TechSpot

Internet connection has disappeared on 2 of 4 computers?

By Odyssey
Aug 17, 2005
  1. In our office we have 2 XP Home, 1 W2k, and one ME computer. Suddenly one of the XP's and the ME just do not want to find the Internet.

    I have run "ipconfig -all" on each and each returns their dns server ip #''s and their own ip #'s (10.0.0.4 in one case, and 192.168.0.? [can't remember], and if I recall correctly the ip # of the default gateway, but not much else. When I get to the office, I can correct or supplement this, but want to get a dialogue started.

    BTW, the 4 computers do not talk to each other, they just share the lan for Internet access.

    What steps should I take to figure out why they have stopped communicating with the Internet?
     
  2. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    "find the internet" means what?

    Can you ping the gateway? Can you resolve names? Can you ping stuff on the net?
     
  3. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    Thanks for yours.

    "Can you ping the gateway?" I believe so in each case, but will double check when I get to the office, and confirm.

    Can you resolve names?" Does this mean if I put in www.msn.com, do the browser return the msn webpage? If so, no.

    Can you ping stuff on the net? No, it times out.

    OE times out when I try to receive mail.
     
  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

  5. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    describe the wiring and access to the internet.

    Basically, we expect all systems to be in the same subnet
    eg: 192.168.0.x ... thru 192.168.0.z
    for sure the 10.0.0.4 is inconsistent with 192.168.0.x

    start with the system which makes the connection to the internet.
    use the ipconfig /all and you get the IP address, Gateway address, subnet mask and DNS address.

    ICS will have issues, but the GW, Mask, DNS will all be the same.
    all IP addresses must be unique.
     
  6. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    This is a little complicated, so pls bear with me (and do keep in mind that you asked). We have our Internet feed via a microwave link. The "modem" for the feed is either a two port router or feeds into a two port router. (This is 3-4 years old commercial equipment).

    One of the two ports goes to a WiFi gateway (this is the Nomadix which you will see below) and access point for our customers.

    All of the above is OK.

    The other port feeds to a 4 port switch. One port is used by one executive office for INet access. It is also OK.

    A second port of that switch feeds the admin office where there are four computers (also all connected via a switch in that office and these computers are connected to the switch with ethernet.) There are two XP Homes and the ME machine (The fourth computer there runs W2k but only accesses the Internet once a month to update the accounting tax files, so we can disregard it for the moment.)

    I would again stress that none of these computers talks to each other, so unsure if the different starting group (10. vs 192.) is relevant. They only use the lan to reach the Internet.

    The ME machine only exists to act as a sort of file server to our internal TV system. We have a sat feed for normal TV programming and devote one channel to our internal slide show. The slide show actually runs on our website as www.websitename.com/tvshow.htm so this computer logs onto the Internet to this URL and feeds the "download" into our tv system. This one was the first to suddenly become unable to find the internet. It is now disconnected with the cover off in the exec office where I am setting it up to see if it will somehow reach the Internet from here. (The old turn it off and back on theory of hope!)

    One of the two XP machines then decided it couldn't connect to the I/N either.
    For this computer, "ipconfig -all" NOW (another person has been fiddling) yields 0.0.0.0 for its IP address and subnet mask, absolutely nothing for the default gateway (not even a zero) and 255.255.255.0 as the DHCP server. Have no idea how to get it back to normal.

    For what it is worth, the computer in the exec office that this is being written from, yields from ipconfig:

    Host Name . . . . . . . . . . . . : systems
    Primary DNS Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Broadcast
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : nomadix.com

    Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix . : nomadix.com
    Description . . . . . . . . . . . : Realtek RTL8139(A) PCI Fast Ethernet
    Adapter
    Physical Address. . . . . . . . . : 00-50-70-B6-74-B6
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . : 10.0.0.112
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 10.0.0.4
    DHCP Server . . . . . . . . . . . : 10.0.0.4
    DNS Servers . . . . . . . . . . . : 12.145.12.2
    12.145.12.3

    Now totally confused. How about you?
     
