• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

I'll need to analyze network traffic to find a hostname or IP address of a particular server...

Ichinisan

Ichinisan

Lifer
I work for a local cable ISP. Recently, multiple cases have been escalated where customers playing Ubisoft's "The Division" on PS4 cannot connect. They get a vague error code that doesn't provide any useful information: "Delta C-1-198"

Our network engineer goes on a week-long Christmas vacation starting tomorrow. I'm also taking a vacation day tomorrow (a use-it-or-lose-it situation). I hoped to have this resolved today since it has been going on for over a week.

The issue started when players installed an update to version 1.5, but here's where it gets strange: Affected players can switch the same console to a different ISP (mobile hotspot, friend/family/neighbor) and the game works online.

Ubisoft suggested the customers call us and perform a trace-route, but they didn't tell us where we should trace a route to. I would need a server hostname or IP address. I agree that a trace-route test should be performed to determine why our customers can't reach Ubisoft's server.

I have tried contacting Ubisoft tech support myself, but they tell me they cannot provide that information. A later update said a trace-route would not help (I disagree). They are trying to close the ticket without providing any suggestion on how we should proceed. Ubisoft will keep referring customers to their ISP and they will keep getting escalated to me.

I found a thread on Ubisoft's forums about this error and confirmed that a significant portion of the thread participants live in my city and use my employer for their ISP -- including the OP of that thread.

So I plan to bring my new PS4 Pro to the office tomorrow (even though it's a vacation day for me). A call center supervisor will bring his copy of The Division. We'll probably need to create a PS4 user for him and sign-in to his Playstation Plus account (I don't have one). Then we'll need to rig up a PC with 2 network interfaces and a software tool to analyze data packets. We'll connect it all through a cable modem (same CMTS as one of the affected users I've been helping).

Can someone suggest a software package for Windows to help analyze traffic that is simple enough to figure out?

Hopefully such a tool can show failed DNS look-ups and TCP/IP client-server connections (or UDP).

Thanks!


[2016-12-26 EDIT]

Holidays have delayed any further progress on this. I'm fairly certain there is a BGP issue with a route upstream from us, affecting some (but not all) other ISPs. I suspect this other inaccessible host could be related...

A couple people have contacted me because they are unable to reach a server on nfoservers.com and one confirmed it works when he uses a VPN tunnel, which would force a different route to the server. When speaking with the other affected customer, I mentioned that I've had 2 couple similar issues in the past (a customer was unable to reach a particular server that was reachable via another ISP), each around 1 year apart. Those were found to be caused by another network, upstream from us, advertising BGP routes incorrectly. In both of those previous cases, the operator of the offending network was notified and the issue was resolved. When I mentioned BGP, he perked-up and confirmed that an nfoservers.com support rep said it could be a BGP issue causing connection problems in the south-east. The nfoservers.com rep had also suggested he should try "TunnelBear" free VPN service. I told him I'd pass along anything our network engineers find, but I expect their response to be delayed due to holidays. He said he would try getting TunnelBear to work.

I had an angry voicemail from Saturday, Christmas Eve. He seemed to think I had suggested TunnelBear, but it was actually the nfoservers.com rep that suggested it to him. He was frustrated because he couldn't get the TunnelBear software to install (requires some version of .NET framework and he doesn't know where/how to get that).

While I have to wait for a response from our network engineers to determine if there is a BGP / routing issue with any of the hosts I've listed, I thought I might be able to look into it.

I found this article:
http://www.techrepublic.com/article/how-to-use-ip-and-bgp-to-troubleshoot-internet-connectivity/

Well, it's not much help. The example looking glass server they suggest (BBC) is "down for maintenance," but I used another and found our ASN.

Then, it suggests using telnet to route-views.oregon-ix.net -- but it prompts for authentication credentials, which the article does not provide. I tried using "anonymous" with a blank password and it fails.
 
Last edited:
If your company will pay for it the Steel Central Packet analyzer they sell that works with wireshark it will save you a ton of time, and is very easy to use even with terabytes of network traffic to sift through. Its like $700 though, and not really needed for what you want to do, would just make it easier and less time intensive.

I would probably just time it so that you are only recording exactly when the issue is happening so you only have a few seconds of traffic to go through and sift through it the hard way.
 
sdifox said:
What kind of isp doesn't have a network monitoring tool?
Click to expand...
Our network engineer can probably do it, but I would not be able to coordinate that between me, our engineer, and the customer. The customer I've been working with is never home when I speak to him.

If I could determine the hostname or IP address, I could escalate this issue to our engineer and expect a prompt resolution.
 
wireshark is good. If you don't want to setup a pc to route the traffic you can also use an old network hub. A hub spits out all traffic it receives on all ports, so if you hook up a pc with wireshark to the hub it will capture all of the traffic going through the hub without need to route the traffic through. Ofcourse you'll be limited to 10mbps half duplex, good enough for most things (I'm sitting on a hub right now, don't judge me 😀 )
 
serpretetsky said:
wireshark is good. If you don't want to setup a pc to route the traffic you can also use an old network hub. A hub spits out all traffic it receives on all ports, so if you hook up a pc with wireshark to the hub it will capture all of the traffic going through the hub without need to route the traffic through. Ofcourse you'll be limited to 10mbps half duplex, good enough for most things (I'm sitting on a hub right now, don't judge me 😀 )
Click to expand...
Purged myself of hubs a long time ago. Right about now, I'm wishing a didn't.

Should be able to combine a wired + WiFi setup to have 2 interfaces though.
 
Ichinisan said:
Our network engineer can probably do it, but I would not be able to coordinate that between me, our engineer, and the customer. The customer I've been working with is never home when I speak to him.

