Tracert to MSN and Zonelabs keeps showing timeouts-unable to download

[Cybordolphin]

I have not been able to get downloads from MSN or Zonelabs for the last week.

Running a traceroute shows that the servers appear to be timing out at their websites?? If the speeds along the way are all approx. 50ms or less, where is the trouble coming from?

I am trying to determine the bottleneck.

How can I pinpoint where the problem lies? Earthlink, or the actual webservers for MSN, Zonelabs?

 

[Bacinator]

That is typically due to firewalls and other restrictions. There is a protocal called ICMP which is what "ping" and "traceroute" use. Some routers will not allow these signals to pass. For example, I try to ping www.aol.com:

H:\>ping www.aol.com

Pinging www.gwww.aol.com [205.188.160.89] with 32 bytes of data:

Reply from 165.xxx.xxx.x15: Destination host unreachable. addresses xxx'd out for security
Reply from 165.xxx.xxx.x15: Destination host unreachable. addresses xxx'd out for security
Reply from 165.xxx.xxx.x15: Destination host unreachable. addresses xxx'd out for security
Reply from 165.xxx.xxx.x15: Destination host unreachable. addresses xxx'd out for security

Ping statistics for 205.188.160.89:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

H:\>


Notice where it says "Pinging www.gwww.aol.com [205.188.160.89] with 32 bytes of data:", that tells you that you do have access to the internet, because your computer went out to a DNS (Domain Name Server), and got the number for aol, which is 205.188.160.89. What you see in my ping, is that 165.xxx.xxx.x15eplied back to me that the destination was unreachable. That is because though other protocols may pass, something is blocking the ICMP protocol. It is also possible that only the recieve portion of the ping is blocked, so it goes out, and pings the server, comes back, and is blocked at a firewall/router or other layer 3 device, thus you never see the ping return. Does that stop you from accessing and downloading? Nope. If you can browse to it, you should be able to d/l, unless something in-between is blocking it.

And just for giggles, telnetting into 165.xxx.xxx.x15 results in:


****************************************WARNING**********************
You are about to access an U.S. Government computer system. Access to this
system is restricted to authorized users only. Anyone who accesses this system
without authorization, or exceeds authorized access, could be subject to a fine
or imprisonment, or both, under Public Law 98-473.
By accessing this system, you consent to having your activities and or accesses
Recorded by the system software and periodically monitored. If this record
reveals suspected unauthorized use or criminal activity, the evidence may be
provided to supervisory personnel and law enforcement officials.
************************************************************************


Thus proving there is an active device, and because it responded to my ping, it is obviously "in-line" to my connection to the internet, and handling security of some sort, otherwise it would not have responded back, it would have kept continuing until it reached another security device (examining what is inside the packet) or would eventually reach the host and the hose would respond on the same path... If there were no security devices, and the host was offline, or you had the wrong ip, you should see:


H:\>ping 165.xxx.xxx.x99

Pinging 165.xxx.xxx.x99 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 165.xxx.xxx.x99:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

The ICMP ping stayed on the internal network, but was intentionally not targeted at a specific device. I posted that to prove that the gateway for the internet, only cares about ICMP packets going through it.

If you get some returns on your tracert, that proves how far you can ping/trace before the packet is blocked, example:

H:\>tracert www.aol.com

Tracing route to www.gwww.aol.com [64.12.149.13]
over a maximum of 30 hops:

1 1 ms <1 ms <1 ms 165.xxx.xxx.4 addresses xxx'd out for security
2 <1 ms 1 ms <1 ms 165.xxx.xxx.5 addresses xxx'd out for security
3 1 ms 1 ms 1 ms 165.xxx.xxx.15 addresses xxx'd out for security
4 165.xxx.xxx.15 reports: Destination host unreachable. addresses xxx'd out for security

Trace complete.

H:\>
The same final device responded that the host was unreachable. So you can see that I go through at least four devices, the first three not blocking ICMP, but the fourth is definitely blocking my ping/trace attempts.

Hope thats not too much info.

 

[Bacinator]

Oh, a tidbit of additional info:

ICMPShort for Internet Control Message Protocol, an extension to the Internet Protocol (IP) defined by RFC 792. ICMP supports packets containing error, control, and informational messages. The PING command, for example, uses ICMP to test an Internet connection.
Source of above definition

 

[Cybordolphin]

Thanks for all the input. That is very helpful.

However....

Can you tell me if when you ping MSN.... if you get only timeouts? That and Zonelabs, and CNN.

