Knoppix 5.0 STRANGE INTERNET PROBLEMS!!!! [Archive] - Download Knoppix Live CD or DVD, Get Documentation and Help

View Full Version : Knoppix 5.0 STRANGE INTERNET PROBLEMS!!!!

toppshatta

06-23-2006, 11:31 PM

i recently tried knoppix 5.0. i used 4.02 before. I have a pci nic which connects to my adsl modem.
When i boot to knoppix 4.02. The internet works just fine i can surf painlessly, but in version 5.01
i cannot connect to the net. i checked online (using 4.02) for help, i got a tip. i ran netcardconfig. i used dhcp, it
returned everything was ok, but i still couldnt surf. i tried not using dhcp, and i put in the values i got from
ifconfig. suprisingly it worked fine, but after a few minutes it deteriorated, and i was unable to surf again.when i tried
running netcardconfig with dhcp it returned an error.
I had to switch off my modem and try netcardconfig again, put it the same values, it would work fine, but after a few minutes i would get an error on firefox or any other browers i used!! this is starnge to me as i am somewhat of a beginner at this. please help me!!

Harry Kuhman

06-23-2006, 11:59 PM

I have a pci nic which connects to my adsl modem.... i used dhcp a, it
returned everything was ok, but i still couldnt surf. i tried not using dhcp access, and i put in the values i got from
ifconfig. suprisingly it worked fine, but after a few minutes it deteriorated, and i was unable to surf again.when i tried
running netcardconfig with dhcp it returned an error...
You're not giving us the right information to help you. Does this modem have a built in router? (It sounds like it does but you are not saying.) You're not even telling us what modem it is, which would be a help if anyone was will to do your work and look up the modem specs. You don't tell us what settings you use when you manually do the netcardconfig, which migth help us spot a problem if that's where the problem is, you don't tell us what settings DHCP normally sets up (the output of ifconfig). You say "it returned an error" but you don't even bother to record the error and tell us what it is.

toppshatta

06-24-2006, 01:34 AM

well thanks for respondimg so quickly. my modem does have a built in router, the modem is a typical usb/ethernet adsl modem (starbridge pyxis 210,
i noticed when i checked my modem settings it has PPOA-VC MUX enabled)When i do ifconfig before i do anything to the netwrok settings on knoppix 5.01 i get

eth0 Link encap:Ethernet HWaddr 00:80:AD:88:40:56
inet addr:10.0.0.3 Bcast:255.255.255.255 Mask:255.255.255.0
inet6 addr: fe80::280:adff:fe88:4056/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:336 errors:0 dropped:0 overruns:0 frame:0
TX packets:357 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:315485 (308.0 KiB) TX bytes:99210 (96.8 KiB)
Interrupt:18 Base address:0xe800

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:10 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:500 (500.0 b) TX bytes:500 (500.0 b)

As for the settings i used when i manually do netcard config is:

Ip for eth0 : 10.0.0.3
network mask for eth0: 255.255.255.0
broadcast address for eth0 : 255.255.255.255
default GW: 10.0.0.1
DNS: 10.0.0.1

After about a minute of browsing i get this error on knoquerer:

An error occurred while loading http://www.knopper.net/knoppix/:
Unknown host www.knopper.net

And mozilla returns a similar error.

Then i ran netcardconfig again using DHCP broadcast i get this:

Sendimg DHCP broadcast from device eth0 Operation failed.
Failed.
Hit return to exit.

Then i ran ifconfig again and i get this:

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:21 errors:0 dropped:0 overruns:0 frame:0
TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1576 (1.5 KiB) TX bytes:1576 (1.5 KiB)

Some how my eth0 cant be detected.

I have to switch my modem off and on again then manually do netcardconfig again for it to work then after a minute i would get an error again.
I'm really lost lol .Thanks for the help

Harry Kuhman

06-24-2006, 01:57 AM

.... my modem does not have a built in router its a typical usb/ethernet adsl modem (starbridge pyxis 210)
I haven't looked the modem up (a little busy now), but I have no idea what is going on or how any of what you report is happening if the modem does not include a router and if you are not running any PPPoE software. All I know says that should not work at all. I think you should do some research on the modem. Of course, if it does include a router that still doesn't solve your main problem. I think that is because your broadcast address makes no sense at all. But I would need a better understanding of your hardware to give you a certain answer. 10.xx.xxx.xxx addresses are not usually used with class C size nets, but based on the 10 address that you showed and the mask that you showed I would try a broadcast address of 10.0.0.255. It makes sense that you would have problems after a few minutes if the ARP protocol breaks down, which it would with a bogus broadcast address.

