Problems with Network

[max1mum]

We are experiencing some problems here, and I am not sure what to do next. Our network has become pretty flaky. A couple of days ago our Internet Connections would just drop off after being connected for about 20 mins. We have about 15 Computers connected to a 24 Port switch which then connects to a Router which Connects to a DSL Modem. The router assigns addresses via DHCP. After the connections drop we can just do a ipconfig /release and /renew , and it run again for about 15 mins. I replaced the Switch thinking that could be the problem. The netword ran fine for about 24 hours then started the same thing again.. Any suggestions? thanks a lot!

- Maximum

Max1mum.
- VBA Programmer
- Studying for MCSD

 

[manarth]

first step - check your logs (router logs, dhcp logs - anything you can find!)

is it just the internet connection that drops? or the entire network? what does "ipconfig /all" show when the network is down?

a packet sniffer (e.g. ethereal) can help locate any unusual network broadcasts.

sorry I can't give a more meaningful answer; there's just too many variables to say "it's this."
updating your router's firmware wouldn't hurt.
Scanning for viruses and running an ad/spyware detector may not solve the problem, but is worth doing anyway.

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[max1mum]

I will check those things when it is down. It is only down until a User refreshes the IP. We can still browse the network internally, but cannot get out to the net until we refresh the ip. I know one of our Execs has a virus. could a virus cause this?



Max1mum.
- VBA Programmer
- Studying for MCSD

 

[manarth]

could a virus cause this?

yes, indirectly....
say the virus's effect was to run a DHCP server; this would then conflict with the router's DHCP.
I only use this as an example though!

As you can browse the internal LAN, my guess is your IP isn't changing.
I think you need to look at the router / WAN settings (although why this has changed I don't know - it sounds like you had it working for a while before hand).

BTW, next time it's down, can you check if it's just BROWSING that's affected, or the entire connection.
Do this by trying to ping an external IP address (e.g. &quot;ping yahoo.com&quot; or &quot;ping 64.58.79.230&quot.

Are these PCs part of a Windows Domain (e.g. NT / 2000) - if so, it may be a domain policy causing the problem.

Do try updating your firmware... especially if you've installed a new switch - updating the firmware is normally my first step after unpacking a new device

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[max1mum]

Ok. I am going to try updating the Firmware on the devices, and Ping an external ip when the connection drops. We are not part of a Domain. Just a group of computers sharing a DSL modem =).


Thanks!

- Maximum

Max1mum.
- VBA Programmer
- Studying for MCSD

 

[manarth]

OK, as you're not part of any domain I'm 95% sure it'll be an issue with the router / switch, because there's nothing (major) else which would affect ALL the machines sharing the connection...

however, if one of the machines has / had a virus, this could have propogated across the machines, depending on what security / file sharing is in place.

if you've found a virus, forum760 may offer some help in removing. (knowing the name / type / location of the virus may help).

If you need some more ideas (or if you work out a solution!) could you post back with your progress?
Good luck!

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[max1mum]

Ok. Here is what i have done.

1. Flashed Router Firmware.
2. Ran Virus Software on machines with none.
I need to run it across the network to check.

When the network goes down i cannot browse internally. I thought i could but i cant. Also when i try logging into the router when its down it doesnt give me my standard Login. usually it says something about my Realm being &quot;linksys XXXXX&quot;, but when its down it says &quot;Realm: NR041&quot; ?? not sure.

If i setup a proxy server can i just install virus software on that one box instead of every computer on the network?

BTW: thanks a lot for your time. It is greatly appreciated.

- Maximum


Max1mum.
- VBA Programmer
- Studying for MCSD

 

[bcastner]

Time for some bcastner Linksys voodoo:

Do this exactly.

1. Have only 1 PC connected to the router. No other connections, including modem. Set that PC to a static IP of 192.168.1.2 subnet 255.255.255.0, DNS 192.168.1.1 Gateway of 192.168.1.1. Access the router setup. Write down all the current settings, as they will soon disappear. Turn the PC off.

