Intermittent dns problem

Yes laptop it happened last night I just rebooted and I am back up. Here is ipconfig all
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Rand J Cooley>ipconfig/all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : Rand
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection :

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : LAN-Express AS IEEE 802.11g miniPCI
Adapter
        Physical Address. . . . . . . . . : 00-0E-9B-01-17-DF
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.4
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 209.206.160.254
                                            209.206.184.249
        Lease Obtained. . . . . . . . . . : Monday, March 14, 2005 7:20:04 AM
        Lease Expires . . . . . . . . . . : Thursday, March 17, 2005 7:20:04 AM

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast Eth
ernet NIC
        Physical Address. . . . . . . . . : 08-00-46-CE-A8-62

ok, now show us what it looks like when the connection fails.

cheers.

When you have to restart, can you still ping local devices and/or internet devices?

Try pinging both of the DNS servers.  If one of them is permanently down and the other doesn't respond within the timeout you'll get an error.

You shouldn't have to restart to recover.  Have you tried doing an ipconfig/renew during the outage?

Jeopboy,
Thx for your response no one else has been much help including  meverest. So the deal is that I don't see any difference between being on or off. I am an independent broker and run Esignal that is not attached to a browser but still works when I can't get on with IE6 or mozilla.Which leads me to believe that it is a DNS problem and not connection based.I have pinged a site and got a response. Renew and release have no impact. I think that this is a Sony problem. Let me know what you think.Thanx Rand

>> no one else has been much help including  meverest.

hey - i am trying to help, but you have to do some diagnostics first.  if you can post the ipconfig results when the connection fails, then i can make some further suggestions.

cheers.

Yes I appreciate that ,but look at your first comment "I suppose this a Windows laptop" if you read my comment it clearly states a laptop, if it were linux I would have stated that. I have a connection to the internet but cannot connect via ie 6 or firefox. I have a connection that maintains thru the outage. I appreciate you taking the time to help but  I don't think this is an issue with the connection but with Sony's laptop. I have been all over google and the internet but no one talks about this particular issue.If it were a router problem I would have fixed it by now. I have a bridge running off the same router and it never does this. The computer lost the connection just before I saw your request for new ip data and I will list it but I looked at it before writing into EE and didn't see anything out of the ordinary. It may be the TCP/IP adapter but I don't really think it's a "connection" issue.

Thx
Rand

Hello,

my supposition that it is a windows system is apparently correct.  i said that as precursor to my ipconfig suggestion.  i make this suggestion as a sensible approach to diagnosing the problem.  given the limited information you have provided, it makes sense to check what the laptop thinks is the dns server address - assuming that it is dhcp specified, then i suspect that maybe the lease expires and fails to renew properly.  thus i ask what the ipconfig looks like when the problem occurs.

if you think i am being unhelpful, just say what more detail you want.

Cheers.

I have thought about that too but the lease looks normal when I looked at it when the system went down. It's now been 2 days since it last failed.It is dhcp specified. What do you expect to see if the lease is not being properly renewed? I have looked at the suggestions on the internet but renew and release have no effect.But if we assume that the lease is not being renewed properly what is the fix?What other info do you want?Let me know and I will provide it. I take it your British?

British? only half - my dad was british, I am ozzie.

i have no expectation of what may be evident by the output of ipconfig when failed.  i generally try not to anticipate anything for fear of having preconceived idea of what is wrong and being waylaid by that.

cheers.

Hmmm...maybe a bit more details could help.

When you say "a connection that maintains thru the outage", I assume you're talking about your Esignal application.  Can you also answer these questions on behavior during the outage:

 - Can you ping the DNS servers by IP address?
 - Can you ping the sites by IP address?
 - Can you ping any site by name?

DNS seems like it could be a good guess (your ESignal might be configured to use IP) but this could also be a TCP issue where you aren't able to establish new connections, just maintain existing ones...

Let me know on the above questions and we'll go from there.

Jeopboy- Thx for your help again.It's 9:13am  PST and it went down about 20 min ago and I did not see your email so I didn't ping but I will try your suggestions next time it drops.Here is the ipconfig /all results that meverest requested.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Rand >ipconfig/all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : Rand
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection :

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : LAN-Express AS IEEE 802.11g miniPCI
Adapter
        Physical Address. . . . . . . . . : 00-0E-9B-01-17-DF
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.4
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 209.206.160.254
                                            209.206.184.249
        Lease Obtained. . . . . . . . . . : Monday, March 14, 2005 9:53:44 PM
        Lease Expires . . . . . . . . . . : Thursday, March 17, 2005 9:53:44 PM

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast Eth
ernet NIC
        Physical Address. . . . . . . . . : 08-00-46-CE-A8-62
I didn't see anything out of the ordinary but I ran it twice and the second time it moved the lease expiration to sat from thurs if that means anything .

Meverest here is the data you asked for. I served with the Brits for 3 years in Germany in the late 70's. I assumed you were British because no American would say cheers except before a drink! So let me know what you think about this ipconfig.I did not ping a site when it was down because I didn't think of it.Thx for your help

OK, that rules out DHCP.

pings like jeopboy suggests will be useful.  can you identify the addresses reported in the ipconfig?

what is the deal with the "computer connection via a bridge" - do you mean that the computer ethernet port is connected to a bridge which connects wirelessly to the netgear?

what is the ip address of the desktop pc, and can you access that when your dns apparently fails?

