Internet connection has disappeared on 2 of 4 computers?

[Odyssey]

In our office we have 2 XP Home, 1 W2k, and one ME computer. Suddenly one of the XP's and the ME just do not want to find the Internet.

I have run "ipconfig -all" on each and each returns their dns server ip #''s and their own ip #'s (10.0.0.4 in one case, and 192.168.0.? [can't remember], and if I recall correctly the ip # of the default gateway, but not much else. When I get to the office, I can correct or supplement this, but want to get a dialogue started.

BTW, the 4 computers do not talk to each other, they just share the lan for Internet access.

What steps should I take to figure out why they have stopped communicating with the Internet?

 

[Nodsu]

"find the internet" means what?

Can you ping the gateway? Can you resolve names? Can you ping stuff on the net?

 

[Odyssey]

Thanks for yours.

"Can you ping the gateway?" I believe so in each case, but will double check when I get to the office, and confirm.

Can you resolve names?" Does this mean if I put in www.msn.com, do the browser return the msn webpage? If so, no.

Can you ping stuff on the net? No, it times out.

OE times out when I try to receive mail.

 

[RealBlackStuff]

Have a look at the attachment here:
Basics-networking

 

[DelJo63]

I have run "ipconfig -all" on each and each returns their dns server ip #''s and their own ip #'s (10.0.0.4 in one case, and 192.168.0.? [can't remember], and if I recall correctly the ip # of the default gateway, but not much else. When I get to the office, I can correct or supplement this, but want to get a dialogue started.

BTW, the 4 computers do not talk to each other, they just share the lan for Internet access.

describe the wiring and access to the internet.

Basically, we expect all systems to be in the same subnet
eg: 192.168.0.x ... thru 192.168.0.z
for sure the 10.0.0.4 is inconsistent with 192.168.0.x

start with the system which makes the connection to the internet.
use the ipconfig /all and you get the IP address, Gateway address, subnet mask and DNS address.

ICS will have issues, but the GW, Mask, DNS will all be the same.
all IP addresses must be unique.

 

[Odyssey]

This is a little complicated, so pls bear with me (and do keep in mind that you asked). We have our Internet feed via a microwave link. The "modem" for the feed is either a two port router or feeds into a two port router. (This is 3-4 years old commercial equipment).

One of the two ports goes to a WiFi gateway (this is the Nomadix which you will see below) and access point for our customers.

All of the above is OK.

The other port feeds to a 4 port switch. One port is used by one executive office for INet access. It is also OK.

A second port of that switch feeds the admin office where there are four computers (also all connected via a switch in that office and these computers are connected to the switch with ethernet.) There are two XP Homes and the ME machine (The fourth computer there runs W2k but only accesses the Internet once a month to update the accounting tax files, so we can disregard it for the moment.)

I would again stress that none of these computers talks to each other, so unsure if the different starting group (10. vs 192.) is relevant. They only use the lan to reach the Internet.

The ME machine only exists to act as a sort of file server to our internal TV system. We have a sat feed for normal TV programming and devote one channel to our internal slide show. The slide show actually runs on our website as www.websitename.com/tvshow.htm so this computer logs onto the Internet to this URL and feeds the "download" into our tv system. This one was the first to suddenly become unable to find the internet. It is now disconnected with the cover off in the exec office where I am setting it up to see if it will somehow reach the Internet from here. (The old turn it off and back on theory of hope!)

One of the two XP machines then decided it couldn't connect to the I/N either.
For this computer, "ipconfig -all" NOW (another person has been fiddling) yields 0.0.0.0 for its IP address and subnet mask, absolutely nothing for the default gateway (not even a zero) and 255.255.255.0 as the DHCP server. Have no idea how to get it back to normal.

For what it is worth, the computer in the exec office that this is being written from, yields from ipconfig:

Host Name . . . . . . . . . . . . : systems
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : nomadix.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : nomadix.com
Description . . . . . . . . . . . : Realtek RTL8139(A) PCI Fast Ethernet
Adapter
Physical Address. . . . . . . . . : 00-50-70-B6-74-B6
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.0.0.112
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.4
DHCP Server . . . . . . . . . . . : 10.0.0.4
DNS Servers . . . . . . . . . . . : 12.145.12.2
12.145.12.3

Now totally confused. How about you?

 

[Odyssey]

Restarted the reluctant WXP computer in the admin office and did another ipconfig. Now shows:

and noting only those things different from the ipconfig listing above that are significant (e.g. not mentioning the adapter address, etc.)