  7. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    Restarted the reluctant WXP computer in the admin office and did another ipconfig. Now shows:

    and noting only those things different from the ipconfig listing above that are significant (e.g. not mentioning the adapter address, etc.)

    Node type: UNKNOWN

    "DNS Suffix Search List. . " ENTIRE LINE IS MISSING

    Connection-specific DNS Suffix . : NOTHING SHOWN AFTER THE COLON
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    AUTOCONFIGURATION IP Address. . . . . . . . . . . . : 169.254.229.6
    Subnet Mask . . . . . . . . . : 255.255.0.0 (note that the 3rd .255 is now .0)
    Default Gateway . . . . . . . . . : 10.0.0.4
    DHCP Server . . . . . . . . . . . : 10.0.0.4

    When attempting to ping 10.0.0.4 , it yields the message: "Destination Host unreachable"
     
  8. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    I saw this in a W2k thread:

    "You are probably current with W2K-updates.
    For a while now, MS has had its own W2K driver-update for Realtek NICs. Only problem is: a working NIC no longer works after M$ -update!
    So, if you have installed that update, uninstall it and use the original driver from W2K itself. I fell into the same M$-trap and it took me ages to figure it out."

    Could the prob with the XP computer be similar or the same? (Don't know when it was last updated as I don't use that puter.)
     
  9. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    The 169... address means the computer is unable to get an IP address through DHCP.

    To eliminate any DHCP issues you go to the TCP/IP settings and give the computer an address manually. Make the IP address, the gateway and netmask match the rest of your working machines (IP address starts with 10.0 when you have netmask of 255.255.0.0). Make the DNS servers the same you have on the other working computers. Disable any software firewall.

    Now that we have gotten autoconfiguration and stupid programs out of the way it is time to test the network. Ping the gateway. If it works, then yay. If it doesn't work then either the gateway doesn't like your computer or Windows TCP/IP system is impersonating a fruitcake or you have a problem with ethernet.

    We test if ethernet works by looking at the arp cache. Since you pinged the gateway we should have the MAC address of it cached. Run "arp -a" from command line and see if you have the gateway machine listed. If the gateway's MAC address is there (no need to check it, it is probably correct) then the ethernet works. If not, then you have an ethernet connectivity issue - check cables, switch ports, link lights, duplex settings.

    If ping worked, then we have a functioning LAN. Time to try to resolve some names. Run "nslookup www.google.com". You should get the IP address of some Google server.

    If you got the IP address back then it means we have a browser issue.

    Post back and tell us how did it go.
     
  10. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    the 'AUTOCONFIGURATION IP Address. . .: 169.254.229.6' is an IGMP address
    and will not route thru to the 10.0.0.4 gateway which leads to the
    NOT REACHABLE condition. Strange that the 10.0.0.4 gets found but
    an IP address is not set. DHCP normally sets the three addresses in the sequence
    ..IP address, Gateway Address, DNS address.

    on this machine
    use Start->Run and enter
    ipconfig /flushdns and hit enter
    command window will appear and then disappear; that's ok

    then try manual intervention, rebooting, and resetting for DHCP. by this i mean
    go to Network connections->right click Lan Connection->right click to properties
    go to the TCP/IP entry
    click properties
    on the general tab
    under Use Following IP and enter:
    .. IP address 10.0.0.127
    ..subnet 255.255.255.0
    ..Gateway 10.0.0.4
    under Use Following DNS enter
    ..12.145.12.2

    and reboot the box. it may be operational BUT you now have a STATIC
    IP address. This will require that the 10.0.0.127 is unique to this box
    and no system now or in the future will duplicate it.
    You ought to make life easier by staying with DHCP.

    You can try pinging other 10.0.0.x systems which ought to work,
    as well as pinging the DNS 12.145.12.2, and if all's ok, the browser should
    run fine. This will confirm the NIC can be configured for full routing to your
    Internet feed via the microwave link.

