Recommended Posts

  sc302 said:
from that picture i would look at x.200. I would recommend getting a $10 hub and put it in between. it seems that you are getting a lot of data to that modem in a short amount of time, overloading it.

save a log, zip it, post it and lets see what we can help with.

Just a note, this capture will include all traffic including ANY unencrypted passwords etc that your machine sends/receives. (unless you filter this out)

Edited by Sophism

Ok seems neowin is having a few issues -- taking forever for threads to come up, etc.. So I have not read in detail all of the posts since my last one, etc.

Lets cover a few things. "Normally" on a switch, be it un-managed (dumb) or a managed (smart) switch running wireshark or any other sniffer on your machine - you should ONLY see traffic to and from your machine and broadcast type traffic and sure multicast, etc.

So if as mentioned if you wanted to view all the traffic from your network to the gateway (router) you would need to put a hub in between the switch and the router - and then connect your box running your sniffer to the hub.. Now you will see all traffic moving between all users on the switch and the router. Or on a managed switch as I mentioned before you could setup a monitor/span port -- this can be set to have multiple ports send copies of the traffic they are seeing to this monitor port - so your sniffer can see all the traffic.

Only when a switch has failed open will you see traffic destined for other machines on the port your box is connected too. Yes there are ways of forcing this, flood its arp table, etc. But that is way beyond the scope of this thread. But yes a switch normally will prevent someone from sniffing your traffic, etc.

If wireshark ran into a memory issue -- either your box is a real piece of crap ;) Or you got some major traffic on your network?? I didn't see from that limited screen shot any IPs on your network other 192.168.1.200 -- I would assume this was your machines IP, and so your switch is doing what its suppose to be doing.. Only sending traffic to the port the traffic is destined for, etc. To see all the traffic you need to put in a hub like suggested or setup a span/monitor port -- to copy the traffic being seen on the port connect to your router to the port you connect your sniffer too.

So your running bit torrent on the machine?? And ftp at the same time your trying to sniff traffic for an issue? I would shutdown everything your machine might be doing on the network before trying to sniff, ie ftp, p2p, etc.

Also -- if p2p is open on your network, yeah that could really bring that router to its knees very very quickly and would explain why its having memory issues. Multiple users running p2p all at the same time is going to cause issues on even a real router. From the data sheet on that router it does not list how much memory it has, etc. But sure looks like a simple little soho router to me, even though they might call it a BIZ model.. Can it really handle the traffic 20 to 30 uses can create? I would guess its maybe 32 or 64MB tops.. With the number of connections even 1 user running p2p can create you can have problems with the soho routers. Multiply that by a few users and yeah your going to have problems.

The problem is the router is hanging on to all the connections.. The default on a tcp connection can be days if not terminated correctly, etc. So yeah they can run out of memory really really quickly when p2p is running. What you can do is turn this down - for example 3rd party firmware has put in adjustments to lower the amount of time the router will hang on to the connection info, etc.

Which is why lots of soho routers off the shelf have issues with torrents.

Example here is the settings on dd-wrt

post-14624-1244581824_thumb.jpg

I also notice some IPX traffic -- yeah thats going to flood out all ports, unless you configure it on your managed switch ;) I would suggest you turn off anything running IPX unless you have some NEED for it? Which most likely is a NO ;)

I would be happy to look over a capture for you -- just post it up, but setup it so your seeing all the traffic going to the router. But just from that small screen shot -- if you have torrent traffic, that is more than likely your problem!! If you want to run that - your most likely going to need to get a "real" router ;) Can be done on a shoestring budget with some old pc hardware and router distro like pfsense or ipcop, smoothwall, m0n0wall, etc. etc.

Or get a router designed for the number of users you have, and the kind of traffic your going to be doing. But p2p can be a killer for sure!! I would suggest you prevent that - and your router will most likely be able to handle normal surfing, email, etc.