Cheers.

I have seen instances where XP does not properly release old connections and will not make new outbound connections on any port--an existing connection would not be and issue here. In doing some review eSignal appears to use IP to "phone home" instead of DNS, so I would expect that application to continue to work if it is already connected. In situations like that, only a reboot has fixed the problem.

How often does this issue happen and how often do you reboot the laptop (not put to sleep, actually reboot). Also, is this XP home or XP pro?

On a side note, the first thing most any of us will ask is what operating system--I have several laptops, each running totally different operating systems from FreeBSD to Windows 98 to OS X:) The troubleshooting commands are different on each, so knowing which operating system and version is information we really need in order to point you in the right direction. Windows 98 uses the command winipcfg to display TCP/IP information and XP used ipconfig /all--those commands are not interchangeable between the two systems:)

First- I am running xp home on all computers on my network,it is setup with a netgear router 614v1. and wireless connection to my laptop and a desktop and xbox upstairs to a wge101 Netgear bridge via switch and rj45s.
Second-It goes down infrequently I can't discern a pattern. I only reboot when the connection is lost. So before this occured I might go a week w/o shutting down.It went down this Sunday and then again this morning (Mar 16) at 9:10.
Third- Meverest I am not sure which addresses you mean but I didn't see anything unusual in the ipconfig report.I have had this laptop for almost a year and this just started about two mos ago.I suspect susanzeigler is right about win xp and how it handles the connections. What next?

OK, as there are apparently several devices on this network, is it ony the laptop that fails and not any other device?

Is there any other wireless device in the house?  Like a cable tv av range extender or a cordless tepehone handset?  The addresses i refer to previously are those listed in the ipconfig: i assume that 192.168.0.1 is the netgear wireless router - and i suspect that the dns servers would be those of the ISP.

as my understanding of your network setup expands, i am beginning to suspect that it is probably not a dns issue at all, but more likley wireless connectivity between laptop and access point.  not certain - just a suspicion,  If you have considered this already and ruled it out, please let us know what you have done to test that.

cheers.
 

oh, and by the way - i say cheers just before a beer too.  even 8 hours before ;-)

Meverest
Yes it is near phones etc but it is not that. I am not an expert but I am knowledgeable enough to problem solve most issues. As I stated before NO OTHER device does this in the house. The cordless device theory is in most cases overstated (I'm not suggesting you are) but I have found most tech support people don't know what they're talking about and use the interference card. My router sits about  8 inches from my cordless phone and I have never had a problem with it. After reading susanzeigler's comments I am beginning to suspect that it is win xp not releasing the connections and not allowing old connections thru. Believe me I googled this all over the net and did see some talk about this but it wasn't  exactly my problem. I am running xp v1 so it's not an upgrade issue. yes .01 is the router and the others are dns addresses. I have done release and the other cmds that were recommended on various forums. I really thought it was a Sony Vaio laptop problem but I haven't found any similar reports. Hopefully someone will come up with an answer, it's annoying but doesn't stop me from doing business other than like this am I had to shut down and restart.By the way it is not a wireless connection problem the computer is still connected to the router.

randcool

I don't mean to be condescending, but I disagree with you on several points.

1.  The cordless device theory is seldom overstated.  Most domestic wireless devices use the 2.4GHz band, and can and DO cause interference with WiFi connectivity.
2.  What makes you think that the wireless connection is still available?  Just because the wireless client driver says 'connected' does not mean much.  Many of those drivers are poorly lacking in functionality and stability.
3.  No, it is NOT likely to be any XP DHCP thing.  If it were, then you would not necessarily lose connectivity. The ipconfig shows that - you still have an ip address, and the virtual adapter is still active.

randcool, we have asked several times for you to conduct some ping tests.  the results of those will give us some additional clues.  and ping as many locations as you can test (in the following order):

1. ping the local adapter: 192.168.0.4
2. ping the router: 192.168.0.1
3. ping the DNS servers: 209.206.160.254, 209.206.184.249
4. ping the desktop PC: 192.168.0.(x)
5. ping the xbox

the biggest difficulty with an intermittent problem is that it is usually very difficult (a philosopher may say 'impossible') to demonstrate that it is fixed.

regards,  Mike.

I notice you mention XP v.1 does this mean you haven't applied Service Pack 2 yet?

Ah yes, don't we love random intermittancy!!!

From what Rand has said, though, even when he is getting DNS errors, his eSignal application is still working and therefore he does have some level of connectivity.

Mike is correct in what he wants you to test--but I will guess that you wil be able to ping all devices by IP. On the XP machines I have seen issues, it is typically the SMTP porst that I notice it on first, but DNS wouldn't be unusual especially if that is the most common connection type that is made.

susanz - my guess is that he will not be able to ping anything at all.  I suspect that it is ip connectivity failing - probably the link layer is down too, but that the wireless client driver fails to report it.

i also was thinking the same as you for a while because of the comment "All other connections on the network are fine" which i incorrectly assumed to mean that only dns was a problem but that other stuff worked.  now i understand that to mean that only the laptop has the problem but the desktop and the xbox works ok.

randcool - i'd also like to suggest that you check out the router admin interface from the desktop next time the laptop link fails.  most wireless access points will have a function to display the list of connected clients and the signal strength etc.  I'd be interested to know what the router thinks is going on - whether it shows the link as active, and whether the dhcp is active also.