Node type: UNKNOWN

"DNS Suffix Search List. . " ENTIRE LINE IS MISSING

Connection-specific DNS Suffix . : NOTHING SHOWN AFTER THE COLON
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
AUTOCONFIGURATION IP Address. . . . . . . . . . . . : 169.254.229.6
Subnet Mask . . . . . . . . . : 255.255.0.0 (note that the 3rd .255 is now .0)
Default Gateway . . . . . . . . . : 10.0.0.4
DHCP Server . . . . . . . . . . . : 10.0.0.4

When attempting to ping 10.0.0.4 , it yields the message: "Destination Host unreachable"

 

[Odyssey]

I saw this in a W2k thread:

"You are probably current with W2K-updates.
For a while now, MS has had its own W2K driver-update for Realtek NICs. Only problem is: a working NIC no longer works after M$ -update!
So, if you have installed that update, uninstall it and use the original driver from W2K itself. I fell into the same M$-trap and it took me ages to figure it out."

Could the prob with the XP computer be similar or the same? (Don't know when it was last updated as I don't use that puter.)

 

[Nodsu]

The 169... address means the computer is unable to get an IP address through DHCP.

To eliminate any DHCP issues you go to the TCP/IP settings and give the computer an address manually. Make the IP address, the gateway and netmask match the rest of your working machines (IP address starts with 10.0 when you have netmask of 255.255.0.0). Make the DNS servers the same you have on the other working computers. Disable any software firewall.

Now that we have gotten autoconfiguration and stupid programs out of the way it is time to test the network. Ping the gateway. If it works, then yay. If it doesn't work then either the gateway doesn't like your computer or Windows TCP/IP system is impersonating a fruitcake or you have a problem with ethernet.

We test if ethernet works by looking at the arp cache. Since you pinged the gateway we should have the MAC address of it cached. Run "arp -a" from command line and see if you have the gateway machine listed. If the gateway's MAC address is there (no need to check it, it is probably correct) then the ethernet works. If not, then you have an ethernet connectivity issue - check cables, switch ports, link lights, duplex settings.

If ping worked, then we have a functioning LAN. Time to try to resolve some names. Run "nslookup www.google.com". You should get the IP address of some Google server.

If you got the IP address back then it means we have a browser issue.

Post back and tell us how did it go.

 

[DelJo63]

Restarted the reluctant WXP computer in the admin office and did another ipconfig. Now shows:

and noting only those things different from the ipconfig listing above that are significant (e.g. not mentioning the adapter address, etc.)


DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
AUTOCONFIGURATION IP Address. . . . . . . . . . . . : 169.254.229.6
Subnet Mask . . . . . . . . . : 255.255.0.0 (note that the 3rd .255 is now .0)
Default Gateway . . . . . . . . . : 10.0.0.4
DHCP Server . . . . . . . . . . . : 10.0.0.4

the 'AUTOCONFIGURATION IP Address. . .: 169.254.229.6' is an IGMP address
and will not route thru to the 10.0.0.4 gateway which leads to the
NOT REACHABLE condition. Strange that the 10.0.0.4 gets found but
an IP address is not set. DHCP normally sets the three addresses in the sequence
..IP address, Gateway Address, DNS address.

on this machine
use Start->Run and enter
ipconfig /flushdns and hit enter
command window will appear and then disappear; that's ok

then try manual intervention, rebooting, and resetting for DHCP. by this i mean
go to Network connections->right click Lan Connection->right click to properties
go to the TCP/IP entry
click properties
on the general tab
under Use Following IP and enter:
.. IP address 10.0.0.127
..subnet 255.255.255.0
..Gateway 10.0.0.4
under Use Following DNS enter
..12.145.12.2

and reboot the box. it may be operational BUT you now have a STATIC
IP address. This will require that the 10.0.0.127 is unique to this box
and no system now or in the future will duplicate it.
You ought to make life easier by staying with DHCP.

You can try pinging other 10.0.0.x systems which ought to work,
as well as pinging the DNS 12.145.12.2, and if all's ok, the browser should
run fine. This will confirm the NIC can be configured for full routing to your
Internet feed via the microwave link.

To restore DHCP, chase the click sequence above and
select Use Dynamic IP Address and Dynamic DNS
click ok to close
wait 30 seconds and confirm the address changes via
cmd /k ipconfig /all

please report your findings

 

[DelJo63]

might like to see
http://www.michna.com/kb/WxSP2.htm
under the topic 'IP address 169.254...—Winsock corruption'

 

[Odyssey]

OK, firstly, very grateful for your continued support. The last posts from each of you was very instructive and I think, productive. see further.

