Member Avatar for gsspeak

Hi,

I have an interesting problem.
I am running a win server 2003 and win xp sp3 network. Until recently we have been able to access all network resources and the internet without any problems.
Now however, we can still access the network resources, (printers/ server files etc), the exchange email system and blackberry servers can send and receive messages, the antivirus solution is able to update trhoughout the network. The only trouble we have now is that we get intermittant web surfing, i.e. sometimes when we open IE8 and type in a page it will connect and allow us to browse that site (if somewhat slower than usual), others we get the can not connect .... even after refreshing the page.
I have checked the router and switches trafic using Wireshark and all appears to be fine.
Does anyone have any suggestions on how to proceed?
thanks

  • 2 Contributors
  • 4 Replies
  • 252 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gsspeak

Dani AI

Generated

The pattern described — local resources, Exchange and AV updates working while interactive web browsing is intermittent, and the problem disappearing when few users are online — points away from basic L2/L3 faults and toward an HTTP-specific path or a stateful middlebox problem. ’s advice to start with the basics is sound; the next round of checks should focus on HTTP interception, connection-tracking limits, and client-side HTTP hooks that were not covered earlier.

Common causes to investigate (practical checks):

  • Proxy auto-detection / PAC / WPAD issues or a flaky transparent proxy at the edge. Temporarily force a direct HTTP connection from a client (bypass the browser) to see whether TCP/HTTP completes:

    # quick TCP/HTTP test from a client (if available)
curl -v http://example.com
telnet example.com 80

  • Connection-tracking / NAT exhaustion on the gateway. When many browsers are open, a router/firewall can run out of translation slots or CPU, allowing existing services but blocking new HTTP sessions. Inspect the gateway for active sessions and CPU, and on endpoints check for many short-lived sockets or TIME_WAIT entries:

    # Windows
netstat -an | findstr TIME_WAIT

# Linux
netstat -an | grep TIME_WAIT

If counts are very high, reduce NAT timeouts, identify/limit high-connection hosts (P2P, large update storms), or increase the gateway’s session capacity.

Also check client-side HTTP interceptors: antivirus/web filters, LSPs or browser toolbars can inject a proxy and fail intermittently. A Winsock reset plus disabling web-scanning for a test client can quickly rule this out:

netsh winsock reset

Finally, collect gateway captures (port mirror) to compare a successful vs failed HTTP session for TCP RSTs, retransmits or proxy errors, and review firewall logs for dropped/denied connections. Perform disruptive changes in a maintenance window. These focused checks narrow the root cause more quickly than repeating basic connectivity tests.

Recommended Answers

All 4 Replies

Member Avatar for rch1231

Download and run Malwarebytes free scanner. It will tell you if there is something redirecting your web activities.

Member Avatar for gsspeak

Thanks rch1231 for the reply. I Ihave tried that ... all systems clean as a whistle... my first thought was virus / malware.
But as we have full access to all other internet related services (email through exchange, windows updates, AV updates etc), I'm thinking that it is likely to be a setting issue on the main server

Member Avatar for rch1231

Well I tried the quick and easy answer. Sorry. How about this:

Start with the basics and work your way up. Double check the cable is plugged in all of the way at both ends. You would be amazed at how many loose cables cause intermittent problems and look like they are properly connected.

What does ifconfig (ipconfig for windows) report?

Can you ping the computers network port?

Can you ping any other systems?

Does this just happen some time or all of the time?

Can you ping the gateway, and each of the nameservers?

Can you query the nameservers like this:

[root@cwsvr02 cur]# nslookup
Server:
Address:

Non-authoritative answer:
Name:
Address:

Also try traceroute (or tracert for windows) to an IP and domain and see if there are any bottlenecks along the way?

Post what you find and we will do what we can.

Member Avatar for gsspeak

Thanks rch1231.

I can ping servers / workstations / printers etc all is working in that manner.

Now that i'm back in work, with out any other users the internet it seems fine. I've turned a few machines on connected throught to the internet without issues.

The issue may have corrected itself....
I will know better on monday when all of the users are back in.... if there are issues I will disconnect the machines and reconnect them one by one. This may give me a better picture of what is going on.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.