TripleM
Level: Smitemaster
Rank Points: 1373
Registered: 02-05-2003
IP: Logged

This is starting to really annoy me, so I'm hoping there are some people here who may have some clue what is going on.

This is basically what is happening:

a) I try to load a particular website (project management website, so no point in giving you the URL, but see below). Website loads perfectly fine.
b) The instant I try to load another page on this website, it tries to connect to the site for a while then gives a network timeout (ie the Firefox version of any time out error message).
c) I cannot access this site for approximately 5 minutes, where I can suddenly load another page.
d) It then dies again.
e) After this has happened a few times, it continues to work for a while. Sometimes for hours. But then a few hours later, or perhaps the next day, it all happens again.

Now, before you say there is a problem with that particular website:

1) Other people can access the website while I am unable to.
2) I can ping + tracert the website fine.
3) I can access other websites at the same time.
4) I can't access the site in any browser, not just Firefox.
5) Often it doesn't even get through a full page load; eg it loads the HTML, but times out trying to load some images on the page.
6) It has been happening A LOT for this particular website recently. However, I have experienced the problem sporadically on other websites; including google, where google.co.nz dies and I switch to google.com for a search instead. For some sites for which this has happened that I have been working on, I haven't been able to connect with FTP either.
7) I have tried switching DNS to another providers DNS. No change.
8) Yes, have run virus/spyware scans etc.
9) Am on a wireless connection, but plugging directly into the router doesn't seem to solve anything.

Does anybody have any ideas whatsoever as to what could be happening, or any way at all that I can debug this more? Would something like Wireshark give anybody useful info or would it be 'too late' by the time it reaches that part?

Help.

Maurog
Level: Smitemaster

Rank Points: 1501
Registered: 09-16-2004
IP: Logged

I am by no means an expert, but it really looks like the problem is in your ISP.

Perhaps some draconian anti-spam settings make it confuse the interactions of that specific website with a DOS attack and it slams the communication down.

____________________________
Slay the living! Raise the dead!
Paint the sky in crimson red!

Briareos
Level: Smitemaster

Rank Points: 3516
Registered: 08-07-2005
IP: Logged

Well, the "no access for 5 minutes" thing sounds like Windows (you are using Windows, I assume?) caching a negative DNS request for the site (which would cause such symptoms, and 5 minutes is the Windows default time-to-live for such negative DNS responses), wherever that is coming from.

If that's really the case you should be able to immediately unhork this by running "ipconfig /flushdns" on the command line. Of course you'll then still have to figure out where that bogus DNS response is coming from ("ipconfig /displaydns" might help), but if you need a workaround it'll probably help to add the IP address of the site to your hosts file (i.e. "C:\WINDOWS\system32\Drivers\etc\hosts") to make sure it always resolves to where it should...

Just a guess, though - then again, you shouldn't be able to ping the site either if the DNS entry is horked. Another cause could be if your provider has some kind of transparent proxy crap going on...

Of course Wireshark should be able to help pinpoint the problem, just make sure you run it before trying to connect to the site for the first time. Right-clicking on an entry and choosing "Follow TCP stream" is very useful in following an HTTP request, but make sure to clear the filter this sets afterwards or you'll be wondering where the rest of the capture went...

np: Cage - I Never Knew You (I Never Knew You)

____________________________
"I'm not anti-anything, I'm anti-everything, it fits better." - Sole
R.I.P. Robert Feldhoff (1962-2009)

---

[Last edited by Briareos at 11-25-2009 01:59 PM]

TripleM
Level: Smitemaster
Rank Points: 1373
Registered: 02-05-2003
IP: Logged

Quick update - (and I had tried flushing the DNS sadly ) - was just checking router logs, and finally noticed something useful.

**SYN Flood to Host** 192.168.1.9, 53917->> 72.3.156.117, 80 (from PVC1 Outbound)

I'm getting that (once for each of the 5 minute intervals where it doesn't work), which is the website I'm having problems with. The other website it happened for me recently was also listed with a SYN Flood.

Briareos
Level: Smitemaster

Rank Points: 3516
Registered: 08-07-2005
IP: Logged

TripleM wrote:
I'm getting that (once for each of the 5 minute intervals where it doesn't work), which is the website I'm having problems with. The other website it happened for me recently was also listed with a SYN Flood.

Well, in that case it's probably time to deactivate your router's SYN flood protection (if possible) if it interferes with your normal use...

np: Speedy J - Extruma (G Spot)

____________________________
"I'm not anti-anything, I'm anti-everything, it fits better." - Sole
R.I.P. Robert Feldhoff (1962-2009)

---

[Last edited by Briareos at 11-27-2009 12:18 AM]

TripleM
Level: Smitemaster
Rank Points: 1373
Registered: 02-05-2003
IP: Logged

Well, there wasn't a way to disable that without lowering the firewall security level significantly, which I was a little hesitant in doing. However, now that I had something to work with I eventually found something useful with a google search:

I have the same router (SMC Barricade 7008ABR) and I noticed I was getting these same "SYN Flood" messages in my log. Eventually I found the culprit -- in my case it was Google Maps. I've always had problems with maps never fully loading (lots of gray tiles) and I finally realized that the problem was the number of connections that Google Maps keeps open at once. The firewall thought they were a denial of service attack and was blocking them. I just increased the maximum number of connections allowed and the problem went away -- no more SYN Flood messages so far and Google Maps finally works.

The setting is called "Maximum incomplete TCP/UDP sessions number from same host" and is found under "Advanced Setup > Firewall > Intrusion Detection". I increased mine from 10 to 50 and it seems to be working well.

This problem has plagued me forever! I came across this thread in my search and wanted to post what I found in case it's helpful

Different router, but same setting exists, and was also set to 10. That explains why I always struggled to load google maps properly as well..

Woot Thanks for the replies.