2. Find a tool that would allow you without intermission to hold the reset button for up to a minute. Try various pens, or a thick (not thin) paper clip. You must not slip from the button. Two people will make the following easier, as it is hard to see the router lights and hold the little reset button at the same time.

3. Push in the reset button and hold it. After a time the diag light will go on, all the lights will flash, and the diag light will go off. While still holding that reset button, count 20 Mississippi. Release the button. Pull out the power cord to the router. Wait one full minute.

4. Pushing on the reset button, restore power to the router. When the diag light goes out release the button, and again unplug the router. Wait one full minute.

5. Power on the router. Power on the PC. Go to the setup page again. Put back in all of your settings.

6. Very important. Set the Keep Alive timout interval to 180. Note this step, because if the problem happens again you want to try changing the setting from Keep Alive to Connect on Demand with a setting of 5. For this trial set Keep Alive to 180. Apply all of your changes. Power off the router and the PC.

7. Connect everything back up. Turn on the Modem. Pause til it stabilizes. Turn on the router. Pause til it stabilizes. Turn on your PCs.

If the problem re-occurs, go to step #6 and make the Keep Alive change.

If the problem then re-occurs, return the router for an RMA with a cross-shipping option if available. You should seriously think about whether this is the best router for your setting. I doubt you will ever see uPnP support for this router, among other defects. Linksys, owners of the Network Everywhere product line, is not going to kill their golden goose the BEFSR41 with this product. It will always be limited in features compared to their SOHO product line. I would purchase something else, and keep the RMA'd device that you get back as a spare.

 

[manarth]

for a decent AV solution, the best bet is to setup one PC as the AV server (this machine will d/l the virus updates from the internet) and have a client A/V app on all the workstations which receives the updates from the internal server you've setup.

The results of an &quot;ipconfig /all&quot; (whilst the system is down) may uncover where the problem lies.

C:\WINDOWS\DESKTOP>ipconfig /all

Windows 98 IP Configuration
	Host Name . . . . . . . . . : myoffice.com
	DNS Servers . . . . . . . . : 10.0.1.39
	                              10.1.1.39
	Node Type . . . . . . . . . : Broadcast
	NetBIOS Scope ID. . . . . . :
 	IP Routing Enabled. . . . . : No
	WINS Proxy Enabled. . . . . : No
	NetBIOS Resolution Uses DNS : Yes

0 Ethernet adapter :
	Description . . . . . . . . : 3Com EtherLink PCI
	Physical Address. . . . . . : 00-10-AA-AA-AA-01
	DHCP Enabled. . . . . . . . : Yes
	IP Address. . . . . . . . . : 10.0.1.100
	Subnet Mask . . . . . . . . : 255.255.255.0
	Default Gateway . . . . . . : 10.0.1.1
	Primary WINS Server . . . . : 
	Secondary WINS Server . . . : 
	Lease Obtained. . . . . . . : 
	Lease Expires . . . . . . . :

I'm starting to feel bcastner is onto something with his suggestion that you may have a dodgy router... but that doesn't clarify why the (internal) network is going down.

for an experiment, setup 2-3 PCs on the LAN with static IPs - make sure they are IP addresses NOT allocated by DHCP (to avoid IP collission) and are on the same subnet as the rest of the network. Set their default gateway to the IP address of the router.
See if these machine go down - if the internet connection goes down, but the 3 machines can still ping each other, the router (or DHCP) is at fault.

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[max1mum]

bcastner : i am going to try your test first, but i am having troubles finding the timeout property in my router?

manarth: ipconfig /all looks good.

I am going to try setting up static ips as i wait.

thanks for all your help!



- Maximum

Max1mum.
- VBA Programmer
- Studying for MCSD

 

[bcastner]

manarth,

There are two &quot;timers&quot; at play, either one could be the source of the problem.