    To restore DHCP, chase the click sequence above and
    select Use Dynamic IP Address and Dynamic DNS
    click ok to close
    wait 30 seconds and confirm the address changes via
    cmd /k ipconfig /all

    please report your findings
     
  11. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

  12. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    OK, firstly, very grateful for your continued support. The last posts from each of you was very instructive and I think, productive. see further.

    Changed the various ip#,dns,subnet, etc as recommended on the XP puter and gave this computer the ip address of 10.0.0.113. It produced what you would expect with ipconfig -all.

    I can now ping the other XP machine on the same switch (10.0.0.74) and the one in the other office (10.0.0.112) successfully, but not 10.0.0.4. It timed out. Ran arp -a but it did not yield the mac # (I guess because it did not find it?) and even though this was unsuccessful, went ahead and ran the nslookup so that I could report back here. It said "Can't find server name for address 12.145.12.2", then the same for .3 (This is a little confusing to me cause it sounds like it could find either dns server rather than google?)

    Thinking further on this, I assume that my ethernet card and connection to the switch are OK since I can ping other puters. And another puter on the same switch can ping the gateway. So I am guessing that I have some sort of configuration issue that prevents me reaching the gateway or something else has gone wrong (but what I have no idea)?

    Progress, I think! What next?
     
  13. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    is this to say you can ping everything except the gateway 10.0.0.4 or
    only the systems directly attached to the same switch?

    the attachment is how I read your network. pls confirm or correct and repost here.

    yea, if you can't reach the gateway then the DNS beyond it is not visable either.
    I note that 12.145.12.2 belongs to AT&T Worldnet; this is a public DNS
    and not in your domain.

    Normally, the modem will have the gateway and DNS addresses from the ISP,
    your router would provide DHCP for all NICs attached downstream, and thus
    the systems would see a gateway and dns address copied from the ISP.

    Another reasonable configuration is the router's address is used as
    the gateway and dns addresses with a unique IP address given to all subsystems.
    the router then fowards all requests it receives to the ISP.

    The path of
    modem -<c>router<L> - <C>switch(A) - <C>switch(B) -- <L>systems

    suggests <C> cloned MAC addresses vs <L> dhcp assigned addresses
    and there should be no problem routing to the modem and beyond, yet
    there seems to be.

    Back to basics: what changed?
    Are the i/n accessible systems all attached to switch(A) and all failures
    to switch(B)?
     
  14. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    I can ping every other computer from the reluctant one, including the single one in the other office (which you may recall is using port #1 of switch #1 with all of the other computers downstreamed from port #2 of switch #1, and they all share switch #2). Just can't ping the router (10.0.0.4)

    Interestingly, the single computer (above, and this is the one I use for these postings) in the exec office can ping the router and all of the other computers except the reluctant one. Even more interesting, the first time I pinged it (the reluctant one, now 10.0.0.113) from here, it returned a reply on the first of the four tests, and has timed out on every attempt thereafter (including attempts 2-4 of that first ping test.)

    Also every computer save the reluctant XP and the older ME which is not at the moment fully assembled can reach the internet with no trouble. FWIIW, the ME puter has exactly the same prob as the XP machine but developed it several weeks earlier.

    So the hardware on the reluctant computer works, but it doesn't want to know about the router, or the router doesn't want to know about it! Now to figure out why?

    I hope this answered your question clearly? What now?
     
  15. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    A thing that should never happen in theory, but does in practice is duplicate MAC address. You should check the MAC addresses on the computers and make sure they are all different.

    Also, look over the gateway settings - maybe someone has imposed a MAC address filter.
     
