Weird Internet Connection Problem

[jlmns]

Hi all,

I've spent most of today trying to resolve a most bizarre problem for a client.

They have a small network with about 5 PCs and a SBS2003, although the server is only used to run an application that the users RDC into - it doesn't act as a domain controller or provide any other services. I didn't set the network up but have inherited it.

The server has a static IP address and DHCP is turned off as the BT router does this.

The company had a problem with the server losing its Internet connection but I managed to resolve that yesterday. After I left the server downloaded a number of security updates and after that this bizarre problem started.

All the machines are now suffering intermittent loss of Internet. If the server is disconnected the problem is seemingly removed although pinging the BBC website shows timeouts but not as many as when the server is connected.

LAN connectivity is never affected.

The server has two network cards but only one is ever connected at one time - the problem occurs on both cards.

BT have said there is nothing wrong with the network - although it is really painfully slow with or without the server connected at 1.5Mbps.

Given that I'm seeing timeouts with the server disconnected I suspect there is a BT problem that is exacerbated by something the server is doing although if it was network traffic I'd expect to see problems on the LAN.

I'd be really grateful for any advice you guys can give. I've dealt with networks for years but this has left me questioning my knowledge.

Cheers,
James

 

[Simon-M]

Have you connected a PC to the BT router to see how that holds up.

 

[KM-Tiger]

The server has a static IP address and DHCP is turned off as the BT router does this.

Could there be a duplication between the server's address and an address in the DHCP pool?

Very odd things do happen if addresses are duplicated.

 

[BenPintilie]

James,

Send me a PM and I can talk you through all the trouble shooting steps you have been through and what we would do from our side, the main question is are you using a 2-Wire or one of the older BT Supplied ones or one of your own. It does not matter which one, it is just so I can use the correct terminology.

I am up until 02:00 UK time every evening if you need a hand.

Thanks
Ben

 

[jlmns]

Thanks for your replies.

Just to make things weirder, the BT router is a Home Hub 3, even though it is a business.

I forgot to add that I swapped the router for a spare that I carry for diagnostic purposes and the problem was still there although it seemed to be worse with the replacement.

Simon, there are 5 PCs which are left connected to the router via a secondary gigabit switch. I've bypassed this and the problem remains, although to a much lesser degree when the server is disconnected.

KM, I've checked all the addresses and there are no duplicates. I've also tried changing the server's address and it makes no difference.

I did wonder if the server's DNS settings might have something to do with it although these hadn't been changed between it working and not working. It isn't as though the PCs need to access the server to get their DNS info though as they work when the server is disconnected.

I'm thinking my next move is probably to try the server on a completely different network seeing that it isn't a domain controller.

 

[Paul_Rosser]

Could be a lot of broadcast traffic from the server, or quite a few other things.

You mention the SBS isn't a domain controller, is there another domain controller ? or are all the machines not part of a domain ?

I would try running wireshark on one of the pc's to have a look at the traffic thats being sent out, just to make sure it's not something with a virus or the like sending out loads of packets.

Could also be a routing issue, on one of the pc's type "route print" in dos just to make sure that they aren't trying to route traffic for some destinations via the server.

 

[jlmns]

Hi Paul,

There are no domain controllers - the PCs are essentially on a peer-to-peer network. Thanks for the extra tips - I am wondering if the server is sending out loads of traffic.

 

[Paul_Rosser]

try running "netstat" on the SBS box and if it's got loads of connections then that could be the issue.

Silly question but is there anything in the servers eventlog ?

 

[jlmns]

Will do - probably be back in there tomorrow evening so will try the tips mentioned.

Only errors I looked at were in the DNS section but there were none logged for today - again I'll have a look when I'm next in there.

 

[jlmns]

Ok, thanks to the wonders of remote desktop I've been checking out the server remotely and this issue gets weirder. I can still control the server by remote control when it supposedly can't see the Internet! I'm logged in watching Internet Explorer either tell me that the site cannot be found or then successfully opening the page yet I'm getting regular ping responses with either a TTL or Destination Port Unreachable regardless of the ability of the server to surf.

