FTP out is working, but HTTP out and telnet out are not.

How are you connected to internet?
are you behind proxy?

There is no proxy. Essentially a DSL connection comes in to a DSL router. Then I have 5 or 6 computers plugged in to that router. 2 linux and 4 Win boxes. I use the DSL router as my gateway and my other linux server as DNS. All of them seem to work just fine except for the new linux box.

Something else that might help. I tried getting an IP via DHCP and that didn't seem to work, which is OK because I am going to give this server a static IP anyway. Could it be a hostname problem?

Thanks
Rob

I'd think it more likely to be a router problem. Some of those DSL routers will restrict Internet access to any IP that they didn't hand out via DHCP or if they weren't old that the IP was statically assigned.

My other linux server has a static IP that the DHCP router has never handed it and it works fine. Plus would that explain being able to successfully tracert, ftp, and ping, but not http out?

Rob

Well, I can't really think of anything on the RedHat 9 system that would allow FTP, ping, etc., and disallow HTTP except an incorrectly configured firewall, which you said was off. Hence my suspicion that it might be caused by the router.

But, we can find out what's happening. A sniffer trace will tell you if the box is sending requests out to the Internet and whether replies come back. Ideally you'd run the sniffer (tcpdump or ethereal) on the other Linux box. But if your DSL router's LAN connections are a switch rather than a hub you won't see the traffic from there and would need to run the sniffer on the local box. Having "been there, done that before" I keep a 4port hub & cables in my laptop bag just to be able to sniff traffic from a machine in a switched environment.

Hello:

Below is the tcpdump output. I used lynx to go out to google.com and my internal server 192.168.1.250, both failed. In lynx you can see it resolve the name, send the request, then it waits forever.

Another interesting thing is that I can ftp out, login to a server (inside or outside), get directory listings, change dirs, but as soon as I try to u/l something it just stalls.

In other news..

I rebooted and unfortunately it is saying my network card is not present.

"8139too does not appear to be present, delaying initialization"

So I have to figure that one out too.