I am trying to figure out why I am unable to ping or download from MSN. I believe it is my ISP's fault. I am trying to narrow it down to which of the routers along the way is bottlenecking.

I am getting:
Pinging msn.com [207.68.172.246] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 207.68.172.246:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

This I believe is part of my problem. This router is inline to MSN from where I ping from. I believe it is one of Earthlinks routers.

ping 209.165.108.170

Pinging 209.165.108.170 with 32 bytes of data:

Reply from 209.86.82.65: TTL expired in transit.
Reply from 209.86.82.65: TTL expired in transit.
Reply from 209.86.82.65: TTL expired in transit.
Reply from 209.86.82.65: TTL expired in transit.

Ping statistics for 209.165.108.170:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms


Here is what I get when I do a trace route to MSN:



Tracing route to msn.com [207.68.172.246]
over a maximum of 30 hops:

1 31 ms 31 ms 31 ms hsa001.pool030.at101.earthlink.net [216.249.99.1
]
2 30 ms 31 ms 30 ms 216.249.64.33
3 30 ms 31 ms 30 ms cor01-vl-228.ca-pasadena0.ne.earthlink.net [207.
217.2.129]
4 31 ms 31 ms 31 ms bor01-ge-1-2.ca-pasadena0.ne.earthlink.net [209.
165.101.1]
5 46 ms 31 ms 46 ms bor01-so-6-1.ca-sanfranc0.ne.earthlink.net [209.
86.82.66]
6 35 ms 31 ms 30 ms 209.165.103.2
7 30 ms 31 ms 31 ms bor01-vlan10.ca-paloalto1.ne.earthlink.net [209.
165.108.166]
8 30 ms 31 ms 31 ms 209.165.108.170
9 30 ms 30 ms 30 ms pos0-0.core1.pao1.us.msn.net [207.46.33.45]
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.

Trace complete.

All of the above is with and WITHOUT firewalling.


My Earthlink DSL speed dropped from 1.2Mbps (plus), down to 46Kbps - 129Kbps. Earthlink is being a pain in the arss about submitting a repair ticket. Really p.o..

I've already gone over all the equipment, and software here, and am sure it is an Earthlink problem. They have been experiencing some problems in my area, but supposedly fixed the problems. If this is fixed.... I have a real problem....lol.

 

[Bacinator]

There are two sides to a router... The inside... and the outside... The inside is the network portion, and the outside is the tunnel/internet portion. If a device is running security, it will talk to you usually, but will not let you in. Just like a guard at a door/booth. If they have a "no soliciting" policy where-ever you are trying to sell your girl scout cookies, the guard will tell you no, and respond to your questions, but he won't let you anywhere past him... Same thing here... Let's use your MSN trace as an example:

Tracing route to msn.com [207.68.172.246]
over a maximum of 30 hops:

1 31 ms 31 ms 31 ms hsa001.pool030.at101.earthlink.net [216.249.99.1
]
2 30 ms 31 ms 30 ms 216.249.64.33
3 30 ms 31 ms 30 ms cor01-vl-228.ca-pasadena0.ne.earthlink.net [207.
217.2.129]
4 31 ms 31 ms 31 ms bor01-ge-1-2.ca-pasadena0.ne.earthlink.net [209.
165.101.1]
5 46 ms 31 ms 46 ms bor01-so-6-1.ca-sanfranc0.ne.earthlink.net [209.
86.82.66]
6 35 ms 31 ms 30 ms 209.165.103.2
7 30 ms 31 ms 31 ms bor01-vlan10.ca-paloalto1.ne.earthlink.net [209.
165.108.166]
8 30 ms 31 ms 31 ms 209.165.108.170
9 30 ms 30 ms 30 ms pos0-0.core1.pao1.us.msn.net [207.46.33.45]
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.

Notice the last point you get a response. That is because each step is one step closer to your goal. You talk to the outside of the router "pos0-0.core1.pao1.us.msn.net", but when you try and talk to the next device, nothing happens. Odd? Not really. The router we just mentioned, step #9, is blocking your ping request from going past that point. If it was your firewall, you wouldn't be able to ping past it. For example, if you bring up Zone-Alarm (which has built in notifications), have in running in full-protect mode, and ping out, a pop up windows will ask you "Do you want to let ICMP ping access the internet", and it will give you file details and other info. A regular firewall doesn't have pop-ups unless it's a potential attack, and just logs the security violation/action, so you will not see anything other than no return.