Cheers.

Yea Mike, I guess we do need Rand to verify that. I was reading the "...and run Esignal that is not attached to a browser but still works when I can't get on with IE6 or mozilla.Which leads me to believe that it is a DNS problem and not connection based.I have pinged a site and got a response. Renew and release have no impact." and assuming he meant that was on the laptop when he was having the browsing problems--perhaps that is not the case though, so guess we need clarification on that.

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.4

Pinging 192.168.0.4 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.0.4:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:

Reply from 192.168.0.1: bytes=32 time=1ms TTL=64
Reply from 192.168.0.1: bytes=32 time=1ms TTL=64
Reply from 192.168.0.1: bytes=32 time=1ms TTL=64
Reply from 192.168.0.1: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.0.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

C:\Documents and Settings\Rand J Cooley>ping 209.206.160.254

Pinging 209.206.160.254 with 32 bytes of data:

Reply from 209.206.160.254: bytes=32 time=157ms TTL=62
Reply from 209.206.160.254: bytes=32 time=51ms TTL=62
Reply from 209.206.160.254: bytes=32 time=22ms TTL=62
Reply from 209.206.160.254: bytes=32 time=76ms TTL=62

Ping statistics for 209.206.160.254:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 22ms, Maximum = 157ms, Average = 76ms

C:\Documents and Settings\Rand J Cooley>ping 209.206.184.249

Pinging 209.206.184.249 with 32 bytes of data:

Reply from 209.206.184.249: bytes=32 time=46ms TTL=252
Reply from 209.206.184.249: bytes=32 time=81ms TTL=252
Reply from 209.206.184.249: bytes=32 time=76ms TTL=252
Reply from 209.206.184.249: bytes=32 time=77ms TTL=252

Ping statistics for 209.206.184.249:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 46ms, Maximum = 81ms, Average = 70ms

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.3

Pinging 192.168.0.3 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.0.3:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Here is the ping data. Mike- I am not offended but I have been around data devices all my life and if this were a interference prob I would have experienced it by now.I know I'm connected because I can still bring my esignal data into the laptop. I am not looking at just the lights on the comp.Jeopboy I'm running xpsp1 no updates.This is my trading computer and I don't want to screw it up just yet. I'm not a fan of MSFT.I would have done the ping tests earlier but I thought you meant when the system was down which I will do next. When I go to bed tonight I will leave it on and see if it shuts down during the night.Let me know what you all think.I want to solve this just to accomplish something.

Thx
Rand

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.205

Pinging 192.168.0.205 with 32 bytes of data:

Reply from 192.168.0.205: bytes=32 time=14ms TTL=64
Reply from 192.168.0.205: bytes=32 time=1ms TTL=64
Reply from 192.168.0.205: bytes=32 time=1ms TTL=64
Reply from 192.168.0.205: bytes=32 time=2ms TTL=64

Ping statistics for 192.168.0.205:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 14ms, Average = 4ms

C:\Documents and Settings\Rand J Cooley>

Rand - I'm no fan of Microsoft either, but they screwed up XP sp1 badly enough that SP2 is kind of necessary.

I was looking for results from when the PC is down (and still want to see them), but this is very interesting in and of itself.  

what are the 192.168.0.3 and 192.168.0.205 devices?  It is unusual that you can't ping the local interface or some other local devices.  What is the difference between the ;205 and .3 devices?

I agree that you about wanting to solve this purely because it seems so vexing!!!

I read a bit on eSignal - I didn't see anything about it but the fact theat you can't get to local devices makes me wonder if eSignal is setting up some kind of VPN to bring the data across and possibly hijacking your TCP/IP

By the way, did you see this update about SP2 on the esignal web site:
Aug 04 Update: We have installed Microsoft Windows XP SP2 (Service Pack 2) and have confirmed that eSignal appears to function just fine. Microsoft has added more security into this version so you'll want to be aware of the choices you make during installation. Activating the new firewall and not specifically permissioning eSignal, for ex, will prevent eSignal from connecting to our servers

If we can find nothing else, it at least appears that you would be safe upgrading in an attempt to solve the issue.

Let us know if you can get ping results while the PC is in the error state.  Maybe we'll be able to figure something out.

Thx jeopboy, interesting comment about esignal. I have had it since May so I didn't think it would be the problem but with the MSFT gremlins at work you never know. I will try to upgrade to sp2 this weekend because I am a broker and don't want to be down tomorrow if the upgrade fails. 203 is a laptop and 205 is the bridge it is connected to upstairs.By the way I don't use xp firewall, I have the router and use panda and symantec as a software firewall. I have upgraded two desktops to sp2 but I just don't trust msft anymore. I started to use another forum site and when I found the two idiots that were trying to help were from msft I left immediately and came here and everyone has been very helpful and kind to me.So if it goes down tomorrow or the next day I will try to ping those sites and give you the info.Thx again

well, you have me beat:

>> C:\Documents and Settings\Rand J Cooley>ping 192.168.0.4
>> Pinging 192.168.0.4 with 32 bytes of data:
>> Request timed out.

yet an earlier post shows:

>>        Physical Address. . . . . . . . . : 00-0E-9B-01-17-DF
>>        Dhcp Enabled. . . . . . . . . . . : Yes
>>        Autoconfiguration Enabled . . . . : Yes
>>        IP Address. . . . . . . . . . . . : 192.168.0.4
>>        Subnet Mask . . . . . . . . . . . : 255.255.255.0

where are these pings from?  Do you have the same IP address this time, or does the assigned address change every time?  If so, i would suspect that your router dhcp server may be broken.

