Strange IP Problem

[jason985]

I have a strange issue here. The problem is 2 of my machines can’t connect to internet via browsers but I can ping internet addresses. If I manual change the ip address to another ip address it will work fine. We are using private ip’s so I can use another one but the problem continues to happen and I have to keep changing the ip address. Any ideas what is causing this?

Btw: Our local machine are connect via unmanaged switch to Cisco router that routes to the internet.

TIA

 

[dtrtel]

I'm not quite sure I follow, but as a start, compare outputs from "ipconfig /all" command on the working and non-working machines and look for differences in the DNS IP addresses, and subnet masks assigned.

What is your private subnet address and mask? You need to be consistent with the subnet mask on the router and the PCs.


--jeff

http://linkedin.com/in/JeffLynch

 

[jason985]

Lets see if i can explain this better. At my remote site I have 10 machines all on 192.168.10.64 255.255.255.192 subnet including the router. The routers address is 192.162.10.65 255.255.255.192. The machines are 192.168.10.80 etc.... The problem that occurs is one or more machines will stop getting to the internet via the broswer, I tested that i can ping google.com and other public sites fine but I am still unable to reach the internet via browser. If I change the ip of the machine to another ip in the same subnet it will work fine.

I double checked dns setting etc... everything matches fine. I tried rebooting router as well without any luck.

 

[jimbopalmer]

The subnet is 192.162.10.65 to 192.162.10.126, that should be fine.
Ping by name works, so DNS is fine.

Sounds like port 80 is blocked for some IPs in the router, as a guess.

I tried to remain child-like, all I acheived was childish.

 

[jason985]

Nope no IPs block port 80 in the router either. It is strange and bothering the hell out of me.

 

[dtrtel]

I've seen similar irregularities of this nature before. Usually the result of viral/malware corrupting Winsock stack. If the problem is recent, you can try a system restore on the affected machine to a date prior to the problem happening (and get all windows updates and antivirus, do a complete scan before accessing any web sites).

If you can't do that, you have to deal with TCP/IP stack corruption, google for LSPfix. Warning, this isn't for the faint of heart, if you feel overwhelmed, consider format and re-install windows.


--jeff

http://linkedin.com/in/JeffLynch

 

[jason985]

Thanks for the info I will look into LSPfix.

 

[internetjunkietiff]

Jason, I am having a similiar issue. Let me know if you figure this out please!

 

[jason985]

Internetjunkietiff, I have not gotten a chance to go by the branch with the problem but I will let you know if the LSPfix works. If you fingure it out before then let me know as well.

TIA

 

[gb0mb]

I saw that when you pinged IP addresses on the internet it worked. Can you ping by host name on those machines? If not DNS issue.

Gb0mb

........99.9% User Error........

 

[jason985]

Still having the problem... I can ping by host name.

 

[burtsbees]

Post a sh run of the router, and let us know how many nodes are on this subnet. Also, what browser are you using? Are there 2 IP addresses that are the problem every time?
A config of the router is important for you to post so we can see what could be going on. Sounds like an application layer issue---have you tried just http, or can you ftp to any sites via the browser? If not ftp through the browser, how about command line? Have you tried Firefox?
Please post that config.

Burt

 

[jason985]

Router Config Below:, The problem seems to be with http traffic only with any browser. FTP works via browser and command line.

Current configuration : 726 bytes
!
version 12.2

!
hostname Branchrtr
!
enable secret 5
enable password
!
ip subnet-zero
!

!
interface FastEthernet0/0
ip address 192.168.5.249 255.255.255.0
speed auto
!
interface Serial0/0
description West-Rose T1 60DHZXxxxxxxx
ip address 192.168.0.18 255.255.255.252

!
ip route 0.0.0.0 0.0.0.0 192.168.0.17
!

!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password
login
!
end

 

[burtsbees]

I thought you said the trouble subnet is 192.168.10.x/26...are you sure this is the right router? Also, what is the dhcp server?

Burt

 

[jason985]

Opps wrong branch config:
Also, We are using static ip addresses. We only have about 10 machines at this branch.

Current configuration : 726 bytes
!
version 12.2

!

enable secret 5
enable password
!
ip subnet-zero
!

!
interface FastEthernet0/0
ip address 192.168.10.65 255.255.255.192
speed auto
!
interface Serial0/0
description Norco-West T1 60DHZX
ip address 192.168.0.8 255.255.255.252

!
ip route 0.0.0.0 0.0.0.0 192.168.0.7
!

!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password
login
!
end

 

[burtsbees]

So you are able to ftp with a browser after you get the internet problem? That's what I was asking. This would help eliminate the possibility of the application layer causing the problem, or malware/virus. One more thing---have you tried in safe mode to see if the machines get the problem?

Burt

 

[jason985]

Yep FTP works from browser. I haven't tried safe mode. I will try that later today when I head over to the branch. I will post the results later.


TIA

 

[burtsbees]

I would definitely say adware/virus causing the problem, if FTP still works AFTER you start experiencing the problem.

Burt

 

[jason985]

After more troubleshooting this is what else I found out. If try to use that same IP address on another machine I have the same problem. The other machine will not connect to internet. So this leads me to believe it is not a problem with the machine itself.

So the machines IP is 192.168.10.80 if I change it to 192.168.10.81 it will work. If I change another machine on the network to the .80 address that machine will not work either so something is not allowing .80 to reach internet… but does let it ping internet addresses via dns and I can reach it and other machines on the local network fine.

 

[burtsbees]

Firewall acl blocking that host port 80, I would say. It would be best if you gave us the entire topology, at least up to the router/firewall, including the dhcp server, for the .10.x subnet.

Burt