Strange DNS or DHCP problems with DSL Alcatel modem, connection keeps reseting
Posts: 14
Hello everyone! I apologize in advance for over-complicating what might be a simple probem.
Recently I've upgraded from 3-4.3 to mepis 6 (best distribution I've used!), and this problem continues. I'm connecting through an alcatel ethernet modem to my onboard network card, my kernel version is 2.6.15-27-386, used the PPPoE wizard to set the definitions initially. I'm also dual-booting with a Window$ partition where everything always worked fine, and since the problem occured on the last OS as well I suspect it has something to do with the modem somehow.
At first when I ran "pon adsl-provider" I got the DNS adresses correctly and everything worked fine for a while, I could access websites and everything. eth0 was getting its IP from a DHCP server (the modem). Then without a warning I could no longer recognize server-names, I could ping a specific IP but not a DNS address. I'd have to "poff", then bring eth0 down and back up (???) otherwise it wouldn't reconnect, then run "pon" again. Nothing shown in "plog", but syslog output is this:
----------
Jan 16 23:25:56 localhost pppd[30727]: Plugin rp-pppoe.so loaded.
Jan 16 23:25:56 localhost pppd[30731]: pppd 2.4.4b1 started by broken, uid 1000
Jan 16 23:25:56 localhost pppd[30731]: PPP session is 1143
Jan 16 23:25:56 localhost pppd[30731]: Using interface ppp0
Jan 16 23:25:56 localhost pppd[30731]: Connect: ppp0 <--> eth0
Jan 16 23:25:58 localhost pppd[30731]: PAP authentication succeeded
Jan 16 23:25:58 localhost pppd[30731]: peer from calling number 00:30:88:01:A2:AF authorized
Jan 16 23:25:58 localhost pppd[30731]: Cannot determine ethernet address for proxy ARP
Jan 16 23:25:58 localhost pppd[30731]: local IP address 89.0.174.236
Jan 16 23:25:58 localhost pppd[30731]: remote IP address 62.90.133.72
Jan 16 23:25:58 localhost pppd[30731]: primary DNS address 212.150.49.10
Jan 16 23:25:58 localhost pppd[30731]: secondary DNS address 62.90.42.110
[MY NOTE: EVERYTHING FINE SO FAR]
Jan 16 23:30:55 localhost gconfd (broken-32093): starting (version 2.14.0), pid 32093 user 'broken'
Jan 16 23:30:55 localhost gconfd (broken-32093): Resolved address "xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only configuration source at posi
tion 0
Jan 16 23:30:55 localhost gconfd (broken-32093): Resolved address "xml:readwrite:/home/broken/.gconf" to a writable configuration source at position 1
Jan 16 23:30:55 localhost gconfd (broken-32093): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at posit
ion 2
Jan 16 23:30:55 localhost gconfd (broken-32093): Resolved address "xml:readonly:/var/lib/gconf/debian.defaults" to a read-only configuration source at posi
tion 3
Jan 16 23:30:55 localhost gconfd (broken-32093): Resolved address "xml:readonly:/var/lib/gconf/defaults" to a read-only configuration source at position 4
Jan 16 23:34:22 localhost dhclient: DHCPREQUEST on eth0 to 10.0.0.138 port 67
Jan 16 23:34:23 localhost dhclient: DHCPACK from 10.0.0.138
Jan 16 23:34:23 localhost dhclient: bound to 10.0.0.1 -- renewal in 3563 seconds.
Jan 16 23:35:04 localhost nmbd[3538]: [2007/01/16 23:35:04, 0] nmbd/nmbd_browsesync.c:find_domain_master_name_query_fail(353)
Jan 16 23:35:04 localhost nmbd[3538]: find_domain_master_name_query_fail:
Jan 16 23:35:04 localhost nmbd[3538]: Unable to find the Domain Master Browser name MEPISGRP<1b> for the workgroup MEPISGRP.
Jan 16 23:35:04 localhost nmbd[3538]: Unable to sync browse lists in this workgroup.
Jan 16 23:48:31 localhost kernel: [17205224.404000] ABORTED IN=ppp0 OUT= MAC= SRC=63.245.209.21 DST=89.0.174.236 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=11377
PROTO=TCP SPT=80 DPT=1109 SEQ=2569453740 ACK=2724089210 WINDOW=53764 RES=0x00 RST URGP=0
Jan 16 23:50:10 localhost nmbd[3538]: [2007/01/16 23:50:10, 0] nmbd/nmbd_browsesync.c:find_domain_master_name_query_fail(353)
Jan 16 23:50:10 localhost nmbd[3538]: find_domain_master_name_query_fail:
Jan 16 23:50:10 localhost nmbd[3538]: Unable to find the Domain Master Browser name MEPISGRP<1b> for the workgroup MEPISGRP.
