Client can connect to LAN but not WAN ????

[Miescha]

This one has been driving me nuts today.
DC is running Server 2003 (though I really don't think this is a server issue b/c no other clients are having a problem).

Switch is an omnistack 6148 (but I moved the client to another switch and no change so I'm sure the switch is not the issue).

SonicWall firewall, but I physically removed this for a testing period and no change, so I'm ruling out the sonicwall firewall appliance.

The client is running XP pro SP3. Logged in as Admin, I can connect to anything on the LAN (other workstations, the server, network printers, etc. . . ). The server is giving the client DHCP data correctly, and DNS is working on all the other machines based on command line ping testing.

I've checked all the necesssary services are running and I'm finding no event viewer data that indicates a problem on this client.

So . . . what the heck am I missing? All day long I've had that feeling that I'm missing something simple and I just don't see it. I'll admit I don't deal with this type of problem very often - all the new client setups I've done just 'work' and I don't recall ever having a client lose its WAN connectivity.

I'm going to dinner and maybe some great idea will hit me before I return in an hour or so.

As always, any ideas are appreciated.

-Miescha

 

[cajuntank]

Check the connection settings under IE to see if something got set in the proxy settings. I've seen some viruses change this setting as to cause you to not surf the Internet

 

[SweetRevelation]

I agree with cajuntank.

Can you only not browse? What if you ping to the internet? Do you get a response?

If you can ping try to telnet to port 80 on a webserver on the internet.

If you can't do those things try a route print and make sure your gateway is setup properly.

 

[Miescha]

Can't browese, can't ping.

If I ping locally, all is fine. If I ping to WAN everything times out without response. If I ping a named address e.g. google.com it will resolve the DNS to 74.125.225.whatever so it seems DNS is working but that could just be the local cached DNS data.

DHCP, DNS, and gateway come from the server (which is the sole server at this location so it does everything - DC, DHCP, DNS, print server, file server, etc. . . typical small business).

I've compared all the settings with the other working clients here and all the settings I can think to compare are the same, but the other clients all get out to the internet and this one doesn't. Its really odd.

I've run multiple virus/spam/spyware tools and the machine comes back clean.

Any other ideas are appreciated. I'm not opposed to just reinstalling the OS but I'd really like to know what is causing the problem - its starting to get personal!

-Miescha

 

[SweetRevelation]

First I'd install wireshark on the machine in question and see if your traffic is leaving the interface.

Second, if it is, I'd create a monitor port on the switch facing the router and run wireshark there to see if your data is reaching the router.

But if your traffic isn't even leaving the workstation to begin with you can rule out the network.

 

[Miescha]

Good call on wireshark. I'll look at that shortly.

wouldn't the traffic have to be leaving the workstation since I can browse to the other clients on the network and I can browse all of the shared folders on the server (and transfer files to the server)?

I'll get wireshark up and running and see what I can find.

thanks!

 

[Miescha]

OK, WireShark is installed and capturing - but I'll need to spend some time getting familiar with the program before I can understand what is going on.

At the very least, when I filter for TCP there are a LOT of red and black lines showing up and I can already tell that isn't good.

I'll get back to figuring out WireShark for a while and let you all know what is going on.

-Miescha

 

[rclarke250]

Have you tried resetting the winsock stack or tcp/ip? check here.

http://support.microsoft.com/default.aspx?scid=kb;en-us;299357

http://support.microsoft.com/kb/811259/

 

[Miescha]

Yes, reset the winsock stack and tcp/ip without luck.

Thanks for the recommendation though - it was a previous life saver.

ipconfig /all on the problem machine is identical to data from the other functioning xp pro machines on the DC.

Still stumped and getting ready for a clean install of the OS (but there are actually a TON of other programs on this particular client machine, so that is sounding a lot less desireable).

-Miescha

 

[Miescha]

SUCCESS (sort of)

I have WAN access - but I can't say exactly why :-(

On a whim, I installed a PCI network card even though I was pretty much certain the motherboard ethernet adapter had to be fine (after all, I can access the switch, firewall, server, all network shares, all the dang LAN) so the adapter can't be bad - right?

BUT, when I installed the spare Linksys adapter - voila, I have internet access.

But I still can't say why b/c if I simply unplug the cat5 and switch it to the motherboard adapter I get the LAN but not the WAN. What the heck am I missing?

-Miescha

 

[Miescha]

Some additional info today.

I just learned that this machine (used by a manager at the location) previously had a AGP video card installed for the purposes of using dual monitors. The day this problem started the monitors went blank and the user decided the card was bad and pulled it. I was given the card today and it is definitely dead (looks like the fan died and it over-heated). I was also told that while trouble shooting the blank monitor problem, they tried to start in safe-mode and as a result all the services were stopped. After pulling the video card, they exited safe mode but the services would not restart - everything was set to 'disabled' and they manually changed everything back to automatic or manual by comparing to another identical machine.

This leaves me wondering if the onboard LAN adapter could have been damaged by the video card overheating. I still think if it works to get out to the LAN then it works from a hardware standpoint. But I'm running out of settings to check that are isolated to just the onboard LAN adapter.

Given that the PCI adapter is working fine and I can get to the LAN and WAN with it, I'm confident in ruling out the entire network and server and even all of the settings on this machine other than those for this particular onboard LAN adapter.

Thoughts?

-Miescha

 

[Miescha]

If anyone thinks of any additional ideas, I'd be thrilled to try them in an effort to determine the cause of the problem.

For now, we've made the decision to just continue using the new PCI network card which is working fine on all accounts we can determine. Obviously, the integrated motherboard LAN adapter isn't going anywhere, so if anyone thinks of an idea I can just move the cat5 cable over to the integrated NIC and test it out.

At least for now, client is happy b/c everything is working and the only cost was a relatively inexpensive PCI network card.

Thanks all!

-Miescha

 

[muckermucker]

this definitely has nothing to do with hardware, it is how your TCP/IP stack is configured. Somethings no one suggested you could try are these:

First go back to the old environment - Take cable out and put it into dodgy network card.

Now run these commands to give us more info at the command prompt:
ipconfig /all > c:\ipconfig.txt
route print > c:\route-table.txt
tracert google.co.uk > c:\trace-route.txt

This will create 3 txt files in the C drive. Paste the contents here.

Do the same on a working PC and paste the contents here. I bet you will probably spot it before us, just look at the differences between the files...