Thanks for the help,
Rob


15:29:39.143806 192.168.1.120.44258 > 216.239.37.99.http: F 3169689036:3169689036(0) ack 2174062055 win 5840 (DF)
15:29:39.175383 192.168.1.120.32787 > marreel.www.marreel.com.domain:  1410+ PTR? 99.37.239.216.in-addr.arpa. (44) (DF)
15:29:39.175793 marreel.www.marreel.com.domain > 192.168.1.120.32787:  1410 NXDomain 0/1/0 (104)
15:29:39.176088 192.168.1.120.32787 > marreel.www.marreel.com.domain:  1411+ PTR? 120.1.168.192.in-addr.arpa. (44) (DF)
15:29:39.176290 marreel.www.marreel.com.domain > 192.168.1.120.32787:  1411 NXDomain* 0/1/0 (108)
15:29:39.176504 192.168.1.120.32787 > marreel.www.marreel.com.domain:  1412+ PTR? 250.1.168.192.in-addr.arpa. (44) (DF)
15:29:39.176717 marreel.www.marreel.com.domain > 192.168.1.120.32787:  1412* 1/1/1 (111)
15:29:46.846247 192.168.1.120.44266 > marreel.www.marreel.com.http: S 3202982813:3202982813(0) win 5840 <mss 1460,sackOK,timestamp 5753284 0,nop,wscale 0> (DF)
15:29:46.846338 marreel.www.marreel.com.http > 192.168.1.120.44266: S 3057075168:3057075168(0) ack 3202982814 win 32120 <mss 1460,sackOK,timestamp 40097283 5753284,nop,wscale 0> (DF)
15:29:46.846385 192.168.1.120.44266 > marreel.www.marreel.com.http: . ack 1 win 5840 <nop,nop,timestamp 5753284 40097283> (DF)
15:29:46.847882 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5753284 40097283> (DF)
15:29:47.050964 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5753305 40097283> (DF)
15:29:47.470960 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5753347 40097283> (DF)
15:29:48.310964 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5753431 40097283> (DF)
15:29:49.990967 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5753599 40097283> (DF)
15:29:53.350968 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5753935 40097283> (DF)
15:29:58.690972 192.168.1.120.44258 > 216.239.37.99.http: P 4294966215:0(1081) ack 1 win 5840 (DF)
15:30:00.070966 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5754607 40097283> (DF)
15:30:01.150666 192.168.1.100.router > RIP2-ROUTERS.MCAST.NET.router:  RIPv2-resp [items 0]: [ttl 1]
15:30:01.151088 192.168.1.120.32787 > marreel.www.marreel.com.domain:  1413+ PTR? 9.0.0.224.in-addr.arpa. (40) (DF)
15:30:01.151604 marreel.www.marreel.com.domain > 192.168.1.120.32787:  1413 1/3/5 PTR[|domain]
15:30:01.151814 192.168.1.120.32787 > marreel.www.marreel.com.domain:  1414+ PTR? 100.1.168.192.in-addr.arpa. (44) (DF)
15:30:01.152012 marreel.www.marreel.com.domain > 192.168.1.120.32787:  1414 NXDomain* 0/1/0 (108)
15:30:03.690944 arp who-has 192.168.1.1 tell 192.168.1.120
15:30:03.691327 192.168.1.120.32787 > marreel.www.marreel.com.domain:  1415+ PTR? 1.1.168.192.in-addr.arpa. (42) (DF)
15:30:03.691573 arp reply 192.168.1.1 is-at 0:a0:c5:40:3b:48
15:30:03.691707 marreel.www.marreel.com.domain > 192.168.1.120.32787:  1415 NXDomain* 0/1/0 (106)
15:30:06.142278 arp who-has 192.168.1.120 tell marreel.www.marreel.com
15:30:06.142314 arp reply 192.168.1.120 is-at 0:d:88:3b:7e:16
15:30:13.510969 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5755951 40097283> (DF)
15:30:31.150218 192.168.1.100.router > RIP2-ROUTERS.MCAST.NET.router:  RIPv2-resp [items 0]: [ttl 1]
15:30:40.390973 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5758639 40097283> (DF)
15:30:45.390943 arp who-has marreel.www.marreel.com tell 192.168.1.120
15:30:45.391050 arp reply marreel.www.marreel.com is-at 0:c0:26:ac:73:1a
15:30:46.690983 192.168.1.120.44258 > 216.239.37.99.http: P 4294966215:0(1081) ack 1 win 5840 (DF)
15:31:01.149790 192.168.1.100.router > RIP2-ROUTERS.MCAST.NET.router:  RIPv2-resp [items 0]: [ttl 1]
15:31:19.993718 arp who-has marreel.www.marreel.com tell 192.168.1.1
15:31:31.149370 192.168.1.100.router > RIP2-ROUTERS.MCAST.NET.router:  RIPv2-resp [items 0]: [ttl 1]
15:31:34.150973 192.168.1.120.44266 > marreel.www.marreel.com.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 5764015 40097283> (DF)
15:31:39.150946 arp who-has marreel.www.marreel.com tell 192.168.1.120
15:31:39.151039 arp reply marreel.www.marreel.com is-at 0:c0:26:ac:73:1a
15:32:01.148945 192.168.1.100.router > RIP2-ROUTERS.MCAST.NET.router:  RIPv2-resp [items 0]: [ttl 1]
15:32:22.690978 192.168.1.120.44258 > 216.239.37.99.http: P 4294966215:0(1081) ack 1 win 5840 (DF)
15:32:27.690945 arp who-has 192.168.1.1 tell 192.168.1.120
15:32:27.691505 arp reply 192.168.1.1 is-at 0:a0:c5:40:3b:48
15:32:31.148526 192.168.1.100.router > RIP2-ROUTERS.MCAST.NET.router:  RIPv2-resp [items 0]: [ttl 1]

Another reboot and the network card came right up, so I don't think we need to worry about that problem.

Rob
PS: Wish I could make this one 1000 pts

Just to clarify I meant the network card came up, but it still has the same problem getting out.

Rob

Well, that tells us something... I'm not sure exactly what yet, but it is something.

At the beginning of the trace I see:

192.168.1.120.44258 > 216.239.37.99.http

which is the outgoing request. Following that I see:

192.168.1.120.32787 > marreel.www.marreel.com.domain:  1410+ PTR? 99.37.239.216.in-addr.arpa.

Which is a DNS request for a reverse lookup on the same IP in the HTTP request. The hostname that the DNS request is most interesting and would imply that it is to the node marreel in the domain www.marreel.com, which I suspect is absurd. The DNS request fails, by the way, and should according to what I see. But the IP is one that is valid for google.com. Was the lynx connection to the IP or to www.google.com or google.com?

Following that there are an number of other failing DNS requests, but no return packets ever from 216.239.37.99. So it appears that there is at least one and possibly two problems. It appears to me that there's a configuration problem, possibly with only the local machine, or possibly with your DNS server, or both. At this point I'd need to know what is shown by:

'cat /etc/sysconfig/network'
'cat /etc/sysconfig/network-scripts/ifcfg-eth0'
'cat /etc/hosts'
'cat /etc/resolv.conf'
'netsat -nr'
'ifconfig -a'

To determine what might be wrong with the local machine's config.