I've done a netstat and there are lots of connections but I'd suspect that if traffic was the problem I wouldn't be able to access the server with the stability I have at the moment.

It went for ages for a while with constant replies so I thought BT had fixed a problem they hadn't admitted to but then it starting getting errors again.

I've also checked the system event log. Only errors for today relate to a printer.

Looks like the server is currently the only machine turned on so it isn't an address conflict or another faulty machine.

It's now run for about 5 mins without a ping dropout.

Yup -I'm definitely confused!

 

[Paul_Rosser]

Could be one of the security updates causing the issue, do you know if the other machines use this for their updates via WSUS ?

Can you actually get into the router ? If yes have a look at the network stats and see if thats dropping a lot of packets.

 

[jlmns]

I've had a look at the router remotely this morning having RDC'd in. Unfortunately the Home Hub 3 gives really limited data.

However while I was still able to control the server the router web pages started failing to open and DNS seemed to be lost - i.e. pinging the BBC website just came back with the "could not be found" message. I minimised the RDC screen and then when I maximised again it was just a black screen so that connection has gone.

It seems to be really intermittant so if it was an update I'd expect it to be all or nothing. The other PCs get their updates directly from Windows Update, not from the server - they are a right mixture of computers.

 

[Simon-M]

I've had a look at the router remotely this morning having RDC'd in. Unfortunately the Home Hub 3 gives really limited data.

However while I was still able to control the server the router web pages started failing to open and DNS seemed to be lost - i.e. pinging the BBC website just came back with the "could not be found" message. I minimised the RDC screen and then when I maximised again it was just a black screen so that connection has gone.

It seems to be really intermittant so if it was an update I'd expect it to be all or nothing. The other PCs get their updates directly from Windows Update, not from the server - they are a right mixture of computers.

Have you tried changing the cable.

 

[Paul_Rosser]

Sounds like it's going to be a process of elimination. I would start by disconnecting everything from the BT router and just plug a laptop into that and see how things are, if they are all fine then it's not BT, if not then it's a BT issue.

After that try reconnecting the machines one by one and testing each time to see if you can find out where the issue lies and then diagnose from there.

Sorry but it's really hard to diagnose weird network issues without actually being on-site.

 

[jlmns]

Hi Paul,

I know what you mean about not being on site. I'll try single machines as you suggest - so far all I know is that with the server disconnected the problem seems to go away on the surface but I still see dropouts when running a ping test.

Simon, I'll try swapping the cable also - must remember that the simplest causes can be the most baffling to solve!

 

[Paul_Rosser]

It could be people think the problem goes away just that the internet is very slow as most browsers will make multiple attempts to load a web page before giving up. But the ping replies are showing that there is an issue.

Could be something as simple as a cable, I would try changing the adsl filter too as when they go it can cause issues.

 

[jlmns]

Thanks to Wireshark I found some malware sending out loads of packets to IP addresses all over the web at random intervals.

I've removed the default gateway from the server's network configuration as it doesn't need to access the web at the moment and am running an overnight scan.

Thanks for all your help - I've used every tip you've all suggested!

James

 

[Paul_Rosser]

Excellent, glad you found wireshark useful.

If you don't already use it process monitor is freeware and is brilliant for diagnosing weird issue, if you want some tips let me know.

 

[jlmns]

Yes, I do have Process Monitor.

I feel a bit of a twit because I was so focused on what I thought was a network problem that I didn't consider the wider possibilities.

 

[Paul_Rosser]

Happens to the best of us m8 and is always more complicated with networks/servers you didn't built yourself.

 

[jlmns]

At least I didn't start removing the 100 odd security updates that installed after SP2!

 

[KM-Tiger]

I feel a bit of a twit because I was so focused on what I thought was a network problem that I didn't consider the wider possibilities.

Those sort of issues can be very hard to diagnose. Sometimes one can strike lucky, other times hours and days can disappear.