Now... This explains why you can ping MSN, but not why you cannot download. Because though the ICMP protocal may be blocked, MSN provides quite a few other services, and they should not be blocking thier own services. On that note, it is possible that earthlink(or something else) is blocking portions of MSN, which may or may not be further into the MSN domain than you got to (step 9). Tho you can see in step 1-7 that the earthlink routers pass the packet, step 8 is a public unlabeled router, and passes it to 9 which responds. One I always use for testing is honda.com. Just because.

My MSN tracert:

Tracing route to msn.com [207.68.172.246]
over a maximum of 30 hops:

1 10 ms 9 ms 7 ms 10.73.32.1
2 9 ms 7 ms 7 ms 10.73.32.1
3 9 ms 11 ms 7 ms 172.30.101.81
4 7 ms 7 ms 7 ms 172.30.101.122
5 10 ms 7 ms 7 ms 68.48.0.50
6 9 ms 9 ms 9 ms 12.126.168.5
7 10 ms 9 ms 9 ms tbr1-p012201.wswdc.ip.att.net [12.123.9.74]
8 27 ms 28 ms 25 ms tbr1-cl4.sl9mo.ip.att.net [12.122.10.30]
9 70 ms 70 ms 69 ms tbr1-cl2.sffca.ip.att.net [12.122.10.42]
10 70 ms 69 ms 70 ms tbr2-p012501.sffca.ip.att.net [12.122.9.138]
11 85 ms 83 ms 84 ms 12.122.12.114
12 88 ms 86 ms 85 ms gar1-p360.stwwa.ip.att.net [12.123.203.169]
13 80 ms 80 ms 80 ms 12.127.70.6
14 83 ms 83 ms 81 ms 207.46.33.225
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.pushed ctrl-c here to cancel before it wasted time counting to 30

You can see that in step 14, my first the octets -> 207.46.33.xxx are the same, and it is just the final IP that is different. Same thing, different direction. MSN has blocked this access point, because that it what it would be if it was open. An access point into their network.

Now webservers are different, because they are a little more lenient. www.honda.com only has web files, no ftp or news or super-duper corperate stuff. Only web stuffs, and so they will let you ping to your hearts content:

Tracing route to www.honda.com [164.109.25.248]
over a maximum of 30 hops:

1 8 ms 8 ms 9 ms 10.73.32.1
2 9 ms 7 ms 8 ms 10.73.32.1
3 9 ms 7 ms 17 ms 172.30.101.81
4 7 ms 7 ms 8 ms 172.30.101.122
5 10 ms 7 ms 7 ms 68.48.0.50
6 9 ms 9 ms 10 ms 12.126.168.5
7 2666 ms 1866 ms 68 ms tbr2-p012301.wswdc.ip.att.net [12.123.9.78]
8 9 ms 12 ms 9 ms ggr1-p3100.wswdc.ip.att.net [12.122.11.238]
9 9 ms 9 ms 9 ms att-gw.dc.uu.net [192.205.32.162]
10 9 ms 9 ms 10 ms 0.so-3-1-0.XL1.DCA6.ALTER.NET [152.63.38.118]
11 9 ms 9 ms 9 ms 0.so-6-0-0.GW6.DCA6.ALTER.NET [152.63.41.221]
12 12 ms 12 ms 11 ms digex-gw.customer.alter.net [157.130.214.102]
13 10 ms 12 ms 12 ms vlan39.dca2a-fdisa-sw1-msfc1.netsrv.digex.com [
64.109.3.149]
14 12 ms 12 ms 12 ms 164.109.87.251
15 12 ms 12 ms 12 ms 164.109.25.248

Trace complete.

So if a router will not respond, your ping will not pass through, and you will get a host unreachable, or a TTL failure (time to loss, everytime a packet hits a router, this TTL, usually around 225, counts down, until it gets to 0. After it hits 0, the next router it gets to will trash it).


Very long explanations to say, there is probably something much simpler going on. Are you running Zone Alarm? Are the sites you're trying to access blocked in IE for security or privacy reasons? To check go to IE, clock on tools menu, then options. And verify under security and privacy, that access and cookies are not blocked for both of these sites. Also if running Zone Alarm, verify cookies handling stuff there under the privacy menu. Another good indication is if you get an odd eyeball or hazard icon in the lower right hand corner of your browser on the status bar (to the left of the *world and the word "Internet"). Clicking on this will tell you what has been blocked for privacy or otherwise usually.