No access to a website on my LAN, but can view on same laptop on different network

Renno

Hi,

Thoroughly bamboozled over the weekend.

Running Vista on a couple of laptops, though a Linksys WRT54G with Tomato firmware. Bullguard firewall, and a ntl/upc connection

I've lost access to a website (and it's control panel) that I administer (http://www.leinster.cc) on my home network. All other websites are accessible. The website and cpanel are working (others have accessed them). I can access the sites on other networks on the same laptops.

With all firewalls turned off, I get the same problem. UPC can access the site from their end, so it doesn't seem to be an ISP problem. The firmware on the router is pretty straightforward, and nothing is blocked at that end.

I've used IE, Safari as well as the normal Firefox, all to no avail. I've deleted all history etc from FF. I've cleared the DNS cache. I've released and renewed my IP address, and then changed to a static IP address. it doesn't help.

The trace is as below.

C:\Users\******>tracert leinster.cc

Tracing route to leinster.cc [217.115.112.134]
over a maximum of 30 hops:

1 4 ms 2 ms 2 ms 192.168.***.***
2 * * * Request timed out.
3 8 ms 8 ms 11 ms 089-101-162081.ntlworld.ie [89.101.162.81]
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * ^C

Has anyone any suggestions? There is a worryingly deep hole in the wall due to the banging of my head. Have I missed something stupidly obvious?

Many thanks,

Paul

Moriarty

It's fine here on my upc connection, site loads grand.

C:\>tracert leinster.cc

Tracing route to leinster.cc [217.115.112.134]
over a maximum of 30 hops:

2 * * * Request timed out.
3 7 ms 7 ms 12 ms 089-101-162081.ntlworld.ie [89.101.162.81]
4 6 ms 7 ms * ie-dub01a-ra4-xe-0-2-0-0.aorta.net [213.46.165.81]
5 10 ms 9 ms 9 ms 213.46.165.46
6 19 ms 9 ms 8 ms 089-101-166166.ntlworld.ie [89.101.166.166]
7 8 ms 9 ms 26 ms megalinux.fastsecurehost.com [217.115.112.134]

Trace complete.

Is it working for you at the moment? Maybe UPC had a hiccup somewhere in their network.

Renno

Thanks. Still no luck here, so that at least rules out the UPC option.

Moriarty

Get in touch with upc support and ask to be escalated to report an ip routing issue.

Your trace route is reaching upc but failing somewhere in their network, which implies that they have something wrong somewhere.

Renno

Of course the one thing I stupidly forgot to do is plug into the modem, bypassing the router. That works, so it would appear to be a router problem. Anyone use Tomato firmware on the Linksys WRT54G?

Some_Person

Make sure there is no IP Filter on in the router blocking some websites etc. Can't think of any other reason why it doesn't work.

Renno

Nothing so simple unfortunately. There are a few other examples around - this one http://www.linksysinfo.org/forums/showthread.php?t=56504&highlight=blocked+site is identical to me.

Alun

Renno wrote: »

Of course the one thing I stupidly forgot to do is plug into the modem, bypassing the router. That works, so it would appear to be a router problem.

If so, then could it be an MTU problem?

http://www.kitz.co.uk/adsl/MTU.htm

Renno

In fairness I had the MTU at 1300 on the router, and hadn't changed it on the registry. Changed to 1472 (pingable properly) on laptop and router, but still www.leinster.cc not accessible

Gavin

Do a packet dump and see if you are getting back any ICMP error messages when you try to connect to using HTTP. Might get a bit more info from that

otherwise, just replace the firmware on the router?

Renno

Thanks Gavin.

I've reflashed back to the original Linksys firmware today (although it hasn't made any difference)

I'm using SmartSniff, but I don't seem to be getting anything back when accessing the site (either TCP,UDP or ICMP). There're plenty of responses for other sites. Does that make any sense, and am I doing the right thing?

FruitLover

Alun wrote: »

If so, then could it be an MTU problem?

Wouldn't explain the traceroute fail.

It's a weird one! If you bypass the router, does the traceroute succeed? And HTTP access? Are you running any routing protocols on the router (e.g. RIP)?

Renno

C:\Users\*****>tracert www.leinster.cc

Tracing route to leinster.cc [217.115.112.134]
over a maximum of 30 hops:

1 * * * Request timed out.
2 6 ms 6 ms 7 ms 089-101-162081.ntlworld.ie [89.101.162.81]
3 8 ms 6 ms 5 ms ie-dub01a-ra4-xe-0-2-0-0.aorta.net [213.46.165.8
1]
4 8 ms 6 ms 5 ms 213.46.165.46
5 10 ms 7 ms 8 ms 089-101-166166.ntlworld.ie [89.101.166.166]
6 8 ms 9 ms 8 ms megalinux.fastsecurehost.com [217.115.112.134]

Trace complete.

Here'e the trace when connected directly to the modem. Works perfectly, as with everything else.

I'm just running the factory defaults of Linksys firmware v4.20.8, so just the basic setup

Webmonkey

Try installing wireshark and see if any messages come back such as ICMP messages when you do a Traceroute. Might give you a better idea of what is going on.

Gavin

Gavin wrote:

Do a packet dump and see if you are getting back any ICMP error messages when you try to connect to using HTTP. Might get a bit more info from that

Webmonkey wrote: »

Try installing wireshark and see if any messages come back such as ICMP messages when you do a Traceroute. Might give you a better idea of what is going on.

