[brodie1600]

Yea. I closed Mozilla, and I looked at my internet status. The sent and received icons flash simultaneously for one second, then after about 5-8 seconds, it does it again. And it'll keep doing this with Mozilla closed. Any suggestions to try to track down this P2P program?

I just checked out my online game, and my latency was VERY high. There's obviously something wrong still.

[JohnWill]

Fire up Process Explorer and it will allow you to examine in detail all the tasks and what they're doing. When everything else is shutdown, even any stuff you don't need in the system tray, see if you can determine which process is causing the network activity.

[brodie1600]

Alright, cool. Just downloaded it... so what exactly am I looking for in the list (I have all programs showing)

[JohnWill]

You want to sort on CPU or IO Requests and see which process is busy while the machine is doing nothing. That may help us zero in on the process that is doing the network activity.

Another good tool to see what's happening on the network is WireShark, that will allow you to capture network traffic. Again, the aim is to find out what is coming and going and where is it going.

[brodie1600]

Mk, I sorted the PE out, and am looking at the processes that run while my internet is closed. It looks like they're:

Desktop Window Manager - (dwm.exe)
System Idle Process
DCP's
And one called, "Interrupts".

I also checked Wireshark out. It looks like whenver I have a slow connection, there are black lines in the window (of Wireshark) with red text that say things like:

"[TCP Previous segment lost] http > 50173 [FIN, ACK] Seq=470..."
"[TCP Out-of-order] HTTP/1.1 302 Found (text/html)"
And this one I'm curious about:
"(Protocol=TLSv1) [TCP Retransmission] Encrypted Alert"

And others of that nation...

So... What do windows like those mean, and with the information I have provided here, is there anything I can proceed on doing with either of the two programs?

[JohnWill]

Wait, I see one issue.

Exactly how much processor time is Interrupts taking up? I had a driver issue here on a serial port board where it had continuous interrupts and consumed all of the processor time of one of the CPU cores. Needless to say, this slowed things WAY down.

What is DWM, that's not one that I have or am familiar with.

The fact that you are seeing corrupted packets and retransmissions would seem to indicate a hardware failure, perhaps the NIC? The interrupts could be tied to the NIC failure. With Process Explorer running, try opening Network Connections and disabling the NIC (right click, select disable), and see if that changes the indications.

[brodie1600]

Mk, a few things here, so I just made them into a list.

1.) DCPs and Interrupts take up about 0.76 CPU every 20 seconds or so. And dwm.exe is a Vista only file that acts like explorer.exe.

2.) And if I disable the NIC, won't that cause the internet to not work at all? I am using a Broadcom 802.11g Network Adapter that wirelessley connects to the router. And another Network Adapter, a Broadcom NetLink Gigabit Ethernet which is currently disabled. My laptop comes with a switch that can enable and disable the wireless adapter (the first one). Should I just click it off and check Process Explorer for something?

3.) I found that in Wireshark, I'm getting blue bars that say things like "Router solicitation" and "Router advertisement" on the ICMPv6 protocol. And I'm also getting the same blue bars, and they seem to be connecting to random sites like statcounter.com and godaddy.com. Any problems there?

4.) And does this have to do something with my IPv6 connection? Because I saw a Multicast thing come up in Wireshark when I re-enabled my internet adapter, and I know it has something to do with an IPv6. I currently have both connections set up to retrieve the IP and DNS automatically.

5.) I saved 3 Wireshark files. One of what it shows when I start Mozilla Firefox and it connects to my home page. Another of what it does when I don't have the browser open, and no connections are taking place. And the last one is one where I tested my network speed at speedtest.net. (Download: 6243 kb/s; Upload: 1925 kb/s; Latency: 44 ms; Location: Chicago, IL). Do you need to see these?

6.) Does someone have access to my computer, or has anyone gotten any information off of my computer?

(And my TTL for most connections is something around 200-250 when I know it should be lower)

Just tell me if I need to supply any more information. (Sorry about all the questions).

[JohnWill]

I'm not ready to wade through all those logs yet.

Let's disable a few things, including IPv6, which you don't need.


Disable the IP Helper service:

1. Hold the Windows key and type R, enter "services.msc" (without the quotes) and press Enter
2. Scroll down to the IP Helper service, right click on it and select Properties
3. In the dropdown box that says "Automatic" or "Manual", set it to Disabled and then click on "Apply"
4. Then click on "Stop" to stop the service from running in the current session
5. Click OK to exit the dialog



Disable IPv6:

1. Hold the Windows key and type R, enter "ncpa.cpl" (without the quotes) and press Enter
2. Right click on each network connection and select "Properties"
3. Remove the checkmark from the box next to "Internet Protocol Version 6 (TCP/IPv6)
4. Click OK to exit the dialog

NOTE: You should do this for each network connection.



