One Computer on Wired Network Disconnects

Hi everyone,

I've seen this topic all over the place, but still haven't found a solution that works for me.

I'm having a problem with one computer on a network. It seems like it's disconnecting randomly, mostly between 9pm and 12am. When it disconnects, repairing the connection solves the problem until it happens again.

It's an older computer running Windows XP Pro. All of the computers on the network obtain ip addresses by DHCP. I've compared the ipconfig on all PCs and all the information is consistent across the network.

The network is pretty standard. It comes into a router, then to a switch, then to the four PCs in the office.

The local network is fine. When the culprit PC disconnects, I can still ping all the other computers, but cannot ping Google or any other site. I can also ping the computer that's losing it's connection from any of the other computers on the network. Internet works fine on all other computers when this one loses it's connection.

This computer is in a radio studio. It is the on-air computer, so it is absolutely never used for web browsing, but DJs in two remote studios transfer files into the on-air automation system using GoToMyPC.

No changes have been made in the network to cause this to start happening.

Here's what I've tried:

-Reboot all network equipment
-Replaced cat 5 cable
-Tried a different port on the switch
-Tried connecting directly to the router
-Uninstall/Reinstall/Upgrade on-board network card driver
-Installed PCI NIC card
-Winsock & TCP/IP stack repair
-Set up power management options so the card is always on
-Set network speed to 10/100 full duplex
-Ran XP's network diagnostics test and fixed problems with DNS servers - dropouts continued the next night
-Ran every relevant type of test I could find on Windows - all came back ok
-Used NETSTAT to verify that the only connection attempts were authorized. All were GoToMyPc

I think that's everything. The only obvious thing I haven't tried is scanning for a virus or malware. Since I'd have to take the station off the air to do so, I'm waiting until this weekend when not as many people are listening.

If there is any additional information needed, please let me know. Thank you for your help! I'm out of ideas here.

 

I suspect this is a fairly old XP installation, yes? It's been years and years since it was wiped-out and re-installed?

When I get flakey-performance issues (sometimes it works, sometimes not = flakey), I follow everything you'd done and sometimes I've believed my wipe-out and reinstall OS solves the problem.

I do wonder about the Time Frame Limitations, though.

I might try to isolate this unit using a separate firewall product - something like an older version of ZoneAlarm (circa 2008 or 2009) and then I might disable connections into it, but see if it drops itself off-line in your observed time-limit. (I like using the older ZoneAlarms because I know they uninstall themselves very cleanly; newer versions might not, and I don't want to use it permanently or leave any remnant remaining - this is just a testing attempt, after all.)

If there's a virus issue, then some Phone-Home Attack might be either overwhelming the bandwidth, or issuing a restrictive value on it to appear 'overloaded and therefore shutdown'.

I have some subscriptions to paid-for AV services and those allow me to build a bootable CD which I can then use for 'total scans'. This traditionally has been the Be All End All of scans, but in today's world of boot-attacks, nothing is guaranteed. I fear that a Start Up Timer Attack might kick itself off, rename itself into Attack Mode, and then before shutting itself off, it would rename itself back into something innocuous or undetectable. And "attack" might not be the correct term - it MIGHT be a file- or data-transfer 'attack' like someone legitimately dialing in (or the PC, dialing out) and delivering info. Your radio station isn't a Target Store, is it? ha ha

Hopefully, others here will deliver far more specific and useful ideas to you.

 

Why do you have to the take the system off-line to run a virus scan? While you say this XP system is never used for browsing, it is connected to a network that has Internet access. And the DJs (who have Internet access) remote access this system too. That means it is definitely "exposed" to security/malware threats - ESPECIALLY if the DJs (or other networked computer users) visits sites perhaps they shouldn't! rolleyes

I am not a fan of wiping the system and reinstalling. That is always a last resort option because, especially with XP, it puts you YEARS behind in security updates. Plus, you don't learn anything about the problem, or more importantly, how to prevent recurrence - if reinstalling even works - and it often doesn't, especially with hardware issues.