Cheers,  Mike.

When a PC can't ping its own adapter, I think it's either a VPN issue or a firewall issue.  Rand has the XP firewall disabled, but the Symantec firewall might be blocking that traffic.

Depending on configuration, VPN clients can create a virtual adapter that intercepts all IP packets and sends them through the tunnel.  

Rand - can you get someone at eSignal to answer the question about whether they establish a VPN tunnel?  In looking at the site, they appear to be using Javascript to maintain the data flow, but it's not clear what the underlying technology is doing to maintain security.

Also, you mentioned that .203 was a laptop, but your ping that failed was to .3.  I assume one of these is a typo.

Finally, before you reboot, take a look at your System and Application Event logs.  Maybe there's some indication of the triggering event in there.

But, if this was an eSignal VPN issue, you would expect it to be more common. I agree it is possible for the tunnel to occassionally hijack the packets, but I would expect to see this behavior happening on a more regular basis.

I definately agree that service pack 2 might solve this issue--I think that we need Rand to tell us if this happens again after he installs the service pack, perhaps the issue will just simply go away. My thoughts are still an XP TCP/IP stack issue, and that is one of the things that SP2 was supposed to make more stable.

Agreed - Good luck this weekend Rand!!!

OK thx for your help I appreciate it very much I will update you once I've run sp2


Rand

Jeopboy and Susanzeigler- OK here we are.I uploaded sp2 Friday night and it worked very well surprisingly enough. So I began to suspect that susanzeigler was right about esignal interfereing with the DNS. So last night I loaded esignal and left it on all night. This morning I  lost my connection twice. I did ping a number of sites and here are the results:

osoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:

Reply from 192.168.0.1: bytes=32 time=1ms TTL=64
Reply from 192.168.0.1: bytes=32 time=13ms TTL=64
Reply from 192.168.0.1: bytes=32 time=1ms TTL=64
Reply from 192.168.0.1: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.0.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 13ms, Average = 4ms

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.200

Pinging 192.168.0.200 with 32 bytes of data:

Reply from 192.168.0.200: bytes=32 time=2ms TTL=30
Reply from 192.168.0.200: bytes=32 time=1ms TTL=30
Reply from 192.168.0.200: bytes=32 time=1ms TTL=30
Reply from 192.168.0.200: bytes=32 time=1ms TTL=30

Ping statistics for 192.168.0.200:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms

C:\Documents and Settings\Rand J Cooley>ping ping204.71.202.160
Ping request could not find host ping204.71.202.160. Please check the name and t
ry again.

C:\Documents and Settings\Rand J Cooley>ping 209.206.160.254

Pinging 209.206.160.254 with 32 bytes of data:

Reply from 209.206.160.254: bytes=32 time=20ms TTL=62
Reply from 209.206.160.254: bytes=32 time=13ms TTL=62
Reply from 209.206.160.254: bytes=32 time=15ms TTL=62
Reply from 209.206.160.254: bytes=32 time=13ms TTL=62

Ping statistics for 209.206.160.254:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 13ms, Maximum = 20ms, Average = 15ms

C:\Documents and Settings\Rand J Cooley>ping 204.71.202.245

Pinging 204.71.202.245 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 204.71.202.245:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\Rand J Cooley>ping www.google.com

Pinging www.google.akadns.net [66.102.7.99] with 32 bytes of data:

Reply from 66.102.7.99: bytes=32 time=34ms TTL=242
Reply from 66.102.7.99: bytes=32 time=33ms TTL=242
Reply from 66.102.7.99: bytes=32 time=34ms TTL=242
Reply from 66.102.7.99: bytes=32 time=34ms TTL=242

Ping statistics for 66.102.7.99:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 33ms, Maximum = 34ms, Average = 33ms

C:\Documents and Settings\Rand J Cooley>ping www.yahoo.com

Pinging www.yahoo.akadns.net [66.94.230.43] with 32 bytes of data:

Reply from 66.94.230.43: bytes=32 time=33ms TTL=53
Reply from 66.94.230.43: bytes=32 time=35ms TTL=53
Reply from 66.94.230.43: bytes=32 time=34ms TTL=53
Reply from 66.94.230.43: bytes=32 time=33ms TTL=53

Ping statistics for 66.94.230.43:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 33ms, Maximum = 35ms, Average = 33ms

C:\Documents and Settings\Rand J Cooley>tracertout
'tracertout' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.200

Pinging 192.168.0.200 with 32 bytes of data:

Reply from 192.168.0.200: bytes=32 time=2ms TTL=30
Reply from 192.168.0.200: bytes=32 time=1ms TTL=30
Reply from 192.168.0.200: bytes=32 time=1ms TTL=30
Reply from 192.168.0.200: bytes=32 time=1ms TTL=30

Ping statistics for 192.168.0.200:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms

C:\Documents and Settings\Rand J Cooley>ping 192.168.0.1
I sent a ping to google and yahoo and it looks like I got a decent response.By the way .200 is my bridge. Let me know what you think I need to do.

