Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[kitz]

Are you using their proxy?

It certainly looks like you are - the fact that all your hops are hidden does seem to imply some sort of proxy
According to the link you can turn it off.

Alternatively is there any other (security) proxy that you could be using?
If the proxy server is busy it can and does cause stuttering.

[ClownBoy]

Sorry Kitz,

I don't know how to check whether or not I am using their proxy.

Also don't know anything about using another proxy.

Can you enlighten me please?

Your continuing help is really appreciated.

Thanks.

[kitz]

Try this

http://www.lagado.com/proxy-test

[ClownBoy]

Not using a proxy according to those 2 tests.

 

[kitz]

did you also try the cache test?

Details how to do this http://www.lagado.com/tools/cache-test

[ClownBoy]

Yes, tried both of the tests.

The number on the second test (cache) changed I ran the test twice.

[kitz]

ok sorry damn really thought it may have been that for a short while then :/

Anyone else got any ideas what else could be causing the non-hops..  and why 1st hop is location?

[roseway]

I'm baffled, I'm afraid.

[kitz]

Im not sure tbh if it could or not.  The hosts file can alter the hop names (as in fact you can see on one of my traces that I have it set so that it shows "Juniper 1" rather than the router IP - something I did a long time ago to easily be able to see which gateway I was connected to.  You can also redirect.

It is worth checking the host file just to see if there is anything in there.
http://www.kitz.co.uk/security/hostsfile.htm

Something else perhaps worth trying is a reverse tracert.
Try the visualroute one http://visualroute.visualware.com/

Let it trace to your IP - click start
Let it run for a min.
Then go to the "table" tab to see the output.
Next click on the "page" button at top right and it will open another windwo

Copy the results
If you want the forum software to keep any formatting spaces wrap the output with code[] tags which you can easily do by using the button just above the row of smilies.

- for comparison

Code: [Select]

VisualRoute Connection Test to 81.174.xxx.xxx
Performed on 26 Nov 2007 11:09:24 GMT
--------------------------------------------------------------------------------------------

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| Hop | %loss | IP Address      | Node Name                               | Location            | ms  | Graph      | Network                                                    |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| 0   | 0     | 205.234.111.204 | DTG311.visualware.com                   | Ashburn, VA, USA?   | -   |            | Defender Technologies Group  LLC DEFENDER-1                |
| 1   | 0     | 205.234.111.129 | r03-8.iad.defenderhosting.com           | Washington, DC, USA | 0   | +          | Defender Technologies Group  LLC DEFENDER-1                |
| 2   | 0     | 69.65.112.25    | r01.iad.defenderhosting.com             | Washington, DC, USA | 0   | +          | Defender Technologies Group  LLC DEFENDER-1                |
| 3   | 0     | 69.65.112.77    | unknown77.112.65.69.defenderhosting.com | Ashburn, VA, USA?   | 0   | +          | Defender Technologies Group  LLC DEFENDER-1                |
| 4   | 0     | 205.234.224.81  | v960.ar1.iad1.us.scnet.net              | Washington, DC, USA | 0   | +          | Server Central Network SCN-4                               |
| 5   | 20    | 216.246.102.97  | 52.ae0.cr1.iad1.us.scnet.net            | Washington, DC, USA | 0   | +          | Server Central Network SCN-5                               |
| 6   | 20    | 216.246.36.201  | 102.xe-1-2-0.cr1.iad1.us.scnet.net      | Washington, DC, USA | 0   | +          | Server Central Network SCN-5                               |
| 7   | 0     | 69.31.31.154    | xe-2-1-0.cr2.iad1.us.nlayer.net         | Dulles, VA, USA     | 2   | +-         | nLayer Communications Internal/Backbone NLYR-69-31-31-0-1  |
| 8   | 10    | 69.22.142.38    | xe-1-3-0.cr2.nyc3.us.nlayer.net         | New York, NY, USA   | 5   | +          | nLayer Communications Internal/Backbone NLYR-69-22-141-0-1 |
| 9   | 0     | 213.200.73.117  | xe-2-0-0.nyc22.ip.tiscali.net           | New York, NY, USA   | 83  |   +        | Tiscali International Network B.V.                         |
| 10  | 0     | 89.149.186.81   | xe-1-0-0.lon20.ip.tiscali.net           | London, UK          | 87  |   +--      | Tiscali International Network B.V.                         |
| 11  | 0     | 213.200.79.234  | plusnet-gw.ip.tiscali.net               | (Germany)?          | 115 |   -+------ | Tiscali International Network B.V.                         |
| 12  | 0     | 212.159.0.186   | te2-2.pte-gw1.plus.net                  | London, UK?         | 74  |   +        | Access LAN                                                 |
| 13  | 0     | 212.159.4.19    | vl23.thn-gw1.plus.net                   | (United Kingdom)?   | 74  |   +        | Dial Cluster                                               |
| 14  | 0     | 212.159.1.53    | ae0-102.ptn-gw01.plus.net               | London, UK?         | 75  |   +        | Access LAN                                                 |
| 15  | 0     | 84.92.3.10      | gi9-0-303.ptn-ag1.plus.net              | (United Kingdom)?   | 75  |   +        | PlusNet Core Network Infrastructure                        |
| 16  | 0     | 81.174.xxx.xx   | 81-174-1xx-xx.plus.com                  | (United Kingdom)?   | 90  |   +-       | Dial-up and ADSL pool                                      |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[mr_chris]

