Knoppix 5.0 STRANGE INTERNET PROBLEMS!!!!

[Harry Kuhman]

Well i read the aritcles - very intersting.I checked the arp packets like u said, strangely though i realised that none of them this time had a destination address
all they were doing was my router was querying the mac address of 10.0.0.3 ( which is my ethernet card), and 10.0.0.3 replying with the mac address.
I also noticed that watever address i put for the broadcast address on knoppix 4.02 worked, with no problems. I also did arp -n in shell and noticed that the only address i have in the arp cache is my router 10.0.0.1.I logged into my router and looked at the settings, i found this. I am not sure if it will be useful.

WAN Statistic:
IP Address Subnet Mask MAC Address
172.26.12.163 255.255.0.0
....

Normally there should be some packets that go out to a broadcast address (not to a specifiic MAC address) that ethereal translates to something like "who has 10.0.0.3" and the computer with that address is expected to respond. This is how the routing tables get populated with the mac addresses in the first place. You may see more of this activity if other computers are turned on and if they try to do anything to your IP address, even a ping (or any local IP address, even one that is not in use, although there will obviously be no response for the ones not in use).

You should be able to watch the DHCP handshake if you do another netcardconfig after ethereal is started (I've actually never done this; I have observed the DHCP handshake on other systems as they start with the use of a hub to "sniff the wire", but I've never had occasion to watch my own DHCP handshake).

The subnet mask above does tell me something. You may remember that I said the 255.255.255.0 mask you use is common for class C routers but not often used for routers that use a 10 class address. Most home routers use an address in the 192.168.xxx.xxx range and use a 255.255.255.0 mask. This allows them an address space of 256 IP addresses including the loopback and broadcast address, supporting as many as 254 computers (although some of these routers save on memory and only support a smaller number of computers within this range). the 192.168 range is actuall a B class network, but it is sub-netted here to keep the router table sizes cost effective.

10 Class networks are A class networks and can support IP addresses from 10.0.0.0. to 10.255.255.255 (this large block is reserved for private networks and is not routable across the Internet). But since this would involve huge router tables, it is almost always divided into smaller sub-nets. This division is what the network mask is all about. As I hope you have already learned, the mask and the IP address together determine the broadcast address.

In your case you show a mask of 255.255.0.0. This is a very large network (65,534 computers) and is not typical of a home router. The thing is, a router at 10.0.0.1 and using a subnet mask of 255.255.0.0 should be sending out occasional broadcasts on the broadcast address of 10.0.255.255 and should be listening to that address for any other broadcasts ("who has 10.0.0.1" for example). Since your Knoppix system is listening for broadcasts and broadcasting itself on a broadcast address of either 255.255.255.255 or 10.0.0.255 and not 10.0.255.255 then it should not receive the broadcasts from the router and it's broadcasts should not recieve a response (by the way, are you forcing your NIC into permiscuious mode in ethereal? That may be what you need to do to see these off-target broadcasts, since otherwise the NIC will ignore them. Be sure to check your ethereal settings and run ethereal under root to make this work.)

So I'm still at a loss on why this works at all, and why it works well under 4.0.2. I don't know what your router is really broadcasting on or listening for broadcasts on (it should be 10.0.255.255 with that sub-net mask, but that is a much larger subnet than I would expect the router to support). I'm not real shocked that if the configuration is strange and everyone isn't agreeing on the same broadcast address that the system degrades in different ways for different versuions of Knoppix or other OSs. The important thing here is that all computers on the subnet have got to use te same broadcast address. The convention is that it's always the highest address based on the IP address and the mask. This is normally all taken care of for you by the router and DHCP so you don't need to look at it, but something is breaking down here and you want to get your ducks in a row and be sure that all computers on the sub-network (LAN) are using the same mask and broadcast address. You may or may not be able to change the mask in your router, but you should be able to manually make these settings in Knoppix and Windows if the DHCP handshake doesn't work.

[toppshatta]

Thanks again 4 replying. Right now im in knoppix 5.02 - im quickly typing this before i have to power off my modem again. I realised in ethereal ( using promisuous mode) that the router continually sends "who has" packets from 10.0.0.2 to 10.0.0.13. I also noticed that there were no replies.I also looked at the broadcast adress the router was broadcasting to and found that it had a mac adress of ff:ff:ff:ff:ff:ff i was really confused by this. Also when i tried to ping the bcast adress while the connection wa up and running 10.0.255.255. i didnt get any replies. however when i pinged that same address in knoppix 4.02 all the packets transmitted were recieved. I also pinged the bcast addressed 10.0.0.255 and 255.255.255.255 and had no prblems at all. My windows xp isnt up at al i did some madness with some .dll files and the system wont boot. i tried reinstalling but it says my hd has error so it cant install. So im stuck with knoppix.
Thanks again. im kinds busy so wil reply sumtime later

[Harry Kuhman]

I also looked at the broadcast adress the router was broadcasting to and found that it had a mac adress of ff:ff:ff:ff:ff:ff i was really confused by this.