Rand

After reading all this stuff, I still think it might be the simple answer...sometimes the bridge drops a few packets.  Sometimes those packets happen to be DNS queries (or replies) and they just get bitbucketed or delayed too long for the reply window.

So, start using the -t option on ping  Try pinging the dns server this way:

ping -t 209.206.184.249

and let it run for 10-20 minutes.   Then Break into it with Crtl-C and look at the statistics.  If you see a bunch of drops or some really long reply times, prolly it's the bridge.

Jon

Jonsh- let it run for at least 10 min no drops or breaks avg response time 30ms.

woah - hang on there:

>> C:\Documents and Settings\Rand J Cooley>ping www.google.com
>> Pinging www.google.akadns.net [66.102.7.99] with 32 bytes of data:

it resolves - that shows that some kind of DNS is working.....  can we go backward a step and can you explain again exactly what is the problem?

and just curious, but why dod you choose this one:

>> C:\Documents and Settings\Rand J Cooley>ping 204.71.202.245

?

Regards,  Mike.

Is that last batch of pings from the time when there were connectivity issues?  As Mike pointed out, there is DNS resolution going on (although it could be cached from an earlier time).

Susan,
No I ran it last nite when I saw the email from Jonsh. I haven't gone down since yesterday but I am leaving my esignal going all the time so if it forcing my DNS down then I want to deal with it as soon as possible.So should I flush the cache?

and just curious, but why did you choose this one:

>> C:\Documents and Settings\Rand J Cooley>ping 204.71.202.245
?  ---------------------------------------------------------^^^^^^^^^^

Regards,  Mike.

Mike saw your post and thought it was a typo, don't remember all the addresses but I think this was a yahoo ip that turned out to be incorrect if that is your point.I pinged what Jonsh suggested.

and I suggested what I believed to be one of your domain name servers :)  Secondary one, if I remember :)

Randcool, we all seem to be missing the point (my personal feeling).  Would you do me a favor? Having looked at all the data and everything you have done, would you try to repost a concise definition of what the problem(s) are?

Jonsh
OK here it is. Periodically, IE6 will return a DNS error, no matter what I try it will not connect. But I can still receive data to my esignal connection.So I still am connected via router etc. What else do you need to know?


Rand

The key thing here is to see what happens on a DNS lookup (or an SMTP session, or something opening a new port, etc.) while the issue is occurring.

So, the next time you get the DNS error in IE and eSignal is still working, try the following:

First, try a ping to a website you would never go to--for giggles, let's just use that of a favorite magazine of mine:
ping www.macaddict.com

That site is pingable. Even if you get a time-out on the ping, DNS SHOULD resolve the site. If it does not, then we know the error is happening. Then try pinging 64.58.168.25. If that works, then we at least know TCP/IP is actively working and able to open new sessions.

Next, try opening a new SMTP connection. This will help tell if it is actually a DNS issue, or if it is a no-available-port issue or some other connectivity problem. In a command window, type:
telnet 64.157.4.78 25

This is one of Yahoo's mail exchangers. IF things are working properly, you will get a connect session that will look something like this:
Escape character is '^]'.
220 YSmtp mta147.mail.sc5.yahoo.com ESMTP service ready

If it can't connect, then we know it is not just DNS that is failing. If it does connect, then we know the issue does indeed relate to DNS.

At that point, we can take it from there.

Susan ok I have printed out your instructions and I will leave Esignal on all the time to force an issue. I will let you know the results as soon as I can

Here is the result of the pings. I just went down at 10:05 after being on all day. I had esignal running when I lost the connection

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Rand J Cooley>ping www.macaddict.com

Pinging www.macaddict.com [64.58.168.25] with 32 bytes of data:

Reply from 64.58.168.25: bytes=32 time=47ms TTL=48
Reply from 64.58.168.25: bytes=32 time=51ms TTL=48
Reply from 64.58.168.25: bytes=32 time=84ms TTL=48
Reply from 64.58.168.25: bytes=32 time=46ms TTL=48

Ping statistics for 64.58.168.25:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 46ms, Maximum = 84ms, Average = 57ms

C:\Documents and Settings\Rand J Cooley>ping 64.58.168.25

Pinging 64.58.168.25 with 32 bytes of data:

Reply from 64.58.168.25: bytes=32 time=46ms TTL=48
Reply from 64.58.168.25: bytes=32 time=49ms TTL=48
Reply from 64.58.168.25: bytes=32 time=45ms TTL=48
Reply from 64.58.168.25: bytes=32 time=85ms TTL=48

Ping statistics for 64.58.168.25:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 45ms, Maximum = 85ms, Average = 56ms

C:\Documents and Settings\Rand J Cooley>telnet64.157.4.78.25
'telnet64.157.4.78.25' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\Rand J Cooley>telnet 64.157.4.78.25
Connecting To 64.157.4.78.25...Could not open connection to the host, on port 23
: Connect failed