Jan 16 23:50:10 localhost nmbd[3538]: Unable to sync browse lists in this workgroup.
----------------
Some of this is giberish to me... 
Somewhere along the way the thing described above would happen. Tried disabling the firewall, messed with the modem setup, did my special voodoo dance - nothing worked. So I changed eth0 to static-IP (10.0.0.1) instead of DHCP and made it's default gateway the modem (10.0.0.138), making sure the modem is running a DNS service. After that for a while, after initial connection, it would reset, getting a different IP address every several minutes. One reboot later and it would still continue, losing connection and IP every 15 minutes or so, but now it would flush the syslog file with tons of these messages (somewhat long, sorry about that):
Jan 21 14:56:34 localhost kernel: [17227086.856000] ABORTED IN=ppp0 OUT= MAC= SRC=66.249.91.18 DST=89.0.213.114 LEN=40 TOS=0x00 PREC=0x00 T
TL=240 ID=46927 PROTO=TCP SPT=443 DPT=4203 SEQ=1889576812 ACK=375471018 WINDOW=8201 RES=0x00 RST URGP=0
Jan 21 14:57:43 localhost pppd[4349]: No response to 3 echo-requests
Jan 21 14:57:43 localhost pppd[4349]: Serial link appears to be disconnected.
Jan 21 14:57:43 localhost pppd[4349]: Connect time 417.5 minutes.
Jan 21 14:57:43 localhost pppd[4349]: Sent 282694623 bytes, received 157037577 bytes.
Jan 21 14:57:49 localhost pppd[4349]: Connection terminated.
Jan 21 14:57:49 localhost pppd[4349]: Modem hangup
Jan 21 14:58:54 localhost pppd[4349]: Timeout waiting for PADO packets
Jan 21 14:58:54 localhost pppd[4349]: Unable to complete PPPoE Discovery
Jan 21 14:59:39 localhost pppd[4349]: PPP session is 541
Jan 21 14:59:39 localhost pppd[4349]: Using interface ppp0
Jan 21 14:59:39 localhost pppd[4349]: Connect: ppp0 <--> eth0
Jan 21 14:59:40 localhost pppd[4349]: PAP authentication succeeded
Jan 21 14:59:40 localhost pppd[4349]: peer from calling number 00:30:88:01:A2:AF authorized
Jan 21 14:59:41 localhost pppd[4349]: Cannot determine ethernet address for proxy ARP
Jan 21 14:59:41 localhost pppd[4349]: local IP address 89.1.186.247
Jan 21 14:59:41 localhost pppd[4349]: remote IP address 212.29.206.51
Jan 21 14:59:41 localhost pppd[4349]: primary DNS address 62.90.42.110
Jan 21 14:59:41 localhost pppd[4349]: secondary DNS address 212.150.49.10
Jan 21 15:00:02 localhost kernel: [17227295.428000] ABORTED IN=ppp0 OUT= MAC= SRC=64.233.183.99 DST=89.1.186.247 LEN=40 TOS=0x00 PREC=0x00
TTL=242 ID=25324 PROTO=TCP SPT=443 DPT=1844 SEQ=1677120815 ACK=615274238 WINDOW=9700 RES=0x00 RST URGP=0
Jan 21 15:00:02 localhost kernel: [17227295.432000] ABORTED IN=ppp0 OUT= MAC= SRC=64.233.183.99 DST=89.1.186.247 LEN=40 TOS=0x00 PREC=0x00
TTL=242 ID=44524 PROTO=TCP SPT=443 DPT=1844 SEQ=167712081Jan 21 15:09:30 localhost nmbd[3553]: [2007/01/21 15:09:30, 0] nmbd/nmbd_browsesync.c:find_domain_master_name_query_fail(353)
----
Jan 21 18:11:22 localhost kernel: [17238774.256000] ABORTED IN=ppp0 OUT= MAC= SRC=66.249.91.18 DST=89.1.154.138 LEN=40 TOS=0x00 PREC=0x00 T
TL=240 ID=64361 PROTO=TCP SPT=443 DPT=3372 SEQ=453243795 ACK=4128316759 WINDOW=9700 RES=0x00 RST URGP=0
Jan 21 18:12:22 localhost kernel: [17238834.256000] ABORTED IN=ppp0 OUT= MAC= SRC=66.249.91.18 DST=89.1.154.138 LEN=40 TOS=0x00 PREC=0x00 T
TL=240 ID=27529 PROTO=TCP SPT=443 DPT=3373 SEQ=637777572 ACK=4187157810 WINDOW=9700 RES=0x00 RST URGP=0
