Network Dropout Loss Problem

This seems to be happening lately ever since Windows XP latest updates (I dont recall which one).

Anyways, what happens is that after any of these events (not all the time but usually in an average of every 2 days):

- playing games
- leaving OutlookXP on
- browsing

My network connection suddenly dies. While I am still able to browse IN my own network (I can see my sis and bro's computer and share files). My network connection is totally gone on the net. If I try to check email, it'll fail (no network connection detected). If I try to browse, no network detected too.

The ONLY thing that's a hint of being online still is my AOL's AIM and if I'm in any games (like Battle.Net for Diablo 2 or Starcraft). I can still chat and play games while staying connection to it.

Aside from that... my connection can't connect out at all. If I quit my game and/or AIM, I can't get back in. (AIM gives an ERROR 1).

I am able to ping my own IP and my other computers in my network.

Basically my network is a LAN (with 5 IP address). My SpeedStream router is connected to the LinkSys's Switch.... from there it connects to all my computers (2 WinXP and 1 Win2k). Firewall is only ZoneAlarm Pro (latest update for a month now). IT runs on DHCP.

Does anyone have any suggestions or way to figure out exactly what is wrong with this? The ONLY thing I can think of that's causing this is the latest WinXP security updates.... but I'll need confirmation on this.

Or is there something on my network I didn't set up correctly? (I'm positive I did set it up right).

 

Is there any reason you're running ZoneAlarm? All it is doing, basically, is protecting you from PCs on the LAN. Unless a hacker knows the layout of your internal network, he's not going to be able to invade your system through a router. Basically, if a hacker is good enough to hack through a router, he's good enough to hack through ZoneAlarm.

My first thought is that ZoneAlarm (or WinXP's internal firewall) is interfering with your connection. I would try disabling those, since you're not getting much benefit from them anyways.

Next, try updating your Network Adapter's drivers.

Try a different browser when the error occurs.

Try both nslookup and ping when the error occurs. Perhaps the error is related to DNS rather than TCP/IP.

Try resinstalling IE6.

See if your router has a firmware update.

 

The thing is my router gives out static IP address not universial IP address like 192.x.x.x. Plus it's not running on NAT (it's diabled).

So knowing my IP already means he can probe or anything right (on my computer)?

I'm planning to disable and uninstall ZAP for now and see if that's the case... but that would mean risking having some ports open (which grc.com revealed when I tested it... while most of them are "closed"... even though I perfer "stealth").

Meanwhile, I know it's not the freeware ZoneAlarm because my other 2 computer has it and that "network drop" doesn't effect them (only my computer on the network can't check anything at all).

Everything is updated too.

 

Some corrections.. Static IP's are one's set by you. Universal IP's.. I think You mean IP's given out by DHCP in which case the static IP and the DHCP (so long as you're using a router) will be 192.168.1.x
Never heard of being able to disable NAT.
that's one of the core functions that enables it to "get outside" to the internet. Your Router IS a NAT device.

If you're still able to browse inside your network but not out, then i would suggest making sure you have the lastest firmware for the router. Putting your ISP's DNS entries in your IP config, making sure that your uplink port / cable aren't fookered and that your modem is not on the fritz.

 

About a hacker being able to access your computer if they know your IP address... no, I don't think they can because a router has access control lists and is like a firewall itself. That's why Chicken said you don't really need zonealarm... it's overkill and to be honest, it's useless since you have a router configured.

Access control lists will only allow certain IP addresses to be connected to you. It will block and filter out any that aren't specified in this list. I may be somewhat off in the technical details of it all, but in general this is what a router does.

 

No, my ISP have given me an IP block.... thus I obtain IP:

216.80.19.1 to 216.80.19.6 (as an example). Thus whichever the router detect slot 1 on the switch will get 216.80.19.2, the next will get the next IP, then so forth.

Thus I dont use what normally other people have with broadband and with a LAN (their primary IP is on the router.. while the router gives 192.168.1.x to the LAN computers that's hooked up).

As for NAT disabled... I mean NATP.

I'm asking if it's safe to keep ZAP off... since doing the grc.com test (easy way to probe test).... all my ports are "CLOSED" and some are "OPEN" (135, 139, 445, 1025). Of course as opposed to ZAP keeping all in Stealth. If it's open.. then it's vulerable right?

 

OK, so you have live IPs, meaning your router isn't any more of a security device than the Internet itself.

I would recommend configuring your router not to accept new connections on ports 1-1024 (with the possible exception of 113) from the Internet. I don't know how your router is set up, but I know you can do that on Cisco routers. Basically, you should secure the router so you don't have to secure the network behind it. That's basic network design. If not, you should probably stick with ZA Pro. You might want to try a different firewall program just to see if it works. Try Sygate Personal. The Pro version is paid, but IIRC the non-Pro version is free. You could try Kerio, too, but I didn't like that one myself.

As far as why you drop random connections, I can't say. I mean, you can try random things like a different NIC, or try a Linksys NIC driver built into Windows (they work for 95% of NICs), or you could put your NIC in a different PCI slot. You can try a different patch cable (make sure yours isn't bent too far and the insulation is intact). Try a different port on the switch.

