Abnormal termination of internet access?

[GEAK]

We have a small LAN and have just recently re-installed W2KS on our internet server/gateway machine. The server has 2 NICs, one for the LAN, the other connected to a cable modem. Prior to re-installation we had normal operation of the server and all clients could access the 'net through a proxy.

Since the re-installation (with almost the exact same software) we get only short term internet access. Between 20 minutes and 8 hours (average one hour) after booting we lose our internet connection. We still have LAN, but no incoming or outgoing connection.

We've been monitoring the event log and get absolutely no indication of a problem, the connection is just lost. We've checked the cable connection and it is fine, server appears to be running fine as well, but until we reboot we don't have internet access.

We haven't been able to track this to a single item of software. We've actually re-formatted the hard-drive & re-installed the OS FOUR TIMES in the last three days, each time testing the connection after installing new software. When it seems that a particular program is at fault, we uninstall but the problem doesn't go away. We re-format, re-install and don't install the errant program and the problem appears when something else is installed.

We're at our wits end... Ideas? Suggestions?

 

[peterve]

What proxy software are you running ?
Never thought of the possibility to use NAT ?

Can you ping internet IP addresses from the server when the connection seems to be 'down' ? Peter Van Eeckhoutte
peter.ve@pandora.be

 

[MrFreese]

okay i have a same issue and what i found is that when you looses your connection Stop & Start the RRAS service, disconnect both LAN connections then start the "Internet connection" Give it 20 sec. then start your local LAN connection ..

Now this is the part i cant figure out how to get W2K to do.

When you start the server, the Internet connection HAS to start first... i have not been able to find to get W2K to start the LAN connections in that order... Let me know if that helps any

Alan T. Freese
Freesefam@msn.com

 

[GEAK]

We were using WinProxy 3.0d, we tried ISA (but kept losing the connection before installation was complete) and we're now using WinProxy 3.0r. The connection is lost regardless of which is installed. It even occurs on the gateway when no proxy software is installed.

Once the connection is down, we can ping locally, but not the internet (from gateway or machines behind the firewall). Only a reboot seems to fix it.

A friend suggested doing a virus scan and we found an indication that SunOS/BoxPoison.worm was on the system. The virus leaves behind a trail of html & asp files - all of which have been deleted. The virus itself hasn't been found (using mcafee & norton...). We suspect that it was on the system, but was eradicated during one of the hd formats. The remnant files that it generated were found on a backup of our server and they haven't been re-produced since then (two days ago).

We still lose our internet connection.

 

[paulwood]

When you loose the connection, is there any indication on the cable modem or are you sure it is the software?

 

[peterve]

I would try a different NIC... Peter Van Eeckhoutte
peter.ve@pandora.be

 

[GEAK]

As to checking the cable, etc... I have, on another machine, a TV video card. The source for that card is coming off the same cable feed. I can see that the cable signal is getting to the modem, even when I can't get the Internet connection.

At this point we are thinking it is a hardware problem. I have tried moving the NIC to another available slot but that did not solve the problem.

I plan to purchase a new NIC this afternoon and install it.

As to the "stop and re-start the connections", we have been trying that. It does seem to work! But, I used GRC.COM to test my ports this morning after doing the stop and re-start. It seems that that procedure does let us surf outward, but according to GRC, our ports are all closed. Thus, no-one can get into our site. (A small web site run from that server.) A re-boot of the server and the site is opened up once again.

 

[GEAK]

I tried 2 brand new NICs. Both were reported by Windows as working propery. I could not get any connection what-so-ever with either NIC.

I put the old one in, configured it just like to new ones, and I instantly got access.

But, for how long?

 

[peterve]

did you try to re-apply latest SP ? Peter Van Eeckhoutte
peter.ve@pandora.be

 

[paulwood]

Does your cable provider require you to register a MAC address for each NIC connected to the cable modem, if so the new NIC's won't work until you do. I have this problem with Telewest, my cable provider.

 

[malaking]

I am not sure if this is related, but I am having a similar with a sonic wall vpn. I have a win2k server and a sonic wall router. I connect to the network from home with a sonic wall vpn client but it terminates at exactly 8 hours. I have adjusted all the settings on the router and checked the security policies on the server but can't find the problem. After the termination occurs I can still access other shared resources on the remote network but just not the server. The only way to access the resources on the server again is to reboot the client machine.

I posted this before but didn't have any luck.

 

[Guest_imported]

I'm having the same problem with winproxy 3.0h shutting down spontaneously, usually overnight. the Error logs state that the proxy machine is having difficulty connecting with dns.

Any help would be greatly appreciated.

Thanks
chris

 

[Zukester]

Hi:

I have a 3COM 3C905B-TX NIC running on Windows 2K Server, and a 3COM 3CP 5699A internal 56K modem. When I install the modem, it works fine. When I use dialup, the NIC and LAN connections no longer work. In order to reinstate this ability, I have to uninstall the modem.

Either one works, never both.

Any ideas? I am running SP1.

Thanks,

Bob Zuvich
MCP + I + MCSE
rzuvich@bicmt.com

http://www.bicmt.com

 

[jakemidd]

I have also had the same problem but with a little twist. I run a small lan (10 pc's and a win2k svr). All pc's see the internet fine except the server. The pc's are linked via a linksys hub and router. After a reboot I can go and surf all day long. The connection if fine until I stop surfing. The intranet site is up, but the internet site cannot be seen evan after a reboot. The only way I have been able to keep the connection up is with NAPSTER of all things (most likely because it keeps a port open).