The sniffer trace also seems to imply that the node at 192.168.1.100 is broadcasting router information, but I'd expect a DSL router being at 192.168.1.1 or 192.168.1.254. What is the machine at 192.168.1.100 and is your routers IP 192.168.1.1?

I am glad we might be on to something here.

marreel.www.marreel.com actually is a valid address. Its the name of the DNS server at 192.168.1.250. All of the other boxes on the network are using this system just fine.

Here is the network breakdown:

192.168.1.1 gateway/dsl router
192.168.1.100 wireless router
192.168.1.250 DNS server, web server, mail server, ftp server
192.168.1.120 New troublesome box
192.168.1.101-119 DHCP pool

The next comment will be all of the files.

Thanks for the help.

Rob

Using lynx I tried connecting to google with the IP and name, same result. Also tried connecting to the internal server using name and IP, also same result.

Thanks,
Rob


# Do not remove the following line, or various programs
# that require network functionality will fail.

127.0.0.1      webserver2      localhost


DEVICE=eth0
ONBOOT=yes
BOOTPROTO=none
IPADDR=192.168.1.120
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
TYPE=Ethernet
USERCTL=no
PEERDNS=no
NETWORK=192.168.1.0
BROADCAST=192.168.1.255


eth0      Link encap:Ethernet  HWaddr 00:0D:88:3B:7E:16  
          inet addr:192.168.1.120  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:252 errors:11 dropped:0 overruns:0 frame:9
          TX packets:152 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:35991 (35.1 Kb)  TX bytes:30570 (29.8 Kb)
          Interrupt:11 Base address:0xa000

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:196109 errors:0 dropped:0 overruns:0 frame:0
          TX packets:196109 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13391982 (12.7 Mb)  TX bytes:13391982 (12.7 Mb)




Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.1.0     192.168.1.120   255.255.255.0   UG        0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0


NETWORKING=yes
HOSTNAME=webserver2


search 192.168.1.250
nameserver 192.168.1.250
nameserver 192.168.1.250



Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.1.0     192.168.1.120   255.255.255.0   UG        0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0

I see three problem in the machine's configuration and one with your DNS. You say that "marreel.www.marreel.com actually is a valid address", which could be true but I doubt that it is. A hostname of that form implies that there is a www subdomain of marreel.com. A quick DNS check reveals that www.marreel.com is a CNAME to marreel.com which has an outside IP of 68.165.131.201. So my suspicion is correct and www.marreel.com is host, not a subdomain. In that case you could have marreel.marreel.com, www.marreel.com, webserver2.marreel.com, etc. You'll need to correct your local DNS server config along those lines.

Now to the machine's config problems:

/etc/sysconfig/network should contain:

NETWORKING=yes
HOSTNAME=webserver2.marreel.com

And since the machine has a static IP /etc/hosts should contain:

127.0.0.1           localhost.localdomain localhost
192.168.1.120  webserver2.marreel.com webserver2

And /etc/resolv.conf needs to contain:

search marreel.com
nameserver 192.168.1.250

Those changes will correct the Linux box's config, but things may not get completely sane until you fix the DNS. If I assume that the hostname of the machine at 192.168.1.250 is www.marreel.com the zone file for your domain would look something like:

;
; Forward resolution zone file for primary DNS server
;
$TTL 3600
@    IN  SOA   www.marreel.com. root.marreel.com. (
               2004061100 ; Serial
               10800      ; Refresh
               3600       ; Retry
               604800     ; Expire
               3600)     ; Minimum
                                                                               
               IN  NS     www.marreel.com.
               IN  MX  10 www.marreel.com.
;
; So http://marreel.com works
;
                    IN  A       192.168.1.250
;
; Systems in this domain
;
gateway      IN  A        192.168.1.1
wireless      IN  A         192.168.1.100
webserver2 IN  A       192.168.1.120
www            IN  A       192.168.1.250

And the reverse zone data would look similar to:

;
; Reverse resolution zone file for primary DNS server
;
$TTL 3600
@    IN  SOA   www.marreel.com. root.marreel.com. (
               2004061100 ; Serial
               10800      ; Refresh
               3600       ; Retry
               604800     ; Expire
               3600)     ; Minimum
                                                                               
               IN  NS     www.marreel.com.

1          IN  PTR   gateway.marreel.com.
100     IN  PTR   wireless.marreel.com.
120     IN  PTR    webserver2.marreel.com.
250     IN  PTR    www.marreel.com.