If you can't reproduce the error, it is really tough to say. There's too many places something could mess up. You've got the whole OSI model to troubleshoot on top of Windows.

Something about battle.net and AIM still working makes me think it is a DNS thing, though. Next time it happens try to ping both www.google.com and 216.239.41.99. That's the IP address for that domain name.

 

Cool.

Thanks for giving me the confirmation I was worried about. So it's called "Live IPs".. lol (I never knew the term ).

Right now, I have disabled DHCP and maually confirmed the IP/subnet/gateway address on all the computers on my network (it seems DHCP usually gives the IP out on the 1st come 1st serve basis.. and even though I did Map the IP to specific computers [I want my computer to stay on one static IP], it sometimes conflicts with each other, some other computer would want to steal my mapped IP).

I'll test run against with ZAP again and see if there's any problems. If it happens again, I'll try using another firewall and see.

Yea, there's way too much stuff to troubleshoot.... right now I'm just depending on sheer luck that it's either ZAP (of the latest update which is screwing it up) or WinXP's latest critical updates which I've installed (I'm feeling towards the IPv6 update)

Thanks to giving me more insights on the situation.... really appreciated it!

PS- I really dont want to go through the OSI model on troubleshooting..... too much trouble

 

dropouts

same problem i think,running 2 comps through netgear router,at times try to browse &just dissapears or cant find page,icq wont connect or outlook,but can connect to game server?same problem on both computers,other comp can connect to icq but nothing else.any ideas?

 

you know what I had to do was to put the DNS servers in my IP config even though the router had acquired them.

 

Anyways, bad news ppl....

I got the Network Drop still... only my AOL's AIM is online (I can talk and stuff) but anything else can't access anywhere at all (workgroup or online).

I dont have any firewall and my network setup is:

DSL Modem -> Linksys's switch (4 slots)

which then I'm connected to slot 1, my sis's slot 2, my bro's slot 3.

Each of us have our own real IP static address which is manually configured in the TCP/IP (DHCP and NATP are disabled).


The only solution to fix this problem is to reboot (works all the time) or disable TCP/IP and re-enable it (and hope that works).

Is there way possible way or anything that could be causing the network drop (or something that can help me identify the problem)?

 

Your TCP/IP stack get's hosed constantly? Doubt that's an option, does AIM use UDP or TCP? Have you thought of/tried reinstalling the OS/TCP/IP stack?

 

I just uninstalled and then reinstalled my NIC driver (which also includes the TCP/IP), so hopefully that will fix it.

Maybe it's a twirk "effect" from updating from Microsoft's latest patches (those network securities). Like those similar symptoms when some programs doesn't work (like those CD burning programs and stuff) after some Windows update.

I'll inform again if it happens again.

So yes, I can confirm it's not ZAP at all that's causing it..... the cause is still "unknown".. lol. All I know is that I can confirm it's one of the Window's security patches that deals with networking that caused it (which one I can't tell, because I installed 3-4 of them on that day).

PS- Me using Sygate Pro now, going to see how well it is (so far I love it... although ZAP has an easier interface).

 

Anyways, it's _STILL_ happening. I honestly have no idea wtf is going on.

Also, I check the Event Viewer (System) and here are a few info maybe that may clue in?

10:58:33 PM Source: MRxXmb

the rest are applicates I just started shutting down: (in order)-

1) The GhostStartService service terminated unexpectedly. It has done this 1 time(s). [Ghosts2~.exe] (something like that)

2) The NVIDIA Driver Helper Service service terminated unexpectedly. It has done this 1 time(s). [CTHelper.exe]

3) The Symantec Event Manager service terminated unexpectedly. It has done this 1 time(s).

After that (during one of those 3 application on my Task Manager shutting down) my network was working again.

Anyone got any clue or so?

EDIT: By chance, since I manually given and assign each computer it's own live static IP/subnet/gateway, etc.... I should disable DHCP on my dsl modem right? (I was thinking that could be conflicting)

 

Master browser election process is normal Windows behavior. The master browser is generally the computer with the PC on the LAN with the highest uptime. That computer acts as sort of a WINS server, keeping a record of every NetBIOS name it has encountered on the network. Every so often a PC might promote itself to master browser when there already is one. In this case, they have an election about it when they find each other. The winner stays the master and the other one stops being the master. Strange, rather useless network traffic, but not likely the cause of your problem since it is NetBIOS related.

GhostStartService is some part of Norton Ghost. Not sure what it does, and quick google turns up very little.

NVidia Driver Helper Service. Feh. This is some service nVidia installs to do something when you install one of their drivers. As near as anyone I know can tell, it does nothing at all except rot in memory. I disable it entirely from Administrative Tools/Services.

Symantec Event Manager provides logging specific to your Symantec/Norton firewall or anti-virus program. All it does is logging, as far as I can tell, so it's abnormal termination is probably nothing to get worried about.

You might try stopping/disabling each service from Administrative Tools/Services in turn to see if it solves your problem. Don't see why it would, but there is something odd going on.

As for DHCP on the dsl modem, you can leave it on or turn it off. It is a service running on the router that isn't responding to requests anymore, but it isn't a security issue. A DHCP daemon shouldn't generate any network traffic without any hosts. Of course, you should have no problems disabling it, too.