Jan 21 18:13:22 localhost kernel: [17238894.248000] ABORTED IN=ppp0 OUT= MAC= SRC=66.249.91.18 DST=89.1.154.138 LEN=40 TOS=0x00 PREC=0x00 T
TL=240 ID=61491 PROTO=TCP SPT=443 DPT=3374 SEQ=1111602080 ACK=4259912405 WINDOW=9700 RES=0x00 RST URGP=0
Jan 21 18:13:52 localhost kernel: [17238924.460000] ABORTED IN=ppp0 OUT= MAC= SRC=66.249.91.18 DST=89.1.154.138 LEN=40 TOS=0x00 PREC=0x00 T
TL=240 ID=24045 PROTO=TCP SPT=443 DPT=5905 SEQ=509515982 ACK=4021033420 WINDOW=9700 RES=0x00 RST URGP=0
Jan 21 18:14:22 localhost kernel: [17238954.252000] ABORTED IN=ppp0 OUT= MAC= SRC=66.249.91.18 DST=89.1.154.138 LEN=40 TOS=0x00 PREC=0x00 T
TL=240 ID=53340 PROTO=TCP SPT=443 DPT=3376 SEQ=1513670680 ACK=17869412 WINDOW=9700 RES=0x00 RST URGP=0
------- [lots of these]
[EDIT: some of those messages are samba related, it's not configured properly, so I just erased them.]
Any help would be apreciated, as for the moment my syslog is a garbage can for these kernel error messages... 
although that's not really a problems compared to the lack of a stable internet connection. Everything else in the systems works fine, mepis rocks!
Thanks a lot in advance!
Sorry to hear you are having
Posts: 4077
Sorry to hear you are having problems. I'm a little bit unclear about this:
...and since the problem occured on the last OS as well I suspect it has something to do with the modem somehow.
Does this mean that it happened in Windows or other OS too? Then indeed it might be a hardware problem, look into getting a new modem, or it might even be the provider...
Connect time 417.5 minutes.
That's 7 hours, pretty long time, does it stay on if you don't use the connection? Sorry I don't know much about modems but I saw that nobody responded...
--
Check out Mepis wiki: www.mepis.org/docs
re: hmmmmm.. I know I should be..
Posts: 519
I could access websites and everything. eth0 was getting its IP from a DHCP server (the modem). Then without a warning I could no longer recognize server-names, I could ping a specific IP but not a DNS address.
If you can ping an IP address but can use a URL with a domain name then perhaps your /etc/resolv.conf file got deleted?
After you get a good connection and everything works OW, run the file manager as root and make a copy of /etc/resolf.conf as /etc/resolv.conf.backup.
When your connection crashes copy the backup over resolv.conf (being sure to keep the name "resolv.conf") and see if that restores your ability to use the DNS.
--
GreyGeek
AdrianTM: What I meant to
Posts: 14
AdrianTM: What I meant to say was that I had the exact same problem on an earlier version of mepis, it never happened on Windows or other linux distributions. And it happens even while I'm active - on the net or otherwise.
GreyGeek: That's a good advice, I didn't know resolve.conf. Unfortunatly(?) things have slightly changed and that situation no longer happens. After startup, I'd activate the connection (still have to turn off and on the network interface...) and it would run for some time - could be minutes or hours - then stop reacting (no ping to either IP or URL), and in the syslog I can see this message:
Jan 27 01:11:13 localhost pppd[14341]: No response to 3 echo-requests
Jan 27 01:11:13 localhost pppd[14341]: Serial link appears to be disconnected.
Jan 27 01:11:13 localhost pppd[14341]: Connect time 65.7 minutes.
Jan 27 01:11:13 localhost pppd[14341]: Sent 45207752 bytes, received 157021404 bytes.
Jan 27 01:11:19 localhost pppd[14341]: Connection terminated.