If I could determine the hostname or IP address, I could escalate this issue to our engineer and expect a prompt resolution.
Click to expand...

You dont have access to the monitoring tool? you know the source mac and ip from the cable modem already. I am referring to your test rig. Just hook up a run of the mill wifi router and check the log on it. dont see what the pc with two nic is for unless you were planning to run pfsense or sophos on it to act as your router.

I have to say the console makers fucked up on the network interface design.
 
Last edited:
Shrug. If Ubisoft is pushing this "bug" onto the ISPs, but won't even coordinate with the customer's ISP to help them figure it out... well, I'd just push back at Ubisoft, and claim that their games are horribly buggy, and to avoid them. LOL.

Edit: I mean, is this happening with any other maker's games? If not, then there you go!
 
VirtualLarry said:
Shrug. If Ubisoft is pushing this "bug" onto the ISPs, but won't even coordinate with the customer's ISP to help them figure it out... well, I'd just push back at Ubisoft, and claim that their games are horribly buggy, and to avoid them. LOL.

Edit: I mean, is this happening with any other maker's games? If not, then there you go!
Click to expand...
I don't think it is just ubisoft. Consoles just dont play nice when it comes to network. They all assume direct connection to the modem, which is never the case. And the ports needed is not spelled out anywhere. I had to add nat rules to pfsense to give wii u and ps4 basically fully open outbound to the internet to make them work.

It's like they have never heard of upnp.
 
Last edited:
Ichinisan said:
I have tried contacting Ubisoft tech support myself, but they tell me they cannot provide that information. A later update said a trace-route would not help (I disagree). They are trying to close the ticket without providing any suggestion on how we should proceed. Ubisoft will keep referring customers to their ISP and they will keep getting escalated to me.
Click to expand...
If you are contacting regular support via their e-mail system, that is the issue, those guys have no clue / no access to that kind of information.

You need to call Ubi corporate, and handle it that way.
No need to play games with the low level staff or do it yourself.

(Though, I also find it odd that a ISP don't have network monitoring equipment with deep packet inspection hardware/software.)
 
sdifox said:
I don't think it is just ubisoft. Consoles just dont play nice when it comes to network. They all assume direct connection to the modem, which is never the case. And the ports needed is not spelled out anywhere. I had to add nat rules to pfsense to give wii u and ps4 basically fully open outbound to the internet to make them work.

It's like they have never heard of upnp.
Click to expand...

upnp is considered to be the devil by most security people. Most enterprise grade firewalls don't support it. I was able to narrow down the ports needed on my PS3 by watching what traffic was being blocked.
 
XavierMace said:
upnp is considered to be the devil by most security people. Most enterprise grade firewalls don't support it. I was able to narrow down the ports needed on my PS3 by watching what traffic was being blocked.
Click to expand...
Consoles are not supposed to be in corp environment to start with.
 
You missed my point entirely. uPNP is a bad protocol that never should have gotten widespread usage. The new gen consoles not using it uPNP is not a bad thing in my book.
 
XavierMace said:
You missed my point entirely. uPNP is a bad protocol that never should have gotten widespread usage. The new gen consoles not using it uPNP is not a bad thing in my book.
Click to expand...
Then console makers should restrict games to certain ports and put that in the documentation. Users should not have to.figure this out.
 
Holidays have delayed any further progress on this. I'm fairly certain there is a BGP issue with a route upstream from us, affecting some (but not all) other ISPs. I suspect this other inaccessible host could be related...

A couple people have contacted me because they are unable to reach a server on nfoservers.com and one confirmed it works when he uses a VPN tunnel, which would force a different route to the server. When speaking with the other affected customer, I mentioned that I've had 2 couple similar issues in the past (a customer was unable to reach a particular server that was reachable via another ISP), each around 1 year apart. Those were found to be caused by another network, upstream from us, advertising BGP routes incorrectly. In both of those previous cases, the operator of the offending network was notified and the issue was resolved. When I mentioned BGP, he perked-up and confirmed that an nfoservers.com support rep said it could be a BGP issue causing connection problems in the south-east. The nfoservers.com rep had also suggested he should try "TunnelBear" free VPN service. I told him I'd pass along anything our network engineers find, but I expect their response to be delayed due to holidays. He said he would try getting TunnelBear to work.

I had an angry voicemail from Saturday, Christmas Eve. He seemed to think I had suggested TunnelBear, but it was actually the nfoservers.com rep that suggested it to him. He was frustrated because he couldn't get the TunnelBear software to install (requires some version of .NET framework and he doesn't know where/how to get that).

While I have to wait for a response from our network engineers to determine if there is a BGP / routing issue with any of the hosts I've listed, I thought I might be able to look into it.

I found this article:
http://www.techrepublic.com/article/how-to-use-ip-and-bgp-to-troubleshoot-internet-connectivity/

Well, it's not much help. The example looking glass server they suggest (BBC) is "down for maintenance," but I used another and found our ASN.

Then, it suggests using telnet to route-views.oregon-ix.net -- but it prompts for authentication credentials, which the article does not provide. I tried using "anonymous" with a blank password and it fails.
 
Last edited:
Ichinisan said:
You seemed to imply it's a major security concern that some devices can bypass NAT using UPnP, but you're OK with IPv6 having no concept of NAT. Alrighty!
Click to expand...
Isn't it still recommended to have a firewall with ipv6 so that your devices aren't open to the internet? In that case I would think UPNP has the same effect regardless of ipv4 or ipv6, since it has to open up ports in the firewall either way.

edit: btw, keep us updated. I'm curious what the conclusions are.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top