Changed the various ip#,dns,subnet, etc as recommended on the XP puter and gave this computer the ip address of 10.0.0.113. It produced what you would expect with ipconfig -all.

I can now ping the other XP machine on the same switch (10.0.0.74) and the one in the other office (10.0.0.112) successfully, but not 10.0.0.4. It timed out. Ran arp -a but it did not yield the mac # (I guess because it did not find it?) and even though this was unsuccessful, went ahead and ran the nslookup so that I could report back here. It said "Can't find server name for address 12.145.12.2", then the same for .3 (This is a little confusing to me cause it sounds like it could find either dns server rather than google?)

Thinking further on this, I assume that my ethernet card and connection to the switch are OK since I can ping other puters. And another puter on the same switch can ping the gateway. So I am guessing that I have some sort of configuration issue that prevents me reaching the gateway or something else has gone wrong (but what I have no idea)?

Progress, I think! What next?

 

[DelJo63]

I can now ping the other XP machine on the same switch (10.0.0.74) and the one in
the other office (10.0.0.112) successfully, but not 10.0.0.4.

is this to say you can ping everything except the gateway 10.0.0.4 or
only the systems directly attached to the same switch?

the attachment is how I read your network. pls confirm or correct and repost here.

It timed out. Ran arp -a but it did not yield the mac # (I guess because it did not find it?)
and even though this was unsuccessful, went ahead and ran the nslookup so that I could report
back here. It said "Can't find server name for address 12.145.12.2", then the same for .3
(This is a little confusing to me cause it sounds like it could find either dns server
rather than google?)

yea, if you can't reach the gateway then the DNS beyond it is not visable either.
I note that 12.145.12.2 belongs to AT&T Worldnet; this is a public DNS
and not in your domain.

Normally, the modem will have the gateway and DNS addresses from the ISP,
your router would provide DHCP for all NICs attached downstream, and thus
the systems would see a gateway and dns address copied from the ISP.

Another reasonable configuration is the router's address is used as
the gateway and dns addresses with a unique IP address given to all subsystems.
the router then fowards all requests it receives to the ISP.

The path of
modem -<c>router<L> - <C>switch(A) - <C>switch(B) -- <L>systems

suggests <C> cloned MAC addresses vs <L> dhcp assigned addresses
and there should be no problem routing to the modem and beyond, yet
there seems to be.

Back to basics: what changed?
Are the i/n accessible systems all attached to switch(A) and all failures
to switch(B)?

 

[Odyssey]

I can ping every other computer from the reluctant one, including the single one in the other office (which you may recall is using port #1 of switch #1 with all of the other computers downstreamed from port #2 of switch #1, and they all share switch #2). Just can't ping the router (10.0.0.4)

Interestingly, the single computer (above, and this is the one I use for these postings) in the exec office can ping the router and all of the other computers except the reluctant one. Even more interesting, the first time I pinged it (the reluctant one, now 10.0.0.113) from here, it returned a reply on the first of the four tests, and has timed out on every attempt thereafter (including attempts 2-4 of that first ping test.)

Also every computer save the reluctant XP and the older ME which is not at the moment fully assembled can reach the internet with no trouble. FWIIW, the ME puter has exactly the same prob as the XP machine but developed it several weeks earlier.

So the hardware on the reluctant computer works, but it doesn't want to know about the router, or the router doesn't want to know about it! Now to figure out why?

I hope this answered your question clearly? What now?

 

[Nodsu]

A thing that should never happen in theory, but does in practice is duplicate MAC address. You should check the MAC addresses on the computers and make sure they are all different.

Also, look over the gateway settings - maybe someone has imposed a MAC address filter.

 

[Odyssey]

Make the IP address, the gateway and netmask match the rest of your working machines (IP address starts with 10.0 when you have netmask of 255.255.0.0). Make the DNS servers the same you have on the other working computers.

Nodsu, in rereading the above, I recall that the other computers (which are all 10.0.0.xyz) are 255.255.255.0 instead of the 255.255.0.0 that the reluctant puter changed itself to. Are you saying that if 10. etc is used, then the subnet should be .0.0 instead of .255.0, and if so should I change all of the computers? Since they are all working OK, I would assume not, but just thought it worth checking on this.