Jan 27 01:11:19 localhost pppd[14341]: Modem hangup
Then after a few seconds it would reconnect on its own with a different IP, and the modem's indicator lights show no sign of losing any of the links (it's an ethernet modem). this repeats several times, until finally it does it one last time but does not reconnect, repeating these two messages:
Pan 27 01:17:45 localhost pppd[653]: Timeout waiting for PADO packets
Jan 27 01:17:45 localhost pppd[653]: Unable to complete PPPoE Discovery
It takes a lot of voodoo to bring it back to life afterwards. Important to note that during all this time the syslog file is flooded with the messages I quoted before:
Jan 27 01:38:10 localhost kernel: [17276839.688000] ABORTED IN=ppp0 OUT= MAC= SRC=221.132.113.12 DST=89.0.192.10 LEN=40 TOS=0x00 PREC=0x00 TTL=113 ID=45040 PROTO=TCP SPT=18055 DPT=4693 SEQ=0 ACK=1240217212 WINDOW=0 RES=0x00 ACK RST URGP=0
Jan 27 01:38:31 localhost kernel: [17276860.532000] ABORTED IN=ppp0 OUT= MAC= SRC=89.20.226.8 DST=89.0.192.10 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=50121 PROTO=TCP SPT=63341 DPT=1314 SEQ=0 ACK=1247431262 WINDOW=0 RES=0x00 ACK RST URGP=0(The DST is my IP)
I'm pretty confident the two problems are related, but the last messages make no sense to me, if I only knew what they mean it might have helped. Anyway, until now whenever I needed a constant reliable connection I'd turn back to Windows, but yesterday it crashed (not related).
By the way, thank you both for taking the time to reply.
messages
Posts: 4864
message type 1
Serial link appears to be disconnected.
means that the adsl link has gone down.
Now the router will try to re-establish the link several times.
message type 2
Timeout waiting for PADO packets
means that while the physical link exists there is something else wrong with the link.
(I had this for ages and it was wrong at the exchange)
message type 3
Jan 27 01:38:10 localhost kernel: [17276839.688000] ABORTED IN=ppp0 OUT= MAC= SRC=221.132.113.12 DST=89.0.192.10 LEN=40 TOS=0x00 PREC=0x00 TTL=113 ID=45040 PROTO=TCP SPT=18055 DPT=4693 SEQ=0 ACK=1240217212 WINDOW=0 RES=0x00 ACK RST URGP=0
are the packets that went nowhere while the link is down.
none of these are telling us why the link goes down, which is what you need to know
the router is indifferent to what OS is used behind it so there must be a problem with what packets are sent to the router constantly, and possible jamming it up.
You mentioned that samba isn't right, so are you working on that?
About messages of the third
Posts: 14
About messages of the third type ("the packets that went nowhere while the link is down") - their destination was me so it seemed to me those are packets that were recieved but ignored, but I guess you're right saying these are all just symptoms. Samba - well, I've killed the daemons manually because so far I haven't found a single "disable samba" button anywhere on the KDE interface, only configuration menus. Would you suggest simply uninstalling it (I don't need a samba server and probably never will)? I could keep it by editing some rc files but there's got to be a more simple solution.
And even after disabling samba I'm getting these messages non-stop, and my connection is fine now. Could it be there's something more basic to it than just another running service that's interrupting?
packets
Posts: 4864
the packet listed was TCP on port 18055 (PROTO=)
this is not an allocated port
http://www.seifried.org/security/ports/18000/18055.html
so if they are inbound this suggests these are your attackers ( we all have them).
I don't know about windows firewalls at all, but perhaps that is set differently and doesn't bounce the packet straight back at the router or refuse it in the same way as iptables (guarddog is a gui for iptables) does.
confused
Posts: 14
This really confuses me...
They come from many different (and changing) adresses, with different destination and source ports, while I'm online or not. Are they all "attackers"?
I'll see what I can do about guarddog, maybe disable it and run a different firewall? but if that doesn't help keeping me online I'm currently pretty much out of answers.
EDIT: Well, after some testing I've decided the messages come from different file-sharing softwares' sources (amule, azureus) and sometimes from firefox, that guarddog doesn't seem to like (no guarddog = no flood!). So assuming I find a way to configure the firewall properly and disable samba (not there yet...) the syslog will be OK. Now I've seen the modem DOES hang-up on random times, which is either a hardware/software problem with the modem or my ISP joking at my expense. But still there are times when non of the above happens and the link resets itself, or times when I can't even connect after boot.
Any comment of any kind is very appreciated, as always.
hmmmm... I know I should be
Posts: 14
hmmmm... I know I should be patient due to the length (and complexity?) of my post, but the constant hangups bring the worst out of me...
does anyone with some networking knowledge have any thoughts of this?