fix those nasty buffer overflows.
    When all else fails, read the instructions.
    If you're posting code, use code tags: [code] /* insert code here */ [/code]

  5. #5
    End Of Line Hammer's Avatar
    Join Date
    Apr 2002
    Posts
    6,231
    Also, Dial on Demand (PPPoE) is this:
    http://searchnetworking.techtarget.c...214430,00.html
    When all else fails, read the instructions.
    If you're posting code, use code tags: [code] /* insert code here */ [/code]

  6. #6
    Carnivore ('-'v) Hunter2's Avatar
    Join Date
    May 2002
    Posts
    2,879
    >>You remember the 3-way handshake for a TCP connection?
    Actually, no I've never actually read up on how TCP works... I guess I should.

    >>it looks like 2.14 is trying to attack the second computer.
    Funny, because the second computer doesn't exist (or at least to the best of my knowledge). All the computers on the network are 192.168.2.X, and besides, no computers have suddenly died on my network as of yet...

    >>I'd recommend a good virus scanner, and spyware check.
    Ack, already? This is a new harddrive, i.e. shouldn't have viruses, unless you mean I got attacked within a few minutes of installing Windows?

    Also, I read the link you posted and I didn't see anything about "dial on demand". Is that just a synonym for PPPoE?

    **EDIT**
    Wow Hammer, you were right I had a worm of some sort, that targets specifically WindowsXP computers.
    Last edited by Hunter2; 09-18-2003 at 08:03 PM.
    Just Google It. √

    (\ /)
    ( . .)
    c(")(") This is bunny. Copy and paste bunny into your signature to help him gain world domination.

  7. #7
    Yes, my avatar is stolen anonytmouse's Avatar
    Join Date
    Dec 2002
    Posts
    2,544
    EDIT: For reference the dialling on demang message means that the router is basically trying to reconnect to the ISP. The ISP is probably dropping the connection because you are attacking it.
    More router message meanings:
    http://groups.google.com.au/groups?h...TNGP09.phx.gbl
    Last edited by anonytmouse; 09-18-2003 at 08:28 PM.

  8. #8
    Carnivore ('-'v) Hunter2's Avatar
    Join Date
    May 2002
    Posts
    2,879
    Yes, the virus scan did it It was Win32.Marchia.Worm or something, targets XP computers. Removing it resulted in instantaneous improvement, and stopped the crazy DSL modem flickering.
    Just Google It. √

    (\ /)
    ( . .)
    c(")(") This is bunny. Copy and paste bunny into your signature to help him gain world domination.

  9. #9
    C++ Developer XSquared's Avatar
    Join Date
    Jun 2002
    Location
    Ontario, Canada
    Posts
    2,718
    Probably Welchia. Good that you got rid of it. You might want to get the RPC patch from http://windowsupdate.microsoft.com/
    Naturally I didn't feel inspired enough to read all the links for you, since I already slaved away for long hours under a blistering sun pressing the search button after typing four whole words! - Quzah

    You. Fetch me my copy of the Wall Street Journal. You two, fight to the death - Stewie

  10. #10
    Carnivore ('-'v) Hunter2's Avatar
    Join Date
    May 2002
    Posts
    2,879
    Yeah, that was the one The name slipped me earlier. I just downloaded and installed a whole bunch of security updates/patches with AutoUpdate (every update that it found), I hope that covers the RPC patch. I was meaning to download all the updates before, but my internet was going so slow ( ) that the updates wouldn't download.

    Thanks everyone!
    Just Google It. √

    (\ /)
    ( . .)
    c(")(") This is bunny. Copy and paste bunny into your signature to help him gain world domination.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Having some internet troubles, no idea what to do
    By Geo-Fry in forum Tech Board
    Replies: 1
    Last Post: 12-09-2003, 07:56 PM
  2. Problems with XP on laptop
    By nbo10 in forum Tech Board
    Replies: 6
    Last Post: 10-04-2003, 11:27 PM
  3. Replies: 8
    Last Post: 09-22-2003, 01:31 PM
  4. PC Alert 4 with Cooler XP
    By DavidP in forum Tech Board
    Replies: 3
    Last Post: 09-20-2003, 03:34 PM
  5. Dual Booting Win XP & Win 98
    By netboy in forum Tech Board
    Replies: 2
    Last Post: 08-18-2003, 02:29 AM