http problems

[Alistair]

I use a draytek vigor 2800v. I have the strangest problem. I'm surfing & then all of a sudden "this page cannot be displayed". I cannot even access my routers page on http://192.168.1.1 & the only way to sort this is to restart the PC. However, it doesn't affect my usnet downloads?
I did do a firmware upgrade on the router, but because of the problem I downgraded again. I don't think its my ISP becuase I migrated on Friday & the problem existed before this time.

I also did complete fresh install of windows.
Any suggestions?

[streetster]

are there any other machines attached to the router? does the same problem exist on them also?

[Alistair]

are there any other machines attached to the router? does the same problem exist on them also?

There's only the 1 machine attached to it my HTPC. I have the router for its VOIP capabilities.

[mrt9888]

did u check the settings of the router; some routers have a disconection timeout

[Steve]

Have you queried Draytek about this? It might not be a problem with their router, but I hear they have great tech support.

[Splash]

given that restarting the PC sorts it I would think that this is a PC rather tan router issue. Have you checked your eventlog? How about updated NIC drivers?

[Nikumba]

When you get this problem, have you tried stopping your usenet downloads and waiting 5 mins and see if you can access the router or website again?

[Alistair]

The router is set to always connected

I have a post on the Draytek support website just now the same as this

I updated the onboard NIC this afternoon but I still get dropouts. Will view the event log next time


I usually stop the usenet downloads & reboot, then recommence

A suggestion from draytek was that the stack might be failing - but haven't had a response yet to what this infers

[Nikumba]

After stopping your downloads, dont restart but wait a few mins.

Used to have a problem with my old Netgear 814 in that its bugger got full and couldnt transfer any more data, stopping the download clears the backlog.

[Alistair]

After stopping your downloads, dont restart but wait a few mins.

Used to have a problem with my old Netgear 814 in that its bugger got full and couldnt transfer any more data, stopping the download clears the backlog.

Will give tht a try, Strange though, this only started about a week ago. Until that point never had these problems.

Now having trouble getting my sip accounts to connect, not my day

[SHISH]

Had a similar problem a month or so ago with XP saying it was connected but obviously it wasn`t. Doing the ipconfig/renew didn`t work either, just needed a restart every time.
Think mine was a problem with a sys file which controls half open connections and now OK after downloading a hacked one from http://www.lvllord.de/

Goes in very easy and works well now.

[Alistair]

Had a similar problem a month or so ago with XP saying it was connected but obviously it wasn`t. Doing the ipconfig/renew didn`t work either, just needed a restart every time.
Think mine was a problem with a sys file which controls half open connections and now OK after downloading a hacked one from http://www.lvllord.de/

Goes in very easy and works well now.

Ping'd the router OK but wouldn't display any pages. ipconfig release/renew seemed ok too. So have downloaded & will give this a try, many thanks

[Paul Adams]

If you're running into the concurrent half-open TCP connection limit then you get a collection of event 4226s from source Tcpip in the event log to tell you so - check that first.

Can you ping www.theregister.co.uk to resolve the name and get a response?

You say "ipconfig release/renew seemed ok too" - so if you enter the commands "ipconfig /release" and then "ipconfig /renew" it will destroy your IP settings and then renew them, but you still have the same problem?

What about if you yank the network cable out for a few seconds?

What about if you disable & re-enable the network adapter?


When the problem occurs next, try the following at a command prompt:
netstat -ano > t.txt
notepad t.txt
In the list, check out local ports in the range 1024-5000 to see if they are all listed, implying an exhaustion of ephemeral ports (but the above action should correct this without needing to reboot).

[Alistair]

Thanks for all the suggestions

I installed the hacked sys file but unfortuantely it didn't resolve my problem.

Even after a release/renew it still cannot diplay webpages without reboot. I tried unpluging the NIC cable, disable/re-enable the network connection in windows & powering on/off the router- no luck with those either

What I did discover is that if I were to stop usnet downloads & then try & restart, this wouldn't work either without a reboot. Whereas, if they are left to their own devices, they will complete, even though i cannot access any http?

[Alistair]

If you're running into the concurrent half-open TCP connection limit then you get a collection of event 4226s from source Tcpip in the event log to tell you so - check that first.

Can you ping www.theregister.co.uk to resolve the name and get a response?

You say "ipconfig release/renew seemed ok too" - so if you enter the commands "ipconfig /release" and then "ipconfig /renew" it will destroy your IP settings and then renew them, but you still have the same problem?

What about if you yank the network cable out for a few seconds?

What about if you disable & re-enable the network adapter?


When the problem occurs next, try the following at a command prompt:
netstat -ano > t.txt
notepad t.txt
In the list, check out local ports in the range 1024-5000 to see if they are all listed, implying an exhaustion of ephemeral ports (but the above action should correct this without needing to reboot).

OK, I did the ping to the register before & after reboot because of the problem:

Before


After


Also here are the results of netstat -ano > t.txt
notepad t.txt:-


Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1144
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING 2376
TCP 0.0.0.0:31038 0.0.0.0:0 LISTENING 1428
TCP 127.0.0.1:1034 0.0.0.0:0 LISTENING 3412
TCP 192.168.1.119:139 0.0.0.0:0 LISTENING 4
TCP 192.168.1.119:2785 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2786 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2787 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2788 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2789 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2790 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2791 208.49.80.60:3128 ESTABLISHED 2372
TCP 192.168.1.119:2792 208.49.80.60:3128 ESTABLISHED 2372
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 896
UDP 0.0.0.0:1026 *:* 1408
UDP 0.0.0.0:1122 *:* 1408
UDP 0.0.0.0:3776 *:* 2632
UDP 0.0.0.0:4500 *:* 896
UDP 127.0.0.1:1025 *:* 612
UDP 127.0.0.1:1048 *:* 1304
UDP 127.0.0.1:1900 *:* 2376
UDP 127.0.0.1:2764 *:* 2372
UDP 192.168.1.119:137 *:* 4
UDP 192.168.1.119:138 *:* 4
UDP 192.168.1.119:1900 *:* 2376

[Paul Adams]

Okay, so this information tells us the following:
- the problem is not due to an exhaustion of TCP ephemeral ports
- the problem is not due to the concurrent half-open TCP connection limit (10) being reached
- name resolution and routing continue to work
- existing TCP connections continue to work, but new ones cannot be established
- the problem is not with the router

I suspect you have a network filter driver which is flagging the TCP ephemeral ports as used and not clearing them.

Does the problem only occur after/during large usenet downloads, or are there other causes?

Run Rootkit Revealer to check for any hidden processes or TCP ports:
Rootkit Revealer