Harry Kuhman

06-24-2006, 05:39 AM

So you edited your post to remove the "not" about your modem having a router. But did the broadcast address that I gave you resolve the problem?

I should add that every computer on the local LAN must use the same broadcast address, so just changing it on the Knoppix system may not help if the other kids are not playing by the same rules. And the router needs to use the same broadcast address too. If the address that I gave you does not resolve things my next suggestion would be to use protocol analyzer software like ethereal to watch the ARP packets that the router sends out and match the broadcast address in the Knoppix system and any other computer on your network to the address that the router uses.

Thanks for the confirmation that the modem has a router, your original response that it did not made no sense.

toppshatta

06-24-2006, 04:32 PM

Again thanks for responding so quickly. yes my modem does have a router( lol i did some reading) , its adress is 10.0.0.1 ( the same address i used in netcardconfig for default gateway) duh lol. newayz the boroadcast address you told me worked, but it detiorated again after a few minutes.but i tried it
on knoppix 4.02 and it worked just fine, had no problems at all. probably its a bug or sumthing in knoppix 5.01.By the way im the only person behind my router, so i guess im the only person on my lan.( forgive me if i sound stupid, but im reading so by the next post i'll be sure as im a beginner in this whole networking thing). and yes i used ethereal and the arp packets were sent to 255.255.255.255. however when i do dchp on knoppix 4.02 it works fine
and i get a broadcast address 255.255.255.255, but as i siad before i used this value before on knoppix 5.02 and it still detiorated after a minute or so.
Thanks for your help man really appreciate it.
Can u suggest a place for a good networking tutorial?? thanks again

Harry Kuhman

06-24-2006, 06:23 PM

I don't know what te issue is. Yes, it could be a problem in 5.0.1, but I have not seen it on my 5.0.1 (maybe I'm not running long enough though, although I was thinking it happened in just a few minutes). BUt it does seem more likely an issue with your network, and the 255.255.255.255 broadcast address really throws me. You might want to look at the router setup and see if these are user settable settngs that might have been screwed up. I would also uggest looking to see if there is a newer firmware version that you could download and flash the router with.

Yes, I hope you are the only person on your router. As long as it doesn't have wireless capability and your systems have not been taken over by an evil hacker I expect that is the case.

Sorry, I don't have any one good source for networking information. But you can find links to all you need and more at Google. For example this simple search (http://www.google.com/search?hl=en&q=broadcast+mask+IP&btnG=Google+Search) will give plenty of links that help you understand broadcast addresses and should help you see why your 255.255.255.255 address makes no sense to me. But be warned, you just can't trust everything you read on the Internet. In this case the very first link that I got with the search (your links may be different, Google is funny that way) was www.net.princeton.edu/iprouters (http://www.net.princeton.edu/iprouters.html) and it's information is dead wrong! Broadcast addresses must never end in zero as it shows them doing. But the second link that I got was www.tldp.org/HOWTO/archived/IP-Subnetworking/IP-Subnetworking-3 (http://www.tldp.org/HOWTO/archived/IP-Subnetworking/IP-Subnetworking-3.html) and it gives a much better (and correct) description of the broadcast address. I expect that you could learn a lot just by starting at any network term in Wikipedia and reading the article and following links. And here is a good one on the broadcast address (http://en.wikipedia.org/wiki/Broadcast_address) to start with. If you read nothing else I give in links, read this. Also, it would be good to learn to read and use the RFC's and fall back to them when you have a question on how things work.

Back to the problem, I'm running out of ideas. You could say it is maybe a bug in 5.0.1, but that doesn't help you and may not help get a bug fixed if there is one. The best thing that I can think of doing (if there is no firmware update that fixes this), would be to watch the packets with ethereal and see what is happening as things break down. Are you still seeing your requests go out? Do you get any sort of responses? Can you do other things like simple pings when things start falling apart? What has been happening on ARP while all of this goes on? Do you still see ARP packets at regular intervals as the systems announce themselves and try to keep the router tables current? (hint: do this for a while with 4.0.2 and/or Windows so that you can watch a functioning system and get a feel for how ARP works before you watch it go to hell with 5.0.1). If you can find and document a bug with 5.0.1 then that gives you a much better chance to report it and get it fixed in the next release than to just hope that someone else does it (someone else doesn't have your router with the wacky broadcast address).