The hub idea i will do in the morning. as far as ipx traffic goes. that is a network protocol on my machine. should i remove it? is that what you are saying?

no one on the network runs any P2P programs. i run FTP and bittorrent at times but this problem happens if they are running or not running.

i have looked around the net for related problems to this SMC POS router and a ton of people have the same issues. and they have tried a bunch of stuff i would never even think of to resolve the issues without any success.

but i will keep playing around with it. it gives me something to do at work.

as far as getting a router that will handle the traffic goes. Comcast tells me that this is the only choice for business internet that they supply. i would love to get a regular cable modem and a stand alone router.

but that's not in the cards.

oh well. I'm off of work in 10 minutes. so i will continue this adventure in the morning.

I don't know why people are saying that switches will allow you to see all traffic... Basically, that's the difference between a hub and a switch, if you want to look at it in those terms. A hub will give you access to all traffic; a switch is only traffic meant for you.

It is definitely the router. Since you're in a business environment and cannot control what's going on with all of the workstations, you'll need to upgrade to a higher quality router. Screw what Comcast says. I had a problem with my home internet not too long ago (I have Time Warner) and they tried to convince me that the problem was with my router and not with their modem. I had the guy replace the modem anyway, and what do you know? Problem solved! (I should know what I'm doing, I'm a Sys Admin).

It seems like these ISPs will do whatever they can to convince you it's not their problem. From just googling the model # of the router, it looks like a $20 POS. Of course that's what the ISP provides... I would research and purchase a quality router/modem to replace it with and stop messing with Comcast because "you don't get no satisfaction" with them.

  agreenbhm said:
I don't know why people are saying that switches will allow you to see all traffic... Basically, that's the difference between a hub and a switch, if you want to look at it in those terms. A hub will give you access to all traffic; a switch is only traffic meant for you.

It is definitely the router. Since you're in a business environment and cannot control what's going on with all of the workstations, you'll need to upgrade to a higher quality router. Screw what Comcast says. I had a problem with my home internet not too long ago (I have Time Warner) and they tried to convince me that the problem was with my router and not with their modem. I had the guy replace the modem anyway, and what do you know? Problem solved! (I should know what I'm doing, I'm a Sys Admin).

It seems like these ISPs will do whatever they can to convince you it's not their problem. From just googling the model # of the router, it looks like a $20 POS. Of course that's what the ISP provides... I would research and purchase a quality router/modem to replace it with and stop messing with Comcast because "you don't get no satisfaction" with them.

Only one person said that and thats been cleared up now, A switch can do it to if a switchport is configured in monitor mode or it has failed open. (arp flooding, and a few other methods)

I agree with the router assessment though, its a POS and I dont see why you cannot get a Modem and your own router. You can get a decent Small Business router from cisco. We can better advise you on a new router with some more information about your work, number of users, types of traffic, future expansion etc.

Edited by Sophism
  Sophism said:
Only one person said that and thats been cleared up now, A switch can do it to if a switchport is configured in monitor mode or it has failed open. (arp flooding, and a few other methods)

I know you can configure a managed switch for that, but I was referring to his (managed) switch, as it currently is. I assumed he probably isn't too keen on configuring it if it hasn't been touched thus far.

I didn't realize it was only one guy arguing about the switch capability to forward all traffic. He seemed pretty persistent, standing his ground.

The only issue I saw from your most recent screen shot was that there is a bad network name between .200 and .61

Check that the computer or device names match up with what is in DNS. I find it a good idea to check logs on routers and switches for strange activity. This is very important. If you got smurfed or BFd, then your router or switch may choose to temporarily lock up to prevent that attacks too

  Trivious said:
The only issue I saw from your most recent screen shot was that there is a bad network name between .200 and .61

Check that the computer or device names match up with what is in DNS. I find it a good idea to check logs on routers and switches for strange activity. This is very important. If you got smurfed or BFd, then your router or switch may choose to temporarily lock up to prevent that attacks too

yah i saw that. i dont even know what .61 is. .200 is my computer.

i guess i can go around and look for ir but that would suck. and what if i find it? just make sure the dns is correct?

well i did not reboot my computer after i uninstalled the protocol. it did not ask me to.

and other machines may be running it in the building. our big network printers are contracted by minolta and i am not going to mess with there protocols.

Because its cheap for them ;) And prob works fine for very small soho.. Say 2 or 5 users that do some minor surfing, etc.

