Evidence WinXP "security updates" may break Linux

[Stephen]

Could it be knoppix?
-Zipster

I don't see how it could be knoppix I have been using it for months and have never had a problem and I update the system at least once every day. So it is not knoppix (debian) causing any problem with network cards both my machines here work even better than they did when using windows to access the net.

I find it odd that some of the posters have run into this issue with windows 98 and xp systems not set to auto-update.

The really odd thing is all the troubles seem to be with machines that have linux and windows on a machine that has access to the internet even if it is "not" ?? using auto-updating. My machines have been free of the Micro-infestation since early last year and as I have already said work perfectly. So windows is the common factor and Microsoft has in the past used techniques (broken the law) to cripple other software makers products so that's the first place I would look for the source of the trouble.

[Harry Kuhman]

So, not meaning to troll here but I have yet to see this mentioned. Could it be knoppix? As I understand it, this is Debian unstable, and it booted and ran just fine, until after the apt-get update ran. I find it odd that some of the posters have run into this issue with windows 98 and xp systems not set to auto-update. I used an older knoppix (which sadly I cannot recall which one - certainly pre-May) to installl from and I am curious if this isnt the issue.

I don't think you're trolling at all; I think it's an important question to ask.

In my case I think it was one of two things that did this. I ran XP's windows update for the first time on my new HP notebook, and I also used Knoppix 3.2. I had been running Knoppix 3.1 fine for a couple of weeks without any problem. I'm just not certain if I ever ran 3.2 and also accessed the network sucessfully. I think I did, but I'm not 100% certain. After the XP windows "security update" I again ran Knoppix 3.2 and this was the first time I saw the network access problem. I went back to 3.1, but it also would not work.

I think it's worth mentioning here that I never did any "app gets" under Knoppix, never installed to my hard drive, and never used the network under Knoppix for anything other than web browsing and checking e-mail.

After a lot of digging I find that the configuration for the nic is now wrong. It's not a surprise that software that defaults to using it as configured fails, and Knoppix (both 3.2 and 3.1) apparently does this. Windows, on the other hand, obviously ignores the eeprom settings that are now wrong and configures the nic to work fine.

In addition to Microsoft's outright declairation of war on Linux, I have to wonder why any OS would not use the default configuration found in a nic eeprom. The whole purpose of this is eeprom is to let a manufacturer or advanced user configure the nic for what they consider optimum results. There is no reason to think these setting are bad unless you know someone is deliberately making them bad, so why override them? Plus, Microsoft has a long history of suck tricks, including software changes designed to hurt Java, Netscape, and others going back at least to DR DOS. This would be the first time to my knowledge that they harmed users hardware, but what other way could they use their software to affect Linux (given that they already have tools in place on the web that work against any non-IE browser and that isn't enough in their fight against Linux).

It is not a proven fact yet that M$ is doing this. Collectiing information is the reason for this thread. But I'm not seeing reports of a Linux only user who suddenly has the problem, only users who are also running Windows.

Yes, there can well be problems when you first install Knoppix to a hard drive. We have to look at those reports and ty to understand what happened in each case. But I don't see an indication that Knoppix is causing this as a trend; that trend seems to be reserved for Windows.

While I did run the "security update", you say that you did not when this happened to you. But M$ may have more than one way to skin a cat .... err penguin. You are aware, for example, are you not, that Media Player can report home any time and get instructions from Microsoft to do anything they want it to do? They actually have wording in the fine print of the licensing agreement that says you give them the right to disable any other software on you machine for any reason! This can certainly include other software that you have bought or free open source software that you have downloaded. There are also some "security updates" that they flag as critical, and don't bother to ask if you want to install.

But could this be some eeprom change that happened by accident from Knoppix? It seems unlikely for another reason. Not only does the eeprom change is a way that normally keeps the NIC from running properly, but the MAC address does not change, and the checksum for the eeprom is correctly set to a new checksum to match the new bogus settings. It strikes me that this has to be a pretty deliberate act to set the checksum corectly to it's new value.

Still, it's well worth asking, and the reason I worded this thread topic as I did. I think we need to have solid proof of this, and then go very public about it, whatever the cause.

[Harry Kuhman]

My plan is also to install another ethernet card (I had two identical, part of a phone networking kit) and try to use Knoppix through that. What I need though is really idiot proof instructions as to how to compare the eeprom settings and anything else on the 2 cards, so that if the previously unused one works, we can see why - can anyone help with this?