Hello:

I made all of the changes except on the DNS server. Then tried to use lynx to get to 192.168.1.250. Same problem. Also tried google, same problem.

Do you need the tcp dump again?

Start a tcpdump as 'tcpdump -n host 192.168.1.250' and then execute:

ping -n -c1 192.168,1.250
host www.google.com
lynx http://192.168.1.250

and show me what that shows.

Here is the output from tcpdump. The output from each of the programs looked good.

22:41:03.781802 192.168.1.120 > 192.168.1.250: icmp: echo request (DF)
22:41:03.781975 192.168.1.250 > 192.168.1.120: icmp: echo reply
22:41:11.356320 192.168.1.250.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138)
22:41:11.356410 192.168.1.250.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138)
22:41:16.666065 192.168.1.120.32774 > 192.168.1.250.domain:  24236+ A? www.google.com. (32) (DF)
22:41:16.758657 192.168.1.250.domain > 192.168.1.120.32774:  24236 4/11/10[|domain]
22:41:30.589054 192.168.1.120.41717 > 192.168.1.250.http: S 1516934460:1516934460(0) win 5840 <mss 1460,sackOK,timestamp 4490159 0,nop,wscale 0> (DF)
22:41:30.589176 192.168.1.250.http > 192.168.1.120.41717: S 1349242448:1349242448(0) ack 1516934461 win 32120 <mss 1460,sackOK,timestamp 51328226 4490159,nop,wscale 0> (DF)
22:41:30.589221 192.168.1.120.41717 > 192.168.1.250.http: . ack 1 win 5840 <nop,nop,timestamp 4490159 51328226> (DF)
22:41:30.590315 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4490159 51328226> (DF)
22:41:30.796436 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4490180 51328226> (DF)
22:41:31.216432 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4490222 51328226> (DF)
22:41:32.056433 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4490306 51328226> (DF)
22:41:33.736438 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4490474 51328226> (DF)
22:41:37.096443 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4490810 51328226> (DF)
22:41:43.816438 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4491482 51328226> (DF)
22:41:57.256439 192.168.1.120.41717 > 192.168.1.250.http: P 1:1085(1084) ack 1 win 5840 <nop,nop,timestamp 4492826 51328226> (DF)

Hi,

try to change network card and reconfigure it from scratch

I'm beginning to like beem4n's suggestion. According to the sniffer trace things partly work. I can see the ping request and response, the DNS query and response, and the HTTP request and the first part of the connection. All of the transactions that do work involve small packet sizes, but the HTTP transaction seems to fail once the data packet size increases. That could well be a fault in the NIC/driver.

OK. Its a brand new Dlink card using the 8139too driver. I have a 3Com card that I could drop in there and try although I have never had much luck config'ing 3com cards on a linux box. I will give it a shot though.

Rob

If I were to go purchase a new NIC to be safe is there a kind you would suggest?

I've not had any problems with 3C905's or Intel EtherExpress Pro cards on RedHat boxes. On later versions (>= 8.0) the Netgear FA310/311's have also worked well.

quick question.. if you type:

telnet google.com 80

what happens?

if it says:

# telnet google.com 80
Trying 216.239.57.99...
Connected to google.com.
Escape character is '^]'.

then your browse is hosing something up.  if its not, then, well, you know you have a real system problem.  this will at least help narrow it down some.

I won't be in front of that server for another couple of hours to test that specific command but when i telnet to any server using the default port that *is* in fact the output I get.

yes, but thats port 23, not 80.  your browser likely isnt concerned with whats going on to that port, unless a full system proxy is specified through the browser somehow.  if you can hit 80 (type some junk and press enter a few times, see if it doesnt disconnect you) but the browser cant, then it does narrow the scope some.

OK, I will give it a shot.

When I telnet to port 23 I get everything up to the Escape character is '^]' line, but then the login prompt never comes up.

I just tried telneting to google.com at port 80.

I get the normal couple of lines. Then I typed a bit and hit enter. It then said connection closed by host.

Help any?

If not I am going to go ahead and install this new network card I picked up.

I still think this is being over complicated, but who knows, maybe it is the NIC..

I'd try using any other application layer program to test it out, instead of relying on the browser.  If telnet's connecting, so should http and anything else.  Try ftp'ing out to something like sunsite.unc.edu, etc.

That behaviour on the telnet to port 80 seems consistant with what was in the sniffer trace. It's like the NIC sees the first part of the transaction and nothing later. I'd pull the NIC, reboot and let kudzu remove it. then plug in the new one and allow kudzu to configure it.