As to the IPX on printers, if they have an IP address, and the other machines are all using TCP/IP -- then you have no need for it on your network.. And its going to continue to broadcast all the time, etc. Its pretty easy to tell how your users are connecting to the printers ;) Are they using IPX or TCP/IP? ;) If using TCP/IP -- then there is no need for IPX to be enabled on the printers, etc.

Its RARE that you would find anywhere still using IPX -- RARE!!!!!

its not that big a deal, but any decent admin would want their network to be clean of crap like that, etc.

in wireshark, click on statistics, conversations, ipv4 and see which comps are chattering the most to the router. scan for a couple of minutes and lets see what you get, then you can narrow it down that way to 1 or 2 pcs and see what kind of traffic that is being pushed out by those machines.

post-118098-1244658327_thumb.jpg

post-118098-1244658337_thumb.jpg

Edited by sc302

You shouldn't have to go find the .61 necessarily. I would just check the DNS first. After that, if there are no duplicate records and the .200 is correct in DNS by name and ip, run an nslookup on .61 to get the name of it. Match that against the DNS record. If it matches, then check the lmhost files on both to make sure there are no rogue entries in them that would take precedence over your DNS server.

He needs to hook up wireshark to the hub between his router and switch or setup a span or monitor port for wireshark to show him the top talkers.. So far the stuff he has posted up is only his machine talking and broadcast traffic.

He can also just look on the switch -- its a managed switch for the traffic per port, etc. If he is looking for the top talkers.

  BudMan said:
He needs to hook up wireshark to the hub between his router and switch or setup a span or monitor port for wireshark to show him the top talkers.. So far the stuff he has posted up is only his machine talking and broadcast traffic.

He can also just look on the switch -- its a managed switch for the traffic per port, etc. If he is looking for the top talkers.

cool, tell me how to look at that through the switch. that would rock..

anyways i have made some changes and so fa it is working but we will see for just how long.

i went through the smc router and turned pretty much everything off. the only thing it is doing is doing port forwarding and url blocking. i then have it going through a Linksys Router, and then in to the switch.

what the hell right? i just wanted to see how it would work.

well no... that didn't work..

same issue, i am locked out of the smc router untill i reboot it. but of course i can log into the linksys no problem..

but i am downloading about 10 gig through an ftp site. work related.. we build airplane parts.

so i just got off the phone with Comcrap.

they are coming out here today to get rid of this SMC8014 POS and replace it with a Netgear.

we will see how that goes. and if all else fails i will have to go out and buy us a IP Gateway of some sort.

if i have to buy hardware, what should i get? does anybody know of a kickass IP gateway for comcast internet?

"i then have it going through a Linksys Router"

:blink: What did you think that was going to do?? So you double natted, or did you setup actual routing?

As to how to setup a mirror port in your switch. Did you think to RTFM?? ;)