The only explanation that I can come up with is that when you perform a traceroute, *something* e.g. your router, or a piece of firewall software, is re-writing the "TTL" part of the IP header that traceroute sends out. (traceroute explanation below if anyone's interested)

Do these weird traceroutes happen with both of your routers? If so, I'd look towards something installed on your PC.

Do you have any firewall software on there? If so, what is it, and does it work better when you disable the firewall.

I'm tempted to ask you to download and run HiJack This - Do a scan and save a logfile, then please attach it to a post on here, you might have something weird that needs getting rid of.

It can't be a proxy because proxy servers will only intercept HTTP requests, and a traceroute sends out ICMPs, so there's no real point investigating the proxy route further.

Other than that, I'm stumped as well, I've never seen this kind of behaviour before!

[mr_chris]

Explanation: How does Traceroute work?

When you send out a packet destined for a particular location on a routed IP network (e.g. the Internet), there is a field in the header called "Time-To-Live" or TTL. This is initially set to a value e.g. 255.

Each time the packet goes through a router, the router decreases the TTL field by one. If the TTL reaches zero, the packet is killed and the router sends a "TTL expired in transit" response back to the source. This prevents an endless bottleneck when routers are misconfigured resulting in a routing loop (where 2 routers are forwarding traffic to each other creating a loop, which I'm sure a few people will remember happening a few times from BT Internet dialup days!).

Traceroute uses this TTL functionality to find out the address of each hop on the network. It creates an ICMP packet destined for the destination IP address and sets the TTL to 1, which means the first hop will expire the packet and send an "expired in transit" response back. Traceroute intercepts this response and displays the first hop.

It then sets the TTL to 2 and sends the packet out again, this time the first router will decrease TTL to 1, and pass the packet on. The second router will decrease TTL to zero, and then send the "expired in transit" response back. Traceroute intercepts this response and displays it as the second hop.

And so on. Quite clever but simple really, and actually I see it as a bit of a 'hack' utility because of how it works!

[ClownBoy]

Code: [Select]