Disable the DHCP Broadcast Flag:

Link: http://support.microsoft.com/default.aspx/kb/928233

1. Hold the Windows key and type R, enter regedit and press Enter.
2. Locate and then click the following registry subkey:
3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Inter faces\{GUID}
4. In this registry path, click the (GUID) subkey to be updated.
5. If the key DhcpConnForceBroadcastFlag does not exist, use the Edit menu, point to New, and then click DWORD (32-bit) Value. In the New Value #1 box, type DhcpConnForceBroadcastFlag, and then press ENTER. If the key exists, skip this step.
6. Right-click DhcpConnForceBroadcastFlag, and then click Modify.
7. In the Value data box, type 0, and then click OK.
8. Close Registry Editor.

NOTE: You should do this for each and every GUID subkey.
NOTE2: (GUID) is a mnemonic for the individual subkeys, the actual text "GUID" does not appaer.




The only program I'm aware of that currently relies on IPv6 is the new Windows Meeting Space. The first 2 changes will cause that program not to work - but will leave all of your normal (IPv4) connections unaffected. If it causes problems that you can't overcome, simply revert back to the original settings.

[brodie1600]

Alright, I did everything you said, but I'm still getting some of those Retransmission errors, and some of the connections are a little slow.

In the regedit path you gave me, I also found a Tcpip6 extension. Should I do stuff with that too?

I tried changing the channel on the router. Nothing.

Any tips?

(Also found out that the other computer connected to the network is getting the same retransmission errors in Wireshark)

[JohnWill]

It may be a common element, the router. Does the other computer have that issue when this computer is disconnected?

[brodie1600]

With my laptop disconnected from the internet, the other computer still gets Out-of-order errors and Retransmission errors, but the connection to sites seems fine at 48-54 Mbps. While I'm on my laptop, my connection can dip down to 18 or even 11 Mbps, and a download speed of 78 or 84 Kbps. (With full bars signal quality). Sometimes, the connection speed will move up to 48 or 54 Mbps, but it doesn't stay there long. And at other times, I will completley disconnect from the internet, leaving my connection at the "Local Only" state. I can't connect to my network, but then the network can't connect to the internet. When this happens, I'm not sure if the same thing happens on the other computer (I would think it did); and if it's not disconnected from the internet, or at a low connection speed, it's usually trying to identify the network itself.

[brodie1600]

Solved! (for now). It happens to be that TCP/IP wasn't enabled, and that was making my connection act up. I can access the internet at top speeds now! Thanks for all your help!

[JohnWill]

I can't imagine that being the issue! If TCP/IP wasn't enabled, you would have no connection of any kind.

[brodie1600]

I don't know, that's what it said when I was Diagnosing the connection.

V.V You're not going to believe this... Alright. Once I changed the connection channel from 6 to 11, the connection from my computer to the router was perfect: 54 mbps. I go about 30 minutes to an hour of perfect connection. I put my computer on Sleep, cause we had to go out somewhere, come back, check the connection speed, and it's at 1 Mbps... I re-enabled IPv6 and undo'd every single step for disabling it (And it still says the IPv6 connection is limited) and reset the router and everything. Frustrated, I moved my laptop all the way over to the router, and restarted the connection. Once it connected again, it said it was at 54 Mbps, and then it dropped back down to 1... while being right next to the router. I can connect to the internet fine, it's just the speed of the connection which is annoying. My connection is set to a manual configuration based on the information given from the router specs. DHCP is enabled on the other computer, but disabled on my laptop (please tell me if this is bad, and if so, how to enable it).

Here's my Windows IP Configuration in CMD:

Host Name . . . . . : Zach-PC
Primary Dns Suffix . . . . . :
Node Type . . . . . : Hybrid
IP Routing Enabled . . . . . : No
WINS Proxy Enabled . . . . . : No

And the DNS Suffix Search List

In my wireless LAN adapter, it says that DHCP is disabled. NetBIOS is enabled over Tcpip. And Autoconfiguration is enabled.


Over to my advanced TCP/IP settings for the wireless connection:

IP Settings:
One IP address, with one Subnet mask. One Default Gateway, and the Metric is Automatic.

DNS:
2 DNS server addresses.
I have 'Append Primary and Connection Specific DNS suffixes' bulleted, and 'Append Parent suffixes of the primary DNS suffix' checked. I have the DNS suffix it gave me in CMD in the DNS suffix box for this connection, and 'Register this connection's addresses in DNS' and 'Use this connection's DNS suffix in DNS registration' both checked.

WINS:
No WINS addresses.
Enable LMHOSTS lookup is checked, and the NetBIOS setting is set to Default.


Whenever I change the transmit channel on the router, my speed shoots up to 54 until something weird happens. So this is partially solved =P . If Anything else happens, I'll post here. But as for now, my connection is fine.

If you see anything wrong here, just tell me, and if you have any suggestions, feel free. Thank you very much.
(The connection is normally at 1 Mbps, and rarely spikes up to 54. Once it goes to 54, it doesn't stay there for very long).

[brodie1600]

PS:

Even though my speed now says 54 Mbps, I'm having to click links multiple times in order to connect, and having to press the Refresh button a lot; the connection seems to be dropping as well:

Zach-PC ---> Home (Router) ---> Gateway --X-- Internet