C:\Documents and Settings\Rand J Cooley>telnet 64.157.4.78.25
Connecting To 64.157.4.78.25...Could not open connection to the host, on port 23
: Connect failed

C:\Documents and Settings\Rand J Cooley>ping www.google.com

Pinging www.l.google.com [66.102.7.99] with 32 bytes of data:

Reply from 66.102.7.99: bytes=32 time=35ms TTL=242
Reply from 66.102.7.99: bytes=32 time=33ms TTL=242
Reply from 66.102.7.99: bytes=32 time=34ms TTL=242
Reply from 66.102.7.99: bytes=32 time=37ms TTL=242

Ping statistics for 66.102.7.99:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 33ms, Maximum = 37ms, Average = 34ms

C:\Documents and Settings\Rand J Cooley>telnet 64.157.4.78.25
Connecting To 64.157.4.78.25...Could not open connection to the host, on port 23
: Connect failed

C:\Documents and Settings\Rand J Cooley>telnet 64.157.4.78.25
Connecting To 64.157.4.78.25...Could not open connection to the host, on port 23
: Connect failed

C:\Documents and Settings\Rand J Cooley>

So where do we go from here

Thx
Rand

once again, you have proven that there is no DNS problem:

>> C:\Documents and Settings\Rand J Cooley>ping www.macaddict.com

>> Pinging www.macaddict.com [64.58.168.25] with 32 bytes of data:

and at the same time you prove that there is no ip connectivity problem:

>> Reply from 64.58.168.25: bytes=32 time=47ms TTL=48
>> Reply from 64.58.168.25: bytes=32 time=51ms TTL=48
>> Reply from 64.58.168.25: bytes=32 time=84ms TTL=48
>> Reply from 64.58.168.25: bytes=32 time=46ms TTL=48

why do you suspect that eSignal is forcing any problem?

regards,  Mike.

It's what the others thought in discussing the issues. Just now when I went down my esignal connection was still active

the only way to prove it (or not) is to run the thing with no esignal running at all.  if it fails again, then it is not esignal.

cheers.

I have it off now because the market is closed today so I will see what happens but susanzeigler is fairly sure it is esignal.

Actually, it was Jeopboy who thought the issue was the eSignal VPN snagging all traffic.

The fact that you are getting DNS resolution eliminates the DNS issues from the picture. On the telnet test, you didn't do it quite right. It should be:
telnet 64.157.4.78 25
                          ^   note the space, not a "."  This specifies the port to make the connection on.

If you are not able to get an SMTP connection, which is what that test will determine, then we know that the issue is not application specific. If you are, then it is seeming to be either an http port issue or it is a browser-specific issue. I know you mentioned trying with IE6 and Mozilla, have you tried using any other browsers?

As Jeopboy suggested, it may very well be that eSignal is either intercepting port 80 (and possibly port 443) traffic, or it could be a firewall issue. My original thought was that it was XP not allowing any new connections--DNS can still work in that case. If you are able to get an SMTP connection (that is the telnet test) then my theory is eliminated as well.

Ok I see , a space between 78 and 25. I will try that and load esignal again. I have thought about the firewall but when I stop the firewall it doesn't matter.I haven't tried anything other than those two browsers what else is there? I will check my firewall log for port problems.Let me know what else I should do.Thx for your help Susan

Rand

It does appear that there is something going on that is related to the browsers.  Either a firewal is blocking port 80/443 or there is something inside the OS that is not creating new connections.

Rand - when the problem is occurring, can you browse to a site by IP address in the browser?

If you can, then the browser is not handling DNS requests correctly (even though you've shown that DNS is working).
If you can't, then there is likely a firewall or OS issue that is not letting you get out.

Testing the port 25 connection as susan suggested will help isolate things further.

And one more thing to try, since we are thinking browser specific...

When the issue is occurring, in addition to trying the SMTP test, let's have you test port 80 (http) as well.

Type telnet www.google.com 80

This will open a new telnet window. Although it won't actually tell you if it gets a connection, you will see it saying trying to connect. Once connected, that window should stay open and there should only be a flashing cursor in the window with no other writing.

As for browsers, Netscape (which is mozilla based), Firefox, Opera are just a few.

i still think it is worth revisiting the beginning and get a detailed description of the problem.  We have not got anything close to a good description so far, just general non specific comment.  I'd like to know exactly what the error message in the browser is for a start.

also, regarding telnet to port 80, hit the return button a couple of times once the blank screen appears, you should see at least some response fromt he web server.

cheers.

I'm still watching this thread, nothing to add as yet, altho I agree with meverest's comments and Susan's troubleshooting techniques...

Jon

hi, I got to thinking about your comments and looked at my firewall log and it appears that port 80 and 443 show dropped packets on the same day that I dropped the connection. Mean anything to anyone?

Assuming the log is for you going out and not for someone else trying to get in, that is exactly what we were looking for.

How detailed is the firewall log?  Can you correlate the drops with the sites you were trying to reach?

Maybe you could post a snippet here.

I had a dns break this am and I will post what happened to include the event log which will show what the problem has been

anxiously awaiting what sounds like it might be the resolution of this rather long issue!!! ;-)

so where is this firewall running?  do you really need it?  If your router does NAT (which I assume it does) firewall is almost redundant.  what would happen if you turn it (the firewall) off?