That's actually OK, the way ethernet is designed to work. Remember, IP packets are just a software abstraction, at the lowest protocol level everything has to translate to an ethernet packet. So to broadcast to all MAC addresses, ethernet needs a "broadcast address" concept similar to the Broadcast address that TCP/IP uses. In the case of MAC address based ethernet, all ff's is the designated broadcast address.

I also pinged the bcast addressed 10.0.0.255 and 255.255.255.255 and had no prblems at all.

I'm not sure what this means or what happened. Pinging a broadcast address is, at best, bad form, as if it does decide that it can ping the address it could cause a lot of systems to respond at the same time. I suggest sticking to pinging the router, pinging other computers, or even pinging non existant addresses on your sub-net (I do this to force the system to try to figure out where that address is, which generates ARP packets.

My windows xp isnt up at al i did some madness with some .dll files and the system wont boot. i tried reinstalling but it says my hd has error so it cant install. So im stuck with knoppix.
Thanks again. im kinds busy so wil reply sumtime later

Too bad about the windows side being down, you would see some interesting Microsoft network broadcasts as it tries to keep the workgroup organized. But this isn't the heart of the problem. You'll want to focus on finding ARP packets and seeing what addresses they use. I just did this under Knoppix 5.0.2 running ethereal under root (sudo ethereal from a console) and it worked as expected (mostly, I'm having one annoying problem getting the diplay to update in real time rather than having to stop the capture to look at the packets).

You might want to put another Knoppix CD in the down windows system, that way you can generate ARP traffic on demand (just ping unused 10.0.0.xxx addresses from the other system).

Good luck. I really think this thing can be resolved, focus on what broadcast address the router is using and what broadcast your system is using. If you can reconfigure the mask (aka sub-net mask) in the router try setting it to 255.255.255.0 and using a broadcast address of 10.0.0.255 across your network). Otherwise use whatever broadcast address that the router insists on (unless it's 255.255.255.255, which I just don't see making sense). Keep me posted and I'll try to provide whatever help I can.

[toppshatta]

Yow!! its me agian.....i have away from ma pc 4 a while. but i have cme to the conclusion that i doubt th breakdown has to do with arp packets.Because i checked ethereal and most of the time when the connection deteriorated no arp transactions were taking place, just normal tcp. I aslo realisd that the arp packets were being sent at the begnning of the connection but generally stopped after a while, showing that i thibk that the arp has nothing to do with the deterioration (correct me if im wrong).i think probably it has to to do with my isp and modem configured for PPPoA rather than PPPoE, and knoppix 5.0 operating under PPPoE.it just a hunch im currently reading on the two to find out the diffence.Is there any way to check what PPP configuration i have in knoppix 4.02??
Again thanks a bunch

[Harry Kuhman]

I've been playing around a lot with ethereal too lately and I'm thinking it's not ARP either. Although on my systems I see arp packerts ever few minutes (not just "at the beginning"), these arp broadcasts are to the mac broadcast address (all ff's), not the IP broadcast address.

Yes, it could be PPPoE/PPPoA related. But once again if you have a modem with a router you really need to look over the router configuration and see if you can't set it up properly.

I have PPPoE in the USA, and although I have several routers I think none of them have a PPPoA option (I know there is none on my current router and I don't recall seeing one on the others). But I know that routers sold for countries that use PPPoA rather than PPPoE should have PPPoA support.

When I go into my router setup, one of the first things that I have to configure is what I'm connecting to, and when I select a DSL modem I them have to enter my username and account. Since your router would always connect to the DSL modem I would not expect the type of connection setup option, but I still would think that you should be configuring the account access in ther router setup. That will allow the router to log in to the ISP for you and deal with the PPPoE or PPPoA protocol for you. Once that is taken care of, you should not need to run any PPPoE or PPPoA software on your computers (I don't run it under Linux or Windows).

I think you can figure this out by looking at the router setup. But if you can't and the ISP support people remain useless, then try seeing if tou can get some answers form the modem/router manufacturer. And even consider making some screen shots of what you see when you go into the router configuration, posting them somewhere, and posting links here along with an explination of what you need a better understanding of.