We test if ethernet works by looking at the arp cache. Since you pinged the gateway we should have the MAC address of it cached. Run "arp -a" from command line and see if you have the gateway machine listed.

and

A thing that should never happen in theory, but does in practice is duplicate MAC address. You should check the MAC addresses on the computers and make sure they are all different.

The mac addresses returned by "arp -a" are for gateway (first) and the sending computer (second)? Yes? (Just want to make sure I know how to check the computers' mac addresses.) I also note that the "physical address" returned by "ipconfig -all" is different from each of these and so assume that this particular "physical address" is not the mac address. What is it the address of?

BTW, since the other computers can ping the gateway OK, can I assume it is not likely that "someone has imposed a MAC address filter"? Or might the other computers somehow have adapted to such a change? Incidentally, what is a "MAC address filter"?

Will check these when I get to the office and report back.

Thanks again.

 

[DelJo63]

each NIC has a unique serial called a M.A.C. and is burned-in at mfg time.
TCP software allows one NIC to masquerade as another.

MAC filtering is a means used to ensure only known NICs are allowed to
produce traffic downstream from the filter (one form of firewalling). There are
two ways it can be used, white list(allow only these) and
black list (exclude only these).

So your system could be in trouble by:
a duplicate MAC or a MAC Filter white list

 

[Odyssey]

Jobeard,

This is going to be tough to determine as the gateway in question is several years old, bought prior to my purchase of the business, and there is no locatable (at our offices anyway) documentation, user guide, etc for the device.

If the gateway ip address is 10.0.0.4, should I reach a sign-in screen for the device's admin panel by entering 10.0.0.4 into a browser window?

Otherwise, I would have no idea how to interrogate the device to ascertain if there is a duplicate mac address.

Or is there an easier way?

 

[Nodsu]

The physical address reported by ipconfig is the MAC address. Arp cache will not show you the MAC address of the local machine, only the remote machines you have communicated with recently.

The netmask has to be the same on all machines (well, it doesn't have to but we'll assume your network was not set up by a sadistic loony). You should set the mask on the pesky machine to match the netmask of the working ones.

Yes, you can try browsing to the gateway. Also, try the https:// address. If those don't work, telnet to the thing. And of course there may be a web service on some weird port - run a portscan on the gateway to find all open ports.

All those possible configuration interfaces will be password protected. You should try to find out the password or look up some manuals from the web to find out the factory default pass.

 

[DelJo63]

If the gateway ip address is 10.0.0.4, should I reach a sign-in screen for the device's admin panel by entering 10.0.0.4 into a browser window?

you got right. Give it a try as '10.0.0.4/' ie w/o the http://
You're going to or at least OUGHT to have a login/password issue.
IF this occurs, then you're on the road to managing the device, but
you'll need to schedule an I/N outage with the users.

Find the little button for REST on the router, HOLD depressed for
5-10 seconds, then wait until the lights resume 'normal' (the device
should have rebooted and traffic resumed).

now you can use the default user/password - - have fun guessing

with such a limited network, it would be worth it to invest in another router!
you need to be able to CONTROL the outcome rather than be a victim
(not that you are, but certainly not YET in control either -)

 

[Odyssey]

all computers have different mac addresses.

Given that it happened to two different machines a couple of weeks apart, it would seem to me to point to some external influence. Could a virus have done this?

If so, what is the best way to locate it? If not, what then? TIA

 

[DelJo63]

all computers have different mac addresses.

Given that it happened to two different machines a couple of weeks apart, it would seem to me to point to some external influence. Could a virus have done this?

If so, what is the best way to locate it? If not, what then? TIA

re: virus: not likely ... just too complicated.

one last suggestion before I head for the bar, move the failing computer
to the switch with only one port in use to see if the symptoms change.

Please confirm that you are still using STATIC IP addressing OR
have gone to DHCP. Without access to the router configuration, I suspect
STATIC is your only choice.

I'm running out of ideas here ... sorry

 

[Odyssey]

it is time to test the network. Ping the gateway. If it works, then yay. If it doesn't work then either the gateway doesn't like your computer or Windows TCP/IP system is impersonating a fruitcake or you have a problem with ethernet.

Jobeard, thanks for your help and please follow this thread in case something gels during subsequent posts.

Nodsu, the post above seems a good place to work from. Not sure I understand the fruitcake part, but you seem to have isolated the potential variables. What should I check next?

 

[Odyssey]

Jobeard, yes still using Static address

 

[Nodsu]

From these variables, you can try putting another network card in that computer and fixing WinSock: http://www.tacktech.com/display.cfm?ttid=257