Cheers.

Here are the results from today

220 YSmtp mta121.mail.sc5.yahoo.com ESMTP service ready

telnet www.google.com 80
502 Command Unimplemented

451 Connection has unexpectedly been dropped, unable to continue.


second attempt


C:\Documents and Settings\Rand J Cooley>telnet www.google.com 80
Connecting To www.google.com...Could not open connection to the host, on port 80
: Connect failed

C:\Documents and Settings\Rand J Cooley>

Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7034
Date:            3/28/2005
Time:            10:02:24 AM
User:            N/A
Computer:      RAND
Description:
The Symantec Network Proxy service terminated unexpectedly.  It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7034
Date:            3/21/2005
Time:            8:17:03 AM
User:            N/A
Computer:      RAND
Description:
The VAIO Media Photo Server (UPnP) service terminated unexpectedly.  It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7034
Date:            3/21/2005
Time:            6:59:45 AM
User:            N/A
Computer:      RAND
Description:
The VAIO Media Photo Server (UPnP) service terminated unexpectedly.  It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type:      Error
Event Source:      DCOM
Event Category:      None
Event ID:      10010
Date:            3/14/2005
Time:            9:57:33 PM
User:            RAND\Rand J Cooley
Computer:      RAND
Description:
The server {9F92FFA3-40D1-475A-9323-A39C705DAB86} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

I ran the port tests as soon as I went down. I also looked at the event viewer today and saw that there were several errors that occured on the days I went down. It looks like Sony's photo server and symantec's proxy server went down. Also the DCOM went down so what do you think? It's not the firewall when I pinged the ports this morning symantec came up and asked for my approval to let the connection thru. I tried it without the firewall and it still didn't work. believe me it's not the firewall I have 2 other computers running firewalls with no problem.What are your suggestions? WE MIGHT BE CLOSE TO ACTUALLY SOLVING THIS!

Rand

Hi,

well, that all makes sense now.  the problem is almost certainly caused by those virus checkers and so called security services.

The DCOM error is simply a symtom of the symantec service crapping out.  There is a work-around i found here:

http://www.datawisecomputing.com/techtips.asp?ID=39

I also suggest that you contact symantec techsupport for additional advice.

regards.

No this is not a problem with Symantec. your solution refers to xp sp2 which I just loaded over the weekend based on Jeopboys suggestion.But lets assume it is a norton problem I will just drop symantec. It's only on the laptop because it came with it.

Just a question--are each of those event log entries corresponding to a reboot of the laptop? A "server service terminated unexpectedly" message can happen on a reboot of the computer--especially if the reboot is not a normal one.

Is there a reason you are running those services? The VAIO Media Service basically allows you to share pictures and music on your local network--basically it set up your laptop as a server, the other computers on your network are the clients. It appears to be pre-installed and enabled by default. If you are not using this service, I would recommend disabling it. It may/may not be assisting in your problem. More info on this service is here: http://www.vaio.net/sonyvaio535.html

The Network Proxy Service, however, CAN cause the exact issue you are experiencing. I found several threads where people have the same issues. Their solution was to set the service to restart on failure--you do this through service manager.
Go to Control Panel > Administrative Tools > Services
Find Symantec Network Proxy in the list of services and right click on it
Click on the "Recovery" tab
Set all failure values to "Restart the Service"

Here are a couple good threads which, although a couple years old, mentions some specific sites which were actually triggering the service to fail.
http://www.dslreports.com/forum/remark,10039472~mode=flat
http://www.dslreports.com/forum/remark,8171434~mode=flat

There is another suggestion in a thread to use the web assistant and disable "Block ads on this site" if there is a specific site that is causing the proxy service to crash.

I think susan's got it - I read those threads earlier today and they seem relevant.

What I neglected to mention, silly me, is that the results of the tests also help indicated the proxy service. You were able to make a connection on port 25 (SMTP) but not on port 80 (HTTP). This means that my original thought of it possibly being XP unable to make new TCP connections was not the answer. If that was the case, you would not have been able to get the SMTP connection. Since it seems to be port 80 (and probably 443) ONLY, this leads to the conclusion that it is something working in conjunction with Internet browsing and that "something" is probably the Symantec Internet Security package (of which the Proxy service is a part). Personally, I don't care for the Internet Security product. I prefer the Norton SystemWorks package (also by Symantec), which just seems to be more stable and cause less problems.

Susan-No the services are not shutting down on reboot because when it happened yesterday morning I immediately went to event viewer before rebooting.I did all the steps you suggested before I did anything else.Yes when I saw the Vaio media server I knew what was going on there and I looked at ways to stop the service. There is also something called the PNP framework service that never worked and must be shut down on reboot.It is part of the vaio media services too. I was attempting to upgrade last night on their site but I don't need or want it. I just use this computer for work.I have done what you suggested with the proxy services.As I replied to Meverest I can remove Symantec if necessary I don't like it anyway.I know DCOM can be removed or disabled also and I suspect that it is invoved in this media server thing. Also I use google ad blocking so what do you think next Susan? I saw the comments about ccproxy.I think we are close to a solution but I want to make sure we have tied it to a specific program. Let me know what you think I will do whatever you think is best. I have learned a great deal just going thru this with you all.