Harry Kuhman

06-24-2006, 06:27 PM

By the way, read this Wikipedia article (http://en.wikipedia.org/wiki/Address_Resolution_Protocol) too. I don't know that this is an ARP issue, but the way that you say it degrades in a few minutes makes me suspect that it could be.

toppshatta

06-24-2006, 07:45 PM

Thanks again man. I am actualy busy reading the articles u gave me.I'll post ne thing interesting i find ASAP. Thanks again

toppshatta

06-24-2006, 08:57 PM

Harry Kuhman

06-24-2006, 11:37 PM

Well i read the aritcles - very intersting.I checked the arp packets like u said, strangely though i realised that none of them this time had a destination address
all they were doing was my router was querying the mac address of 10.0.0.3 ( which is my ethernet card), and 10.0.0.3 replying with the mac address.
I also noticed that watever address i put for the broadcast address on knoppix 4.02 worked, with no problems. I also did arp -n in shell and noticed that the only address i have in the arp cache is my router 10.0.0.1.I logged into my router and looked at the settings, i found this. I am not sure if it will be useful.

WAN Statistic:
IP Address Subnet Mask MAC Address
172.26.12.163 255.255.0.0
....

Normally there should be some packets that go out to a broadcast address (not to a specifiic MAC address) that ethereal translates to something like "who has 10.0.0.3" and the computer with that address is expected to respond. This is how the routing tables get populated with the mac addresses in the first place. You may see more of this activity if other computers are turned on and if they try to do anything to your IP address, even a ping (or any local IP address, even one that is not in use, although there will obviously be no response for the ones not in use).

You should be able to watch the DHCP handshake if you do another netcardconfig after ethereal is started (I've actually never done this; I have observed the DHCP handshake on other systems as they start with the use of a hub to "sniff the wire", but I've never had occasion to watch my own DHCP handshake).

The subnet mask above does tell me something. You may remember that I said the 255.255.255.0 mask you use is common for class C routers but not often used for routers that use a 10 class address. Most home routers use an address in the 192.168.xxx.xxx range and use a 255.255.255.0 mask. This allows them an address space of 256 IP addresses including the loopback and broadcast address, supporting as many as 254 computers (although some of these routers save on memory and only support a smaller number of computers within this range). the 192.168 range is actuall a B class network, but it is sub-netted here to keep the router table sizes cost effective.

10 Class networks are A class networks and can support IP addresses from 10.0.0.0. to 10.255.255.255 (this large block is reserved for private networks and is not routable across the Internet). But since this would involve huge router tables, it is almost always divided into smaller sub-nets. This division is what the network mask is all about. As I hope you have already learned, the mask and the IP address together determine the broadcast address.

In your case you show a mask of 255.255.0.0. This is a very large network (65,534 computers) and is not typical of a home router. The thing is, a router at 10.0.0.1 and using a subnet mask of 255.255.0.0 should be sending out occasional broadcasts on the broadcast address of 10.0.255.255 and should be listening to that address for any other broadcasts ("who has 10.0.0.1" for example). Since your Knoppix system is listening for broadcasts and broadcasting itself on a broadcast address of either 255.255.255.255 or 10.0.0.255 and not 10.0.255.255 then it should not receive the broadcasts from the router and it's broadcasts should not recieve a response (by the way, are you forcing your NIC into permiscuious mode in ethereal? That may be what you need to do to see these off-target broadcasts, since otherwise the NIC will ignore them. Be sure to check your ethereal settings and run ethereal under root to make this work.)

So I'm still at a loss on why this works at all, and why it works well under 4.0.2. I don't know what your router is really broadcasting on or listening for broadcasts on (it should be 10.0.255.255 with that sub-net mask, but that is a much larger subnet than I would expect the router to support). I'm not real shocked that if the configuration is strange and everyone isn't agreeing on the same broadcast address that the system degrades in different ways for different versuions of Knoppix or other OSs. The important thing here is that all computers on the subnet have got to use te same broadcast address. The convention is that it's always the highest address based on the IP address and the mask. This is normally all taken care of for you by the router and DHCP so you don't need to look at it, but something is breaking down here and you want to get your ducks in a row and be sure that all computers on the sub-network (LAN) are using the same mask and broadcast address. You may or may not be able to change the mask in your router, but you should be able to manually make these settings in Knoppix and Windows if the DHCP handshake doesn't work.

toppshatta

06-25-2006, 12:34 AM

Thanks again 4 replying. Right now im in knoppix 5.02 - im quickly typing this before i have to power off my modem again. I realised in ethereal ( using promisuous mode) that the router continually sends "who has" packets from 10.0.0.2 to 10.0.0.13. I also noticed that there were no replies.I also looked at the broadcast adress the router was broadcasting to and found that it had a mac adress of ff:ff:ff:ff:ff:ff i was really confused by this. Also when i tried to ping the bcast adress while the connection wa up and running 10.0.255.255. i didnt get any replies. however when i pinged that same address in knoppix 4.02 all the packets transmitted were recieved. I also pinged the bcast addressed 10.0.0.255 and 255.255.255.255 and had no prblems at all. My windows xp isnt up at al i did some madness with some .dll files and the system wont boot. i tried reinstalling but it says my hd has error so it cant install. So im stuck with knoppix.
Thanks again. im kinds busy so wil reply sumtime later

