Page 1 of 1
Troubleshoot TCP/IP &/or DNS
Posted: Tue Nov 30, 2004 5:22 pm
by entropy13
Got one - not sure if I should post in this forum. . .
replaced mobo & proc. in desktop. Used sysprep ahead & "repaired " afterwards. Comp had XP w/ SP2 prior to upgrade - worked fine. Used XP slipstreamed w/sp2 to repair. Now certain websites (ex: ebay, weather.com, microsoft) won't load. Get "page cannot be displayed" after about 30sec. Most other pages are fine. My Laptop, wireless to Linksys, finds pages with no trouble, so i know its not ISP related. No router settings changed. Desktop with problem has static IP and DNS servers set manually (all checked against laptop) Have done exhaustive googling on this one.
Tried (unsuccessfully):
Spybot & Ad-Aware - did remove a number of cookies and 3-4 items
AVG "deep" scan - negative
Trojan scan - negative
reinstall NIC drivers
reinstalled/upgraded Sun JAVA
loaded Mozilla (has same problem)
WinsockXPfix.exe
disabling DNS Client Service
flushdns - gives error since DNS Client service is disabled
reinstall IE6
checked ping on Domain Names & IP of above sites - no return
Don't want to reinstall . . .may try another "Repair" if I have to.
Any ideas GREATLY appreciated!
netsh to rebuild TCP/IP stack
BTW - homebuilt rig w/ 2.4G P4 Celeron, 512MB ram and ATI 9200 vid., NIC onboard Intel PRO100/VE with Bellsouth 3000/384 DSL, using WRT54G router wired
Posted: Tue Nov 30, 2004 5:39 pm
by Kip Patterson
Check the hosts file. Should be empty.
Posted: Tue Nov 30, 2004 6:40 pm
by entropy13
Already did . . .forgot to mention that in first post. Also tried deleting Index.dat in temp. internet files.
Trying to rmember everything I've tried in the past 48 hrs. Googling, seems others have this problem with sp2 also, but not luck on solution.
Posted: Tue Nov 30, 2004 8:04 pm
by buckifan
Do you get an error message when you run ipconfig /renew?
Posted: Tue Nov 30, 2004 8:20 pm
by entropy13
"The operation failed as no adapter is in the state permissible for
this operation."
. . .at 8:18pm.

Posted: Wed Dec 01, 2004 12:41 pm
by buckifan
Looks like your Winsock registry keys are corrupted. Try this:
In Registry Editor, locate the following keys, right-click each key, and then delete:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2
Restart your computer at this point. New entries will be created.
Now install TCP/IP:
Right-click your network connection and click Properties. Click install and then select Protocol. Click Have Disk and browse to C:\Windows\inf and click OK. From the list select Internet Protocol (TCP/IP) and click Ok.
Restart again.
Posted: Wed Dec 01, 2004 8:10 pm
by entropy13
No good. Tried and still get same results.
Just noticed something interesting, though. Tried weather.com again. Status bar says "Page found" so I don't think its a DNS resolver issue anymore. Page simply times out after about 30sec and displays "Page cannot be displayed" error.

Posted: Wed Dec 01, 2004 8:46 pm
by earthmofo
You may have reached the new limit imposed on concurrent TCP connectin attempts with SP2. The new limit is supposed to help stop the spread of worms and trojans (see below). Look to see if you have the following in your event log.
To search for the event go to Administrative Tools and click on Event Viewer then on the System log. Click on View in the menu bar then from the drop down menu select search. In the line for Event ID enter 4226 then click on Find Next.
Posted: Wed Dec 01, 2004 8:54 pm
by entropy13
Already thought of that and ran the "patch" the other night. No 4266 in event log either. This one is driving me NUTS!
Posted: Wed Dec 01, 2004 8:59 pm
by buckifan
You indicated that you cannot ping a remote host. Can you ping the local computer -- 127.0.0.1? If that works try to ping the your local host address and then the gateway.
If I were you I'd start backing up my important stuff. A clean install could be in your future.
Posted: Wed Dec 01, 2004 9:16 pm
by earthmofo
It should be Event ID 4226 not 4266. My error in the reply.
Posted: Wed Dec 01, 2004 9:18 pm
by entropy13
Ping to local host, router, ISP gateway, and 3 DNS all good. Ping to selected sites (weather.com, ebay, microsoft, excite) all time out. Ping to other sites (ie; speedguide) good also.
I'm gettin the same feeling about the clean install. My wife's desktop (which got my old mobo) is doin' same thing as this one. Could be a long weekend. . .
Posted: Wed Dec 01, 2004 9:25 pm
by entropy13
earthmofo-
did the same thing. . .correct search, incorrect with the "hunt & peck" on the KB. Thanks for the idea, though.
Posted: Wed Dec 01, 2004 9:29 pm
by earthmofo
Did you use Microsoft's Sysprep tool? If both machines have the same error it seems to be pointing to Sysprep as the cause.
Posted: Wed Dec 01, 2004 9:35 pm
by entropy13
Yup - right off the CD. I think we might have a corruption somewhere, but where? I've run regclean and uninstalled 'ghost' devices. Working on a few more of the TCP/IP settings right now as well. This one's pissed me off now, so I can't let it beat me!
Posted: Wed Dec 01, 2004 10:03 pm
by entropy13
The Computer Gods have smiled upon me!!!! Among my settings, I had turned off accidentally PMTU Discovery (Blackholes) and had my MTU settings messed up. Finally noticed running a TCP/IP analysois online. Ended up using another site (boo-hiss) tweaker to fix the problem. Now to see if i can repeat the fix on the wife's machine. Thanks for the brainstorming guys!!
Posted: Thu Dec 02, 2004 9:57 am
by buckifan
Good job. Most people(myself included) probably would have done a clean install of the OS by now.
Having PMTU discovery disabled would explain why some hosts were reachable and others were not. Black hole routers were encountered when trying to reach some hosts.
This one will be filed in my knowledge base.
Posted: Thu Dec 02, 2004 1:15 pm
by entropy13
I tried running some tracert last night to see where the breakdown was - since I could ping gateways. All of the "bad sites" timed out after about 10 hops or so. . .that got me wondering so I started checking my good ol' Cablenut settings and found it! THe MTU was wierd, though. Must have been resest in the the overinstall to something strange. Was able to repeat the procedure on my wife's machine so, I know that was what the problem was. Thanks again for the input.