That said, with all that you have tried, you may be getting near that "last resort" stage.

This tells me the "network layer" still works - so again, I would be hesitant to reinstall the OS.

Thinking out loud...

Ethernet cables are fragile, but critical network devices - but you swapped them out.

NICs (including integrated) can go bad - but you tried another, which would force a fresh NIC install and network settings refresh.

Ethernet ports can go bad (be damaged) but you tried a different switch port and directly to the router.

Firewalls can allow "local network" access but block "Internet" access. Have you checked your firewall settings?

If you enter ipconfig /all on two different computers that are connected the same way, you should get near identical results, especially for the IP Address (where first 3 octets should be the same (ex, 192.168.1.xxx), Subnet Mask (ex, 255.255.255.0), Default Gateway (ex, 192,168.1.1), and DNS Servers.

Assigning a static IP address may prevent issues with duplicate IPs on the same network - a problem that sometime occurs with DHCP networks where computers come and go throughout the day.

Have you checked your router logs? ​

Sidenote: "BECAUSE" that XP system is connected to a network that has Internet access, I would urge you most strongly to replace that system BEFORE April 8th when Microsoft ends support for XP. There is already strong evidence badguys are holding back releasing new malware to exploit newly discovered (but not reported) vulnerabilities until after April 8th. And several of the major anti-malware software makers have already announced they will cease support for XP when, or shortly after MS does.

At least get on permanent (written and delivered) record with your bosses and bean counters that all networked XP systems needed to be upgraded to a modern OS (if the legacy hardware is capable and has the necessary driver support from the makers) - or totally replaced with modern hardware and a modern OS. Be sure to tell them too when they balk at being short-notice blindsided that Microsoft announced the April 8th XP End-of-Life date over 5 years ago.

 

Thanks the responses! I probably should've run some spyware and virus scans before posting. I found a bug that was constantly trying to connect to the internet and causing the NIC to shut down. Somebody must've transfrred it in over the network. I found it and removed it, and this old machine's been staying online ever since!

 

I've been trying to get them to upgrade for a long time. In fact, I've been kind of annoyed with them because they'd rather keep having me work on these old beasts than just buying something more modern. It costs them more to pay me to fix these computers than it would cost them to upgrade. Not very budget friendly, if you ask me. But hey, I just work here.

 

There's also the cost of driving you bonkers - pounding your head against a brick wall.

Of course, if you were an auto mechanic, you WANT folks to keep those falling-apart old clunkers rather than get the new ones that will last 3-4-5 years and are then traded in!

Instead of a pocket-protector with 18 colored pens, you need to get one of those gray Texaco Shirts with "TOM" in the name-circle! And get a tub of Gunk, too... offer to shake hand often... ha ha

 

Eh, I have a pretty thick skull by now. My regular job is fixing transmitters and studio equipment. IT is secondary, but I'm pretty used to everyone thinking equipment runs on magic. They never take my advice until something breaks, and then it's all my fault. The things they don't teach you in college, haha.

 

My background is as a radio technician too and I got into IT when I had to tie a SLF radio to a NORAD mainframe. So I hear where you are coming from. We used to call that "magic" "FM", and it was NOT for "frequency modulation" but a certain type of magic!

Anyway - yeah - gotta keep scanning for malware, even if we have real time scanners running. Glad you got it cleaned and sorted with no apparent collateral damage.

Perhaps you can use this malware incident as a little more leverage, illustrating that is an "small" omen of things to come.

Of course. That is EXACTLY why I said above to "get on permanent (written and delivered) record with your bosses."

Assuming you can scrounge up a spare monitor, keyboard and mouse for a new computer, I think you should gen up a purchase request for a new computer. I bet you could build one for $500 - $600 that will meet your needs while keeping you safe from the badguys.