 

[mcconmw]

Have you tried sp2 now that it's out to see if it fixes the problems.

 

[CaRKiLLa]

Ok I may be able to give all of you some info. I'm running two different setups getting out on a cable modem. 1 is with a Linksys Cable-router and the other is with a Sonic Wall Pro. I had similar problems with this too also when I first got the cable connection using Zone Alarm on my PC. The problem is how tight your system is. I'm assuming that all of you are using dynamic addressing from your inet provider. The problem is when you leave your machines idle (not accessing sites on the internet), your IP lease from your provider starts to run out. Depending on the provider it could be anywhere where from 5 mins to 3 hours. Most providers I have worked with have it set at about an hour. The ISP sends pings or ICMP packets to your ip addy to make sure the workstation is still on or active. If the DHCP server gets a reply or you access some pages it renews the time period. If it doesn't it drops the lease and puts it into a pool for the next person who connects. What is happening is when the ping or ICMP requests comes to your router/firewall it rejects the packets(to keep the bad guys out). Since your machine is not accessing any pages the lease runs out andit drops your IP.
Most of the time you can recover by going to a command prompt and typing IPCONFIG /release and then IPCONFIG /renew. You may have to add your adapter number is you are using multiple nics.
"Always-on" internet access really isn't always on if you use a firewall and DHCP. An easy way around this is to run a program that hits the internet from time to time. A good thing that I use is the SETI screensaver. It is always requesting and sending very small packets to the SETI servers. With this happening you won't lose your ip lease.

Let me know if this helps or if you have any other questions.

 

[GEAK]

Thanks for all the great tips & advice. Our system seems to have stabilized (for now). In answer to some comments, we have (and had done so prior to the problems) installed all of the latest SPs. As to maintaining outbound traffic, behind the firewall we have four machines all of which are running SETI, our average time between SETI packets is about 6 hours.

As to the firewall blocking pings - I don't think that's it either. On one occasion my fiancée monitored the gateway machine while I'd ping it from work (we were on the phone during the test)... For a few minutes it would get through and then the gateway machine would just disappear without any apparent indications on either end.

Just before the problems started, our ISP was taken over by a rival company. With the original owner we had (what they called) a "semi-static" IP address. For three+ years the IP address never changed. Within a month of the takeover our IP address changed twice. On a few days after that first month we saw it change four & more times/day - without shutting down the gateway.

Since the problems began we've had techs (from the ISP) come in and check out our system. The first one replaced our cable modem with a newer model but that didn't solve the problem. He arranged for "his supervisor" to come check our system. The 'super' arrived and admitted he knew less about our system than we did - he wasn't at all familiar with Win2K as 99% of customers are running 95/98/ME. He ended up replacing both of our NICs (outbound and intranet connection to hub).

Now that the NICs & modem have been replaced (along with a little extra tinkering by my fiancée) we seem to have a stable connection. We noticed that even after the problem went away, our IP address would change quite frequently (two successive pings within 5 minutes of each other reported different IP addresses).

The changing IP address turned out to be more of a pain than we could tolerate. Since my fiancée and I both instruct, we were running a web server with material for our students on our gateway machine. Everytime the IP address changed, our students could no longer browse the material. We've since moved to a hosting service (at $40/year we couldn't resist) and now our gateway is 95% outbound vs the former 25% outbound.

I'm not any closer to the reason behind our former problems but maybe my fiancée is (I'm a programmer, she's the network wiz ). I'll check with her and find out whether she knows - I (or she) will post an update with her findings.

 

[Cryptospy]

I believe there is an issue with the 3C905 NICS and w2k server/adv serv. Go to microsoft and check it out... They periodically lose a connection.

I've got the link @ work, but its Canada day here and its my Day off.

 

[ag6969]

I can't say for sure, but I believe Cryptospy is right. I had NAT set up on my Win2k Server with an Intel PRO-100/3com 3C905 combination with Rogers cable and it worked great, but when I shifted the connection to a dedicated system to perform NAT with 2 3Com 3C905 NICS, I had this problem. I got fed up and set up FreeBSD box with the 2 3C905 NICS, and haven't had a problem since. (My fingers are crossed, it's been a week!)

 

[GEAK]

I'm narrating what my fiancée is telling me ...
Prior to the problem I was running the RTL NICs (AON-325 c/w RTL8139, the other was RTL8029) with Win2K Server NFR and they worked fine. The problems first came up when we removed the NFR version and installed Win2K SBS.

The first thing that the tech supervisor from our ISP did was to put in 2 D-Link NICs.

I was hard-coding the IP address since it had been stable for three years but turned on DHCP when the ISP started changing the IP address.

I don't know for sure what the exact solution was, but the combination of changing out the NICs and turning on DHCP seems to have solved the problem.

Switching to LINUX or any other OS wasn't really an option for us. We're both developers and instructors (computer programming courses) and the college at which we teach is pretty much geared towards MS platforms. It would have been too much to get up to speed on a new OS while still doing development on the MS systems.