Rand

The ad blocking I was mentioning is part of the Norton Internet Security. ccProxy is the Symantec Network Proxy service. See if you can force the failure again--if it is indeed the Proxy service, then it should restart and any outages should be brief.

Ok I turned off ad blocking so I will turn it back on I don't visit a lot of demanding sites so I don't know what's driving the dns error.

Ah, but that's the whole thing. It isn't actually a DNS error. It is port 80 being blocked--IE just reports it as a DNS error since it can't connect . . .

I understand now, I have turned ad blocking back on and will wait ti see if we can recreate this problem. Is there anything that you would like me to do if it stops again? Thx for all your help Susan.

Rand

Well, if it is indeed the Proxy service, then it will quit. If it doesn't restart, however, then we have more issues.

Any luck with this problem? I've just got myself a shiny new Vaio and guess what? Exactly the same :/

It is definitely DNS. When it craps out any net program that does not rely on DNS resolution chugs away fine. Restarting the DNS client in services solves the problem and i'm back up and running again, but only for a bit.

Also, I have a Toshiba laptop - also wireless - with exactly the same config and I can't recreate the problem. I guess that rules out the router. No Symantec stuff or anything like that on my Vaio ... I removed it all.

Are you still getting the same problem? Can I come and bang my head against your wall?!

jonnyboy69- yes  it is a dns problem and I think that it is caused by the PNP framework program and  the photo server. I don't use that stuff but it loads automatically. Susanzeigler thought it might be the popup blocker in symantec but since I have followed her advice about restarting in service manager I have not been able to recreate the problem. The cc.exe program seems to cause a lot of trouble for other users. I only have symantec because it came with my k-14. I use Kerio on my desktop because it's free and much better than anything else I've seen. Try the suggestions Susan has provided above and let me know what happens. Thx for writing because I was really surprised that no other sony user had complained about this. google didn't turn up anything close to our issues. Susan is the ONLY one who has broken the code on this and I am very grateful for her help. If you want to Pm me jonnyboy let me know.If you need help with the service manager thing just let me know.

Rand

Hi Rand,

I followed her instructions (and she is truly wonderful for helping out so much!), but I get the same problem. And I don't get the same symptoms as you with regards to service failures etc. So I guess this means a) we have a different problem or b) they aren't relevant to this problem. The conclusion i'm gradually coming to is that Sony aren't much good at Wireless. Here's why:

Firstly, except for you, I haven't found anyone with an identical problem, but I have found quite a few comments scattered around the net on how unreliable wireless is on Vaio laptops. For example, see here: http://shopper-zdnet.com.com/Sony_VAIO_VGN_S260/4014-3121_15-31118470.html?rvwtp=4852-3121_15-31118470&tag=nav.user&orderby=90&sort=

Secondly, i've tried switching wireless on the laptop off and using the network card instead ... everything is fine and I don't get any problems.

And thirdly i've tried using a Belkin PCMCIA wireless card (and disabling the Vaio's wireless) ... and again, everything is fine.

So, as far as I can see, the problem is only specific to the built-in Sony wireless card. I can live with carrying around the Belkin card, but it's very annoying when I splashed out so much money for this thing, and Wireless was one of the major benefits.

Have you had a recurrence since turning off your Symantec popup blocker? Like I said I don't have it on my system anymore, but i'd be interested if you thought that was the cause of your problem.

What do you think?

Dan

FYI, i've got a Vaio VGN-S3XP

Hi Dan,

What does your event viewer look like? does it show any errors at all? I would think it should show the card going down? Have you upgraded tp sp2 and have you upgraded the wireless driver? They had an upgrade on the Vaio page sometime back. Also there is a Vaio diagnostic utility that you can download. My internal is a lan express which has been very good since I bot this a year ago. I have had few problems but after seeing all the problems on the net with Sony I would go to Toshiba though.Since we turned the restart on in services I have not had a DNS problem, the popup blocker is still on though I don't think that was the problem. If you need help to the updates site let me know.I am not too worried about speed I run a home network and use this for work but I surf a lot and it seems fine to me but that is relative to some guys. I was on dialup 2 years ago so DSL is a godsend and I run a netgear router at 54 G and even 11b is not that slow compared to dial up.

Rand

Susan- I just saw that I went down at 1000 and 1101 (4/18/2005) because I happened to be sitting at the computer. There have been a few outages since we last talked but because I turned service restart on it has happened so I would see it. I believe you are right and it is Symantec and the Vaio photo server which are causing the DNS connection to drop. I saw in event viewer that the last two stoppages were due to Symantec Proxy server.What do you think?

Rand

I personally don't use that Symantec product. I prefer the System Utilities product which doesn't have the proxy service. If you are able, I would uninstall the Norton Internet Security package and replace it with the Norton System Utility product. It still has the anti-virus, as well as some other really good utilities, but does not have the proxy service that seems to be causing your issues.

Thx for your reply I really don't care about Symantec. They aren't very good. I run so much protection that viruses aren't a problem for me. I will just uninstall and use a real av program. My concern is giving you the points for helping me you figured it out by yourself and if it weren't for you I would still be scratching my head.

Rand