  16. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    Nodsu, in rereading the above, I recall that the other computers (which are all 10.0.0.xyz) are 255.255.255.0 instead of the 255.255.0.0 that the reluctant puter changed itself to. Are you saying that if 10. etc is used, then the subnet should be .0.0 instead of .255.0, and if so should I change all of the computers? Since they are all working OK, I would assume not, but just thought it worth checking on this.

    and

    The mac addresses returned by "arp -a" are for gateway (first) and the sending computer (second)? Yes? (Just want to make sure I know how to check the computers' mac addresses.) I also note that the "physical address" returned by "ipconfig -all" is different from each of these and so assume that this particular "physical address" is not the mac address. What is it the address of?

    BTW, since the other computers can ping the gateway OK, can I assume it is not likely that "someone has imposed a MAC address filter"? Or might the other computers somehow have adapted to such a change? Incidentally, what is a "MAC address filter"?

    Will check these when I get to the office and report back.

    Thanks again.
     
  17. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    each NIC has a unique serial called a M.A.C. and is burned-in at mfg time.
    TCP software allows one NIC to masquerade as another.

    MAC filtering is a means used to ensure only known NICs are allowed to
    produce traffic downstream from the filter (one form of firewalling). There are
    two ways it can be used, white list(allow only these) and
    black list (exclude only these).

    So your system could be in trouble by:
    a duplicate MAC or a MAC Filter white list
     
  18. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    Jobeard,

    This is going to be tough to determine as the gateway in question is several years old, bought prior to my purchase of the business, and there is no locatable (at our offices anyway) documentation, user guide, etc for the device.

    If the gateway ip address is 10.0.0.4, should I reach a sign-in screen for the device's admin panel by entering 10.0.0.4 into a browser window?

    Otherwise, I would have no idea how to interrogate the device to ascertain if there is a duplicate mac address.

    Or is there an easier way?
     
  19. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    The physical address reported by ipconfig is the MAC address. Arp cache will not show you the MAC address of the local machine, only the remote machines you have communicated with recently.

    The netmask has to be the same on all machines (well, it doesn't have to but we'll assume your network was not set up by a sadistic loony). You should set the mask on the pesky machine to match the netmask of the working ones.

    Yes, you can try browsing to the gateway. Also, try the https:// address. If those don't work, telnet to the thing. And of course there may be a web service on some weird port - run a portscan on the gateway to find all open ports.

    All those possible configuration interfaces will be password protected. You should try to find out the password or look up some manuals from the web to find out the factory default pass.
     
  20. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    you got right. Give it a try as '10.0.0.4/' ie w/o the http://
    You're going to or at least OUGHT to have a login/password issue.
    IF this occurs, then you're on the road to managing the device, but
    you'll need to schedule an I/N outage with the users.

    Find the little button for REST on the router, HOLD depressed for
    5-10 seconds, then wait until the lights resume 'normal' (the device
    should have rebooted and traffic resumed).

    now you can use the default user/password - - have fun guessing

    with such a limited network, it would be worth it to invest in another router!
    you need to be able to CONTROL the outcome rather than be a victim
    (not that you are, but certainly not YET in control either -)
     
  21. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    all computers have different mac addresses.

    Given that it happened to two different machines a couple of weeks apart, it would seem to me to point to some external influence. Could a virus have done this?

    If so, what is the best way to locate it? If not, what then? TIA
     
  22. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    re: virus: not likely ... just too complicated.

    one last suggestion before I head for the bar, move the failing computer
    to the switch with only one port in use to see if the symptoms change.

    Please confirm that you are still using STATIC IP addressing OR
    have gone to DHCP. Without access to the router configuration, I suspect
    STATIC is your only choice.

    I'm running out of ideas here ... sorry
     
  23. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    Jobeard, thanks for your help and please follow this thread in case something gels during subsequent posts.

    Nodsu, the post above seems a good place to work from. Not sure I understand the fruitcake part, but you seem to have isolated the potential variables. What should I check next?
     
  24. Odyssey

    Odyssey TS Rookie Topic Starter Posts: 23

    Jobeard, yes still using Static address
     
  25. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...