I pretty much ahve to give you the instructions I have laid out in detail in these threads already. Please go back and read through the previous posts, it should give you all the information you need. without knowing exactly what network cards you have and what chips are on them I can't tell you the exact diafnostic program to run anyway. But I think I''ve documented the steps I took and would ask others to take pretty clearly. Please read over them, think through what you are going to do, and ask any questions now before you start if something isn't clear.

What I would suggest:
Now, before you go to the new NIC, look at http://www.scyld.com/diag/index.html and download (from windows) the proper diagnostic utility for your NIC.
You'll need to compile this under Knoppix. Again, you can do this now, before your new NIC is installed and at risk. You boot Knoppix, open a shell, mount the hard drive as writeablle. and use the command line at the end of the file. You should be able to run the diag on your now bad nic before you switch to the new one. If any diag complains you need to be root to run it, just add " sudo " at the front of the command line.
Having done this should give you a good feeling that you are ready to swap nics. I would also record all of the information I can get from the diag for your card and from ethtool (in any knoppix since 3-May-03) for your old card, it will be very handy in comparing these values to the new uncorrupted card. If you have any questions when you get to this point ask again before you sawp the nics.


Then I would suggest then swapping Nics.

Do NOT run Windows with the new Nic before you take the next steps: Boot knoppix. See if you can get to the Internet (I just click the Knoppix link in the browser window that opens). Mount your hard drive as writeable (so you can easily pipe the output of the diagnostics to a file) and run the diagnostic you compiled, and ethtool, and collect all of the register and eeprom information that you can. Look at how the eeprom differs from the other NIC (obviously the MAC address and checksum will be different, but what else was changed?). And keep a record of these eeprom values. If your new Nic is changed again by something it will be very informative to return the Nic to it's proper state and see if it keeps happening.

PLEASE let us know how this goes. Ask questions and I or someone else will try to answer them. I do understand your wish for idiot proof instructions, I'm very greem with Linux myself and sometimes need to spend extra time with a man page for something that should be obvious to most Linux users. But there is no such thing as completely idiot proof, and I don't want to start writing instructions that begin with "make sure the computer is plugged in and connected to the monitor", and yes, I have taken support calls where these were the problems. If you've gotten this far you can likely do this with the information that has been posted so far, and it will be a very important contribution to this research (as well as getting your own system up and running again, and give you the tools to keep it up and running from what is changing the Nic to keep you from running Knoppix).

[stevethayne]

Hi Harry,
My intention was to install the "new" ethernet card in the spare slot on my pc, and to have both the "old" and "new" ones in the system at the same time. That way I can just swap the cable from one to the other, to see if one is working after the other is not(after reboot of course). Plan to do this tomorrow uk time...got a day off... and am dog tired now. Thanks for your help, will let you know how I get on.

Steve.

[Harry Kuhman]

My intention was to install the "new" ethernet card in the spare slot on my pc, and to have both the "old" and "new" ones in the system at the same time.

You should be able to do this, assuming, of course, your plug-and-pray bios likes the two nics and such. Knoppix should be pretty good about finding and using eth1 if that's where the ethernet is connected too (my experience, your results may vary). Give it a try, you can always yank the old card if there is a problem. I would still stress that you should lay the ground work and get the diagnostic you will use, compile it, and test it with the old card before you install the new card. Record all of the information you can.

I would also record the MAC address for the old card. You're going to have two of the same brand and model nic in the system, and you have no right to expect that eth0 will be the old one and eth1 will be the new one, it could well be the other way around. You'll need the MAC address to be sure which card is assigned eth0 from Knoppix. And it might not be the same card that Windows sees as the first ethernet card. I would also consider putting a mark along the top of one of the cards with a permanent marker so that I could tell them apart a month from now. In my case I would mark the old, now misconfigured, card with a black marker, but mark one in some way that you will be able to remember which one you marked (don't just put a mark on one and then try to remember later "Which on did I put this mark on, the new or the old?")

Good luck and please lkeep us current on your progress.

[stevethayne]

Hi Harry, and others
No joy in getting a connection to the net with the alternative network card. Had to wait 24 hours for the mac address to be registered with my provider. But then got no connection to the net through it, despite not having previously used the card with windows xp. I guess that doesn't disprove the windows xp connection, but it does add to the confusion for me. I wonder if father Knopper himself is aware of the difficulties we've been having.... Maybe he (or others) can write in a fix to the auto detect.

[Harry Kuhman]

No joy in getting a connection to the net with the alternative network card. Had to wait 24 hours for the mac address to be registered with my provider. But then got no connection to the net through it, despite not having previously used the card with windows xp.

The 24 hour wait is a killer. Will make it unlikely that you'll be able to swap cables on the NICs as you said you planned to do.