Harry Kuhman

06-25-2006, 01:39 AM

I also looked at the broadcast adress the router was broadcasting to and found that it had a mac adress of ff:ff:ff:ff:ff:ff i was really confused by this.
That's actually OK, the way ethernet is designed to work. Remember, IP packets are just a software abstraction, at the lowest protocol level everything has to translate to an ethernet packet. So to broadcast to all MAC addresses, ethernet needs a "broadcast address" concept similar to the Broadcast address that TCP/IP uses. In the case of MAC address based ethernet, all ff's is the designated broadcast address.

I also pinged the bcast addressed 10.0.0.255 and 255.255.255.255 and had no prblems at all.
I'm not sure what this means or what happened. Pinging a broadcast address is, at best, bad form, as if it does decide that it can ping the address it could cause a lot of systems to respond at the same time. I suggest sticking to pinging the router, pinging other computers, or even pinging non existant addresses on your sub-net (I do this to force the system to try to figure out where that address is, which generates ARP packets.

My windows xp isnt up at al i did some madness with some .dll files and the system wont boot. i tried reinstalling but it says my hd has error so it cant install. So im stuck with knoppix.
Thanks again. im kinds busy so wil reply sumtime later
Too bad about the windows side being down, you would see some interesting Microsoft network broadcasts as it tries to keep the workgroup organized. But this isn't the heart of the problem. You'll want to focus on finding ARP packets and seeing what addresses they use. I just did this under Knoppix 5.0.2 running ethereal under root (sudo ethereal from a console) and it worked as expected (mostly, I'm having one annoying problem getting the diplay to update in real time rather than having to stop the capture to look at the packets).

You might want to put another Knoppix CD in the down windows system, that way you can generate ARP traffic on demand (just ping unused 10.0.0.xxx addresses from the other system).

Good luck. I really think this thing can be resolved, focus on what broadcast address the router is using and what broadcast your system is using. If you can reconfigure the mask (aka sub-net mask) in the router try setting it to 255.255.255.0 and using a broadcast address of 10.0.0.255 across your network). Otherwise use whatever broadcast address that the router insists on (unless it's 255.255.255.255, which I just don't see making sense). Keep me posted and I'll try to provide whatever help I can.

toppshatta

06-30-2006, 04:34 PM

Yow!! its me agian.....i have away from ma pc 4 a while. but i have cme to the conclusion that i doubt th breakdown has to do with arp packets.Because i checked ethereal and most of the time when the connection deteriorated no arp transactions were taking place, just normal tcp. I aslo realisd that the arp packets were being sent at the begnning of the connection but generally stopped after a while, showing that i thibk that the arp has nothing to do with the deterioration (correct me if im wrong).i think probably it has to to do with my isp and modem configured for PPPoA rather than PPPoE, and knoppix 5.0 operating under PPPoE.it just a hunch im currently reading on the two to find out the diffence.Is there any way to check what PPP configuration i have in knoppix 4.02??
Again thanks a bunch

Harry Kuhman

06-30-2006, 07:10 PM

I've been playing around a lot with ethereal too lately and I'm thinking it's not ARP either. Although on my systems I see arp packerts ever few minutes (not just "at the beginning"), these arp broadcasts are to the mac broadcast address (all ff's), not the IP broadcast address.

Yes, it could be PPPoE/PPPoA related. But once again if you have a modem with a router you really need to look over the router configuration and see if you can't set it up properly.

I have PPPoE in the USA, and although I have several routers I think none of them have a PPPoA option (I know there is none on my current router and I don't recall seeing one on the others). But I know that routers sold for countries that use PPPoA rather than PPPoE should have PPPoA support.

When I go into my router setup, one of the first things that I have to configure is what I'm connecting to, and when I select a DSL modem I them have to enter my username and account. Since your router would always connect to the DSL modem I would not expect the type of connection setup option, but I still would think that you should be configuring the account access in ther router setup. That will allow the router to log in to the ISP for you and deal with the PPPoE or PPPoA protocol for you. Once that is taken care of, you should not need to run any PPPoE or PPPoA software on your computers (I don't run it under Linux or Windows).

I think you can figure this out by looking at the router setup. But if you can't and the ISP support people remain useless, then try seeing if tou can get some answers form the modem/router manufacturer. And even consider making some screen shots of what you see when you go into the router configuration, posting them somewhere, and posting links here along with an explination of what you need a better understanding of.