--------------------------------------------------------------------------------------------
VisualRoute Connection Test to 85.210.174.237
Performed on 26 Nov 2007 19:42:31 GMT
--------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------------------------------------------------------------
| Hop | %loss | IP Address      | Node Name                               | Location               | ms | Graph      | Network                                     |
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
| 0   | 0     | 205.234.111.204 | DTG311.visualware.com                   | Ashburn, VA, USA?      | -  |            | Defender Technologies Group  LLC DEFENDER-1 |
| 1   | 0     | 205.234.111.129 | r03-8.iad.defenderhosting.com           | Washington, DC, USA    | 0  | +          | Defender Technologies Group  LLC DEFENDER-1 |
| 2   | 0     | 69.65.112.25    | r01.iad.defenderhosting.com             | Washington, DC, USA    | 11 | +--------  | Defender Technologies Group  LLC DEFENDER-1 |
| 3   | 0     | 69.65.112.77    | unknown77.112.65.69.defenderhosting.com | Ashburn, VA, USA?      | 10 | +--------  | Defender Technologies Group  LLC DEFENDER-1 |
| 4   | 0     | 205.234.224.81  | v960.ar1.iad1.us.scnet.net              | Washington, DC, USA    | 0  | +-         | Server Central Network SCN-4                |
| 5   | 0     | 216.246.102.97  | 52.ae0.cr1.iad1.us.scnet.net            | Washington, DC, USA    | 0  | +-         | Server Central Network SCN-5                |
| 6   | 0     | 216.246.102.150 | xe-1-2-0.cr1.ams2.nl.scnet.net          | Amsterdam, Netherlands | 86 |       +--  | Server Central Network SCN-5                |
| 7   | 0     | 195.69.144.95   | te1-3.cr01.nik.bb.pipex.net             | (Netherlands)?         | 82 |       +    | AMS-IX peering LANs                         |
| 8   | 0     | 62.72.137.249   | te2-4.cr05.tn5.bb.pipex.net             | (United Kingdom)?      | 84 |       +-   | Core Link-1                                 |
| 9   | 0     | 62.72.137.10    | v3952.cr05.hx2.bb.pipex.net             | (United Kingdom)?      | 88 |       +--- | Core Link-1                                 |
| 10  | 0     | 62.72.139.26    | ae0-104.cr02.hx4.dsl.pipex.net          | (United Kingdom)?      | 82 |       +    | PIPEX Communications UK Limited             |
| 11  | 0     | 62.241.161.182  | g4-0.ar04.hx4.dsl.pipex.net             | (United Kingdom)?      | 83 |       +    | PIPEX Network Addresses                     |
| ... | -     | -               | -                                       | -                      | -  |            | -                                           |
| ?   | -     | 85.210.174.237  | 85-210-174-237.dsl.pipex.com            | (United Kingdom)?      | -  |            | ADSL Dynamic IP address pool                |

[ClownBoy]

The only explanation that I can come up with is that when you perform a traceroute, *something* e.g. your router, or a piece of firewall software, is re-writing the "TTL" part of the IP header that traceroute sends out. (traceroute explanation below if anyone's interested)

Do these weird traceroutes happen with both of your routers? If so, I'd look towards something installed on your PC. Yes

Do you have any firewall software on there? If so, what is it, and does it work better when you disable the firewall. Zonealarm, makes no difference if on or off

I'm tempted to ask you to download and run HiJack This - Do a scan and save a logfile, then please attach it to a post on here, you might have something weird that needs getting rid of.  Can do if it will help

It can't be a proxy because proxy servers will only intercept HTTP requests, and a traceroute sends out ICMPs, so there's no real point investigating the proxy route further.

Other than that, I'm stumped as well, I've never seen this kind of behaviour before!

[mr_chris]

Would be interested in that hijack this logfile to be honest

Also could you download and run LSP Fix and let us know what LSP providers are listed - maybe post a screenshot of the program before actually doing anything?

LSP's (layered service providers) are basically hooks into Windows networking, and are used by certain programs to intercept network / Internet traffic. Normally for good purposes if the proggy is legit (for example some antivirus programs use them to intercept mail traffic in order to transparently scan mail), but equally they are used by malware too to redirect search results etc.

It's just to try and eliminate something else, I guess

[ClownBoy]

Initially......


Error
---------------------------
Winsock 2 Registry key (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters) is missing or could not be accessed.

If using Windows NT/2000/XP, please make sure you are logged in as Administrator and try again.

If you are still receiving this message as Administrator, it may be necessary to re-install Winsock 2.
---------------------------
OK   
---------------------------

Then run in compatibility with XP, sorry couldn't copy and paste.............

NLAapi.dll
Mswsock.dll
Winrnr.dll
napinsp.dll
pnrpnsp.dll

In the keep side.

No problems found.

Will post the Hijack log very soon.