So i put the new card in and unfortunatly the same problem occurs.

- On FTP I can go out and login to any site. But as soon as I try and DL a file it just hangs.

- Mozilla and lynx both have the same problem.

- ping works

- telnet starts to work but it hangs before displaying the login: prompt

- traceroute seems to work

Seems like its still a system config problem.

What, did you guys give up on me?

i havent used redhat in awhile, im an avid debian user, dunno what to tell you here.  this isnt something ive ever seen on a linux server.

Actually, now with this new card I can't get to anything. I tried pinging an internal address 192.168.1.250 and it says the host is unreachable. Where do I start checking for this prob?

What does 'ifconfig -a' show?
What card do you have in the machine now?
What does 'mii-tool' show?

ifconfig -a shows: "Illegal Instruction"

I have the brand new linksys card in there still. Kudzu set it up with the DEC21*40 driver.

mii-tool shows: eth0: negotiated 100BaseTX-FD flow control, link ok

>  ifconfig -a shows: "Illegal Instruction"

Something is hosed. At this point, considering what's been covered in the question and the comments, I'm leaning towards a basic system hardware problem. Perhaps a memory, processor, or chip set fault.

What I'd do now is to see if there's a BIOS update from your motherboard vendor that hasn't yet been installed. Next I'd look at the BIOS and see if there's a setting to disable PnP mode. And finally I'd run memtest86 on the box for at least one full pass.

I did a reinstall of RH 9 with the new network card and strangely everything comes up now except HTTP. I can ftp, telnet, ping, traceroute, everything, but I can't HTTP out nor can I get the system to allow httpd to accept incoming requests.

The really interesting thing is that I can telnet to a web server on port 80, do a 'GET /' and it returns the HTML.

Any ideas now?

Hi,

type "set" and post output here

also "ifconfig" and post output

> The really interesting thing is that I can telnet to a web server on port 80, do a 'GET /' and it returns the HTML

And what happens if you start Mozilla and go to that same site in the same manner?

I will get teh set and ifconfig output in a sec

Mozilla says its connecting to the site but never returns any data. It just sits their loading forever.

Rob

when i'd originally asked you to telnet out to a webserver on port 80, the browser settings was what i wanted to narrow down on.  you threw me off that trail of thought when you said not even lynx worked..but if get / works, then I'd say check out the edit -> preferences -> advanced -> proxies, make sure thats either blank or set accordingly.

in the same area, look at the http networking settings.  if enable pipelining and enable keep-alive are enabled, disable them and try again.  theres no reason to revert back to http 1.0, that'd be horrible, just test those two settings out.

Lynx in fact does not work. It has the same result as Mozilla.

More interesting info:

- I checked the proxy settings in Mozilla and turned off keep alive. Pipelining was already off. Didn't help.

- After playing around with FTP a little more I noticed that I can download files but I can't upload.

- With the reinstall I forgot to install the CD ROM burning software so I really don't have a way to get data off of the computer. What in the ifconfig or set output are you looking for?

Thanks for the help
Rob

I also went and plugged the box in to another network just to eliminate that possibility. After changing the IP info to work on the new system I have the exact same problem.

debian's looking nicer..could always use kanotix or knoppix to install it.. O_o

Well, installing another OS isn't high on my list. I would prefer that RH work, but I might just be stuck.

Whats the best/easiest OS for servers aside from RH?

Thanks
Rob

Which Dlink card do you have?

The burner S/W is pretty easy to add from your distro CD's. You'll want to install the cdrecord and mkisofs packages, at a minimum. And no, I don't know which RH 9 CD they are on.

> I also went and plugged the box in to another network just to eliminate that possibility. After changing the IP info to > work on the new system I have the exact same problem.

That does seem to imply that there's a basic hardware problem on this computer. At this point you've tried two different NIC's and two different networks. While there could have been a problem with a NIC or something wierd with your DSL router, it's very unlikey that you'd have the same fault on two differnet networks. The only thing common to all of this is the computer itself.

And to some degree the failure of ifconfig ("Illegal Instruction") on the first installation of RH 9 tends to point in that direction as does what we see in the sniffer traces. You really need to check to see if you have a current BIOS and I'd highly recommend a memtest86 diagnostic run.

What motherboard (make/model) is in this box?

I am not sure what M/B is in the box. Is there a diag tool that will spit out this info?

I installed the exact same OS on another box in my network and it came up just fine without a problem. So rather than continuing on with this I am scrapping the old box and have ordered a new server from Dell. I will go ahead and award the points, but might post some more questions when the new server arrives. :)