For the machines using the router's DHCP service, there is a lease that can expire and needs renewal. It is my guy feeling that this is what is failing on the router: the lease term is too short and the renewal fails.

The second &quot;timer&quot; is obviously whatever lease he obtains from his ISP. Whether or not that fails is unclear, but if it too should fail to renew, the DHCP service, which is dependent, falls into an unknown state.

It would be impossible to say from his description which or if not both of these renewals is failing. But my &quot;gut&quot; tells me one or both services are not reaching a renewal in a timely fashion. If I had to pick one, it is the DHCP service renewal, but again, it is dependent on a stable connection to the ISP in order to resolve DNS addressing for the service.

 

[manarth]

bcastner - my guess would be the LAN DHCP: see comment about being unable to connect internally when down.

If it were just the WAN IP, the internal connection would be fine (the router's system for receiving the IP address from the ISP is completely seperate from the DHCP serving system for allocating LAN addresses).

If the WAN were down (and so the DNS), pinging using internal IP addresses would still work.

network troubleshooting - days of entertainment

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[max1mum]

OK. i havent tried the static IPs yet, but I reset the powered everything off, and reset the router. Still does the same thing. Next i will try assigning static IPs to the computers. I'll let you know how it goes. thanks

- Maximum

Max1mum.
- VBA Programmer
- Studying for MCSD

 

[bcastner]

manarth,

I agree with you.

It was more speculation on my part as to an alternative. If the DHCP service faces a renewal request from the client it wants to push not just its IP enumeration for the client, but return a Gateway and DNS addresses. That is why I said the service state at the point is unknown. You really would have to disassemble the firmware to see if it pushes old address, bad addresses, or refuses the DHCP request. As I said, unknown.

Best.

 

[manarth]

hehe - I've tried reverse engineering routers (hardware & firmware) - you're right, they do sometimes have very interesting dependancies!

I've not come across a &quot;WAN dependant DHCP server&quot; yet though - probably because DNS would be the only affected service... I can confirm Linksys's routerss' DHCP is not dependant on the WAN.

Cheers, <marc>

 

[manarth]

and now the thought springs to mind: if &quot;ipconfig /release&quot; &quot;ipconfig /renew&quot; reestablishes connection, then A DHCP server is returning a valid IP address. I'd hope it's the router, but you never know =)

Max1mum - try checking a) on the router and b) using &quot;ipconfig /all&quot; how long a lease the DHCP server is giving. (last 2 entries in &quot;ipconfig /all&quot; are &quot;lease obtained: &quot; and &quot;lease expires: &quot



<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[bcastner]

max1mum,

It took me a while to find a readable copy of the full manual.

The WAN timeouts are at the bottom of the page where the PPoE password is set, at least it looks that way. You may have to scroll to see it.

If you could, I would like you to disable the access logging feature. It consumes a lot of router resources, and if the logs are not assigned to an IP they can, according to Linksys, stack up and exhaust memory resources.

I would also like you to enable uPnP for a while. Make sure one client workstation has the uPnP client software installed. You can tell because your network connections screen wil show an Internet Gateway device as well as an internet connection listing. If the Gateway does not appear on your device, go to Control Panel, Add/Remove Programs, Windows Components, Networking, and click the box for the uPnP services. Apply, and the software module for the Gateway will be installed. Once Installed, click to enable to show the Icon as a tray icon. This will give you visual feedback as to whether the router is working, and if you right-clock it you can query its status.

I know you are probably sick of all of this by now, but you are either very close to making it work or very close to having cause to send it back.

 

[max1mum]

I finally figured it out after 2 days of lots of stress. Wanna know what it was? =) We another router setup as a hub in one of the office's that didnt have DHCP disabled! . haha. thanks for all of your time. It was greatly appreciated. I definately learned a few things here.

Thanks again

- Maximum

Max1mum.
- VBA Programmer
- Studying for MCSD