http://www.cisco.com/en/US/docs/switches/l...10_UG_A-Web.pdf

post-14624-1245095701_thumb.jpg

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Nothing surprising there. Anyone expecting privacy on ANY social media platform is delusional at best. Let alone one controlled by the same creep that owns Tesla (a.k.a. facecrook on wheels), which blatantly violates user privacy with Tesla vehicles as reported by Louis Rossman. This action of his is just another prime example of why ANYTHING from him is trust-worthy as the same from Zuckerberg...i.e. not at all.
    • 007 First Light's first trailer shows off an action-packed James Bond game by Pulasthi Ariyasinghe IO Interactive has been teasing its next project outside of Hitman for some time now, and even before its first-ever showcase that's happening soon, the James Bond game showed up during the PlayStation State of Play event today. Dubbed 007 First Light, the third-person action-adventure title received a trailer showing off the new face of Bond, some of his gadgets, and plenty of action. Catch it above. While inspired by novels of Ian Fleming as well as the movie franchise, First Light will follow Bond to reveal just how he earned his MI6 007 role in an all-original story by IO Interactive. James Bond will be just 26 years old in this iteration. While not the smooth and tactical agent with a martini that we've seen in the movies just yet, this Bond is described as a man with "sharp instincts, sometimes reckless, who is still learning when to fight, when to bluff, and when to disappear into the shadows." As expected from the Hitman developer, missions in 007 First Light will offer both stealth and loud options, depending on the player's actions. A variety of futuristic gadgets will be available for use as well, while driving portions are also confirmed for the title. "In 007 First Light, Bond starts as a NAVY air crewman, when against all odds, an audacious act of bravery propels him on MI6’s most challenging training program," says the studio, regarding Bond's beginnings. "This training coupled with his natural instinct, wits, and heart will see him grow into a fully-fledged spy. It’s a completely original standalone story, developed in collaboration with Amazon MGM Studios." The studio says that the game will take players across the world, from snow-drenched mountains to sun-soaked beaches, while interacting with some of the most iconic characters in the franchise, including M, Q, and Moneypenny. There are original faces in the story too, such as Bond's mentor Greenway. 007 First Light is coming to PC (Steam and Epic Games Store, Xbox Series X|S, PlayStation 5, and the Nintendo Switch 2 sometime in 2026.
    • That sharp cold toothache you dread? Its origins trace back to ancient, unexpected purpose by Sayan Sen Image by Pavel Danilyuk via Pexels Scientists at the University of Chicago have discovered that the sensitive tissue inside our teeth first evolved as part of the armored skin of ancient fish. Their new study, published in Nature, confirms that dentine—a key part of teeth—was originally used by early vertebrates to sense their surroundings. This research supports the idea that dentine wasn’t always used for chewing. Instead, millions of years ago, it helped fish detect changes in the water. The study also clears up confusion about Anatolepis heintzi, a fossil once thought to be the earliest known vertebrate because of its dentine-like structures. For years, scientists debated whether Anatolepis was really an early vertebrate. The fossil had tiny tubules that some researchers believed were odontodes—small structures considered to be the ancestors of teeth. However, there wasn’t enough evidence to be sure. To settle the debate, scientists used synchrotron scanning, a powerful imaging technique, to study different fossils and modern creatures. The scans revealed that Anatolepis didn’t have dentine. Instead, its tubules were sensory structures similar to those found in arthropods like crabs and shrimp. These structures, called sensilla, help animals detect their surroundings. “This shows us that ‘teeth’ can also be sensory even when they’re not in the mouth,” said lead researcher Yara Haridy, PhD. “There’s sensitive armor in these fish. There’s sensitive armor in these arthropods. This explains the confusion with these early Cambrian animals.” Although Anatolepis turned out to be an arthropod, researchers did find real dentine in another ancient fish. The Ordovician vertebrate Eriptychius, which lived about 465 million years ago, had large dentine-filled tubules in its armor. This confirms that dentine first evolved in vertebrates as a sensory tissue. Further tests showed that modern fish, such as sharks and teleosts, still have nerve connections in their external dentine structures. This means early vertebrates may have used dentine to sense their environment before it became part of teeth. Scientists have two main ideas about how teeth came to be. The “inside-out” theory suggests teeth evolved first and were later adapted for exoskeletons. The new research supports the “outside-in” theory, which argues that sensory structures appeared first in exoskeletons and later evolved into teeth. While the team didn’t find the oldest vertebrate fish, study co-author Neil Shubin, PhD, believes the discovery is still important. “We didn’t find the earliest one, but in some ways, we found something way cooler,” he said. Source: University of Chicago, Nature This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "How dare you profit off our user's data without compensating them. That's our job!"
  • Recent Achievements

    • First Post
      James courage Tabla earned a badge
      First Post
    • Reacting Well
      James courage Tabla earned a badge
      Reacting Well
    • Apprentice
      DarkShrunken went up a rank
      Apprentice
    • Dedicated
      CHUNWEI earned a badge
      Dedicated
    • Collaborator
      DarkShrunken earned a badge
      Collaborator
  • Popular Contributors

    1. 1
      +primortal
      347
    2. 2
      snowy owl
      167
    3. 3
      +FloatingFatMan
      164
    4. 4
      ATLien_0
      161
    5. 5
      Xenon
      128
  • Tell a friend

    Love Neowin? Tell a friend!