Thread reading FAIL !


Can you observe packets entering and leaving the router ? See if they look different

Renno

I'm slightly outside my comfort zone here, so please bear with me.

Did a trace on www.leinster.cc on Wireshark. The first three ICMP messages (packets 3-5) are time-to-live exceeded, which I presume is common, and just a time out on the trace.

Packet 6 is then sent to the DNS server (OpenDNS). Packet 7 (the reply from DNS) is "Standard Query Response, No such name".

Then packets 8 and 9 are from 192.168.1.101 to 224.0.0.252 and the response is "Source Port 55993 Destination Port: llmnr [UDP CHECKSUM INCORRECT]"

Then there are three NBNS, "Name Query NBSTAT" packets, each followed by ICMP errors "Destination Unreachable (Port Unreachable)"

I'm hoping that that is significant! I can post the whole text file if need be.

Thanks,

Paul

Gavin

Yeah the timeouts are what you'd expect alright, that's how traceroute does its thing.

perhaps disable dns on the traceroute, tracert -d and do a tracert to the IP address, not the domain name, just to eliminate dns as an issue

Renno

Thanks.

I can't really see anything of interest now! Text file of the Wireshark trace attached. Would you mind having a look at it?

Paul

Webmonkey

What IP are you using to trace route to. I don't see anything to do with 217.115.112.134. What happens when you go to 217.115.112.134

Renno

That was using tracert -d 217.115.112.134

This is the response I get in Wireshark when entering 217.115.112.134 in Firefox. Doesn't look right, even to my untutored eye.

Webmonkey

Seems quite a lot of ARPing there....Who is 192.168.1.112, they never seem to respond to your computer with their MAC. Yet it seems to keep trying. You are successfully sending http request to router but you never get a reply. This really is a weird problem considering you can go to other sites successfully.

Renno

On the network I have two laptops, a NAS, three network music players and a printer - but nothing at 192.168.1.112. I can't imagine that is helping anything.

I haven't been able to work out whether it's possible to delete a phantom ip address on a network. Any ideas - and is it possible that is related to my problems?

Thanks again,

Paul

Renno

112 was an old ip address of a printer, that was still being used in the properties of the printer. Now deleted, but it (obviously I suppose) has nothing to do with my problem.

It looks as if whereas with a trace to a "successful" site (eg google), the router sends out a request to the DNS server, for each successful packet throughout the trace, with the "unsuccessful" site (eg leinster.cc), no DNS request is made, before the trace moves onto the next IP address.

Does that make sense?

Webmonkey

Yeah the ARP had nothing to do with it really, but least you got unneccessary traffic on network now by eliminating that.
Now, I'm not surprized a DNS query is done every step as it resolves the host->ip of each hop. However since you don't get anywhere with your traceroute to your site, then it wouldn't have anything to check up.

Have you got any spare Hub (not switch) lying around, you might like to connect a your Router to this and a PC and your modem. With wireshark you should see the ICMP messages going outward, if you do, least you know its working in one direction. You should also see responses destined for the router. This is drastic measures.

Seen that other thread, does seem indeed a problem. Why only one site is puzzling and the site you want most. Have you reset the router?

oh and by the way, can you go to http://217.115.112.133/ - just to see if IP based or IP range based.

Renno

I can get to that no problem. So it's not an IP range problem.

Over the weekend, I've been having more and more problems with the router - generally just dropping out, although it reset the SSID as well at one point.

I have a new router on order - I'll report back later in the week if it solves it. Hopefully it was one (fairly bizarre) symptom of a router dying a slow death

Thanks for all your help - I'll be asking for more if the one doesn't fix it!

Paul

Alun

Renno wrote: »

It looks as if whereas with a trace to a "successful" site (eg google), the router sends out a request to the DNS server, for each successful packet throughout the trace, with the "unsuccessful" site (eg leinster.cc), no DNS request is made, before the trace moves onto the next IP address?

No, you should only see one DNS request, but more than likely it's cached from previous attempts to contact the site so you won't necessarily see it.

Try flushing the DNS cache first (ipconfig /flushdns at a CMD prompt) first, and you should see the DNS requests on your wireshark trace.

This is a strange problem alright. You don't have any static routes defined or anything odd like that on your laptop do you? Or any entries in your hosts file that may be messing things up?

Webmonkey

Alun wrote: »

No, you should only see one DNS request, but more than likely it's cached from previous attempts to contact the site so you won't necessarily see it.

Try flushing the DNS cache first (ipconfig /flushdns at a CMD prompt) first, and you should see the DNS requests on your wireshark trace.

This is a strange problem alright. You don't have any static routes defined or anything odd like that on your laptop do you? Or any entries in your hosts file that may be messing things up?

It's very strange indeed. It's the same for all PC's on the network, it appears to be only on the wireless side the problem is.

Let us know how you get on anyways Renno.

Renno

Finally managed to get the whole network back up and running.

Bought a Linksys WRT160n - had fairly major issues in getting everything up (but won't bore you here!)

Most importantly, access to www.leinster.cc has returned. I can only assume that my WRT54G was slowly degrading in some way, and this was one (very) bizarre symptom.

Thanks for all your help.

Paul

Webmonkey

Glad hear all working again but that was a very strange problem!