Troubleshoot TCP/IP &/or DNS

entropy13 · Post by **entropy13** » Tue Nov 30, 2004 5:22 pm

Got one - not sure if I should post in this forum. . .
replaced mobo & proc. in desktop. Used sysprep ahead & "repaired " afterwards. Comp had XP w/ SP2 prior to upgrade - worked fine. Used XP slipstreamed w/sp2 to repair. Now certain websites (ex: ebay, weather.com, microsoft) won't load. Get "page cannot be displayed" after about 30sec. Most other pages are fine. My Laptop, wireless to Linksys, finds pages with no trouble, so i know its not ISP related. No router settings changed. Desktop with problem has static IP and DNS servers set manually (all checked against laptop) Have done exhaustive googling on this one.

Tried (unsuccessfully):
Spybot & Ad-Aware - did remove a number of cookies and 3-4 items
AVG "deep" scan - negative
Trojan scan - negative
reinstall NIC drivers
reinstalled/upgraded Sun JAVA
loaded Mozilla (has same problem)
WinsockXPfix.exe
disabling DNS Client Service
flushdns - gives error since DNS Client service is disabled
reinstall IE6
checked ping on Domain Names & IP of above sites - no return

Don't want to reinstall . . .may try another "Repair" if I have to.
Any ideas GREATLY appreciated!
netsh to rebuild TCP/IP stack

BTW - homebuilt rig w/ 2.4G P4 Celeron, 512MB ram and ATI 9200 vid., NIC onboard Intel PRO100/VE with Bellsouth 3000/384 DSL, using WRT54G router wired

Kip Patterson · Post by **Kip Patterson** » Tue Nov 30, 2004 5:39 pm

Check the hosts file. Should be empty.

entropy13 · Post by **entropy13** » Tue Nov 30, 2004 6:40 pm

Already did . . .forgot to mention that in first post. Also tried deleting Index.dat in temp. internet files.
Trying to rmember everything I've tried in the past 48 hrs. Googling, seems others have this problem with sp2 also, but not luck on solution.

buckifan · Post by **buckifan** » Tue Nov 30, 2004 8:04 pm

Do you get an error message when you run ipconfig /renew?

entropy13 · Post by **entropy13** » Tue Nov 30, 2004 8:20 pm

"The operation failed as no adapter is in the state permissible for
this operation."

. . .at 8:18pm.

buckifan · Post by **buckifan** » Wed Dec 01, 2004 12:41 pm

Looks like your Winsock registry keys are corrupted. Try this:

In Registry Editor, locate the following keys, right-click each key, and then delete:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

Restart your computer at this point. New entries will be created.

Now install TCP/IP:

Right-click your network connection and click Properties. Click install and then select Protocol. Click Have Disk and browse to C:\Windows\inf and click OK. From the list select Internet Protocol (TCP/IP) and click Ok.

Restart again.

entropy13 · Post by **entropy13** » Wed Dec 01, 2004 8:10 pm

No good. Tried and still get same results.
Just noticed something interesting, though. Tried weather.com again. Status bar says "Page found" so I don't think its a DNS resolver issue anymore. Page simply times out after about 30sec and displays "Page cannot be displayed" error.

earthmofo · Post by **earthmofo** » Wed Dec 01, 2004 8:46 pm

You may have reached the new limit imposed on concurrent TCP connectin attempts with SP2. The new limit is supposed to help stop the spread of worms and trojans (see below). Look to see if you have the following in your event log.

To search for the event go to Administrative Tools and click on Event Viewer then on the System log. Click on View in the menu bar then from the drop down menu select search. In the line for Event ID enter 4226 then click on Find Next.

entropy13 · Post by **entropy13** » Wed Dec 01, 2004 8:54 pm

Already thought of that and ran the "patch" the other night. No 4266 in event log either. This one is driving me NUTS!

buckifan · Post by **buckifan** » Wed Dec 01, 2004 8:59 pm

You indicated that you cannot ping a remote host. Can you ping the local computer -- 127.0.0.1? If that works try to ping the your local host address and then the gateway.

If I were you I'd start backing up my important stuff. A clean install could be in your future.

earthmofo · Post by **earthmofo** » Wed Dec 01, 2004 9:16 pm

It should be Event ID 4226 not 4266. My error in the reply.

entropy13 · Post by **entropy13** » Wed Dec 01, 2004 9:18 pm

Ping to local host, router, ISP gateway, and 3 DNS all good. Ping to selected sites (weather.com, ebay, microsoft, excite) all time out. Ping to other sites (ie; speedguide) good also.
I'm gettin the same feeling about the clean install. My wife's desktop (which got my old mobo) is doin' same thing as this one. Could be a long weekend. . .

entropy13 · Post by **entropy13** » Wed Dec 01, 2004 9:25 pm

earthmofo-
did the same thing. . .correct search, incorrect with the "hunt & peck" on the KB. Thanks for the idea, though.

earthmofo · Post by **earthmofo** » Wed Dec 01, 2004 9:29 pm

Did you use Microsoft's Sysprep tool? If both machines have the same error it seems to be pointing to Sysprep as the cause.

entropy13 · Post by **entropy13** » Wed Dec 01, 2004 9:35 pm

Yup - right off the CD. I think we might have a corruption somewhere, but where? I've run regclean and uninstalled 'ghost' devices. Working on a few more of the TCP/IP settings right now as well. This one's pissed me off now, so I can't let it beat me!

entropy13 · Post by **entropy13** » Wed Dec 01, 2004 10:03 pm

The Computer Gods have smiled upon me!!!! Among my settings, I had turned off accidentally PMTU Discovery (Blackholes) and had my MTU settings messed up. Finally noticed running a TCP/IP analysois online. Ended up using another site (boo-hiss) tweaker to fix the problem. Now to see if i can repeat the fix on the wife's machine. Thanks for the brainstorming guys!!

buckifan · Post by **buckifan** » Thu Dec 02, 2004 9:57 am

Good job. Most people(myself included) probably would have done a clean install of the OS by now.

Having PMTU discovery disabled would explain why some hosts were reachable and others were not. Black hole routers were encountered when trying to reach some hosts.

This one will be filed in my knowledge base.

entropy13 · Post by **entropy13** » Thu Dec 02, 2004 1:15 pm

I tried running some tracert last night to see where the breakdown was - since I could ping gateways. All of the "bad sites" timed out after about 10 hops or so. . .that got me wondering so I started checking my good ol' Cablenut settings and found it! THe MTU was wierd, though. Must have been resest in the the overinstall to something strange. Was able to repeat the procedure on my wife's machine so, I know that was what the problem was. Thanks again for the input.