I would suggest that you might want to look into a DSL/Cable router link the Linksys. They are dirt cheap now and will avoid this problem for you, as well as providing an extra level of firewall protection and form the start of a local network for you. Thiis switch/router, and others like it that I have seen, allow you to "clone" the MAC address of the card that the cable company already knows about, and present that MAC address to the cable company. Of course, on the local side of the router it uses it's own MAC address and talks to your NIC with that MAC address just fine. In this case it would greatly help issolate the problem too. If your local network does not work then, the problem is certainly not with the cable company; if the local network works fine then you could well have an issue with the cable company.

Have you been able to learn anything about why the new NIC does not work? What types of errors are you seeing? Have you tried manually setting up the NIC rather than using DHCP? What step do you want to take next?

[stevethayne]

Hi Harry,
I'm writing this via a suse live connection. Having read another post, thought I'd try it, and it has connected to the net fine. Not sure what it does differently, but like you said in a nearlier post, it's no surprise that some live cds get around the problem in the same way that xp does.
The 24 hour wait was to have an additional mac address registered with the cable company. (they let me have registered at any one time). I tried to work out what the problem was. Again, my technical knowledge is limited here. But I tried writing down the settings from windows (from ipconfig /all) and replicating them in Morphix via sudo ethconfig (or something similar gleaned from a forum post!) Interestingly, the settings were quite different in Morphix. The IP address was different, though I think this is normal, that I don't have a static IP address with my cable connection. The gateway also seemed to be different. And the Host (I'm doing this from memory - might not have this exactly right) which I think should have been www.blueyonder.co.uk - this field was blank under Morphix. Also, when I tried using another Network config tool in Morphix, I was told that they were unable to get a response, which they said might be because the cable was unplugged, or because another process was in the way. (Got similar info from Knoppix)

Hope this helps - sorry it's all a bit vague. Will let you know if Suse live has problems connecting on subsequent boots. I far prefer Knoppix, so am hoping someone can combine Suse's workaround with Knoppix....

[Harry Kuhman]

Interestingly, the settings were quite different in Morphix.

Yea. I don't understand what has been done with Morphix. I thought it was to be pretty much a Knoppix distro with the appliications changed for a specific use. I got the 35 version of the "game" release, it had the same problem with my now misconfigured NIC that Knoppix does, but sudo mii-tool -r doesn't seem to correct it the way it does in Knoppix. They were nice enough to keep around the mii-tool command, as well as netcardconfig, but something has been changed so that it doesn't help. Wish I knew what, this might be another piece in the puzzle. If anyone knows what has been changed, please post back here. (And please post why it was changed if you know that too.)

By the way, the .35 game release of Morphix is OK as far as it goes, but they didn't fill the CD and there seem to be a number of games that could have been included that were not. Some games in the menu just don't seem to work though, like the Unreal Tournament 2003 demo (which seems strange for a live CD). With Knoppix removing games to make room for other things, Morphix is a nice project though, and I hope future releases have more games and less that don't run, and I sure hope I can figure out why I can't get my network interface working the same way I can get it working in Knoppix.

[Harry Kuhman]

I just came across something very strange with my NIC problem - and something that might help others who are having NIC problems but can't get the sudo mii-tool -r trick to work.

First of all, I just found this with the June 6 2003 release of Knoppix, but did some tests on my older version (5-16-03) and found it worked there as well. Have not checked with proir versions, but it likely works with them too.

I just got Knoppix working on my HP notebook with the NIC that used to work but stopped working after I installed XP security updates! Here's what happened: I booted Knoppix. Normally I just hit return at the boot prompt, but this time I typed in expert. I typed an n to all six of the optiions I was asked to allow me to reconfigure devices or load extra stuff. I would have expected that giving an n in each case would be just the same as taking the default boot, but somehow something is different - when I boot this way my NIC works properly without having to reset it with mii-tool!

I have no theory at all on what could be different in the boot process. I don't even have a good idea where to look next. It's a pain to boot this way, almost easier to just do a default boot and then run the two commands I use to get the network back. But it seems like there could be some important information on what is going on here if anyone has enough Linux network experience to figure out why the system is different if booted this way.

And yes, I have confirmed that the problem still exists with the 6-6-03 release if booted without the expert option.

Those others who have lost their ability to connect to the network at all when booting Knoppix might want to try booting this way and see if it helps you too. Pleae report back both sucess and failure so we can all continue to track this problem.

And if anyone has any thoughts on what I should look for on my system to help figure out why booting this way changes the way the network is started, please share them with me.