slow page loading

[darcy]

wow,, the things one learns, thank* you, FP

here is result of test { i have left port #s out but will post if needed }:


Solicited TCP Packets: PASSED — No TCP packets were received from your system as a direct result of our attempts to elicit some response from any of the ports listed below — they are all either fully stealthed or blocked by your ISP. However . . .



Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.)



Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

______

textual summary:

0 Ports Open
0 Ports Closed
26 Ports Stealth
---------------------
26 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: FAILED - ALL tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.



i will post screenshots +/or copy text of the assorted modem/router firewall description options (if you need them?).

[FlyingPenguin]

It would be nice to kill ping replies. You'll have to look through the router settings to see if you can disable it. Should be on the same page as the firewall or a sub-page of the firewall.

Could be phrased many ways.Look for a setting to disable ping, ICMP, Echo, Solicitation.

Some routers don't let you turn of ICMP.

See if you can download a PDF manual for your router and do a text search for echo and ICMP.

[Executioner]

Would this affect your ping you see on multiplayer games on the net? Normally I sort based on ping, so if that was disabled it would not show up in a ping request?

[FlyingPenguin]

Not the same thing Exec. ICMP Ping (Echo) allows your router to respond when someone else pings your IP. You want your ports stealthed and Echo disabled to avoid giving away they there's anything at your IP - port scanners just bounce off you like you're a black hole.

Anything that gives you away invites attack.

[Executioner]

Thanks for that. I did test my ports, and ICMP was enabled, but now I have it disabled. The only other port that it identifies is port 113.

Your computer has responded that this port exists but is currently closed to connections.

From reading the info when I click on port 113, it's not clearly defined whether to have it open or stealth.

[FlyingPenguin]

All ports should be stealthed.

Port 113 is called the IDENT port. Some routers (like mine) have a separate setting for disabling that.

[Executioner]

Should I be concerned with it? My router does not have an option for disabling the port.

[FlyingPenguin]

No.

[darcy]

{ i see i am not the only one learning ; ) }



thank you, FP : )

i found manual for my model #/version { saved the .pdf as well as the url }, but i could find nothing that would disable ping/echo/ICMP, etc.
also, the illustrations in the manual look nothing like what i have now { they look like the A90 model's panel. }


mine looks like this under Firewall [ there are no sub-pages ]:



i do not know where else to look.

i did read, among my many searches, that setting it to medium would cause ftp {which i use frequently } woes, although that seems contradictory to the wording in the screenshot, above.

i do not know how to locate separate ports to play w/their settings.

am i in trouble now?

[FlyingPenguin]

Don't worry about it Darcy. It's good enough.

[darcy]

thank u very* much for your help, FP

[darcy]

heaven help me,,

i logged on earlier this morning and, after about 30 mins., i lost internet connection.
the "internet" icon on router/modem was either solid red or not lit up at all.


i typed modem/router url into address bar and logged in.
- under "gateway status" it said gateway is not ready for connection (or something to that effect)
- DSL link showed as connected
- Internet Status showed as not connected.
- PPP showed as down.

i then manuevered my way to Network Connections on lappie.
- Local Area Connection showed as Connected.
-1394 Connection 2 {1394 Net Adapter #2} showed as Connected.

i was able to ping router.

after fooling around w/the cables, rebooting, shutting modem off/on, etc etc, w/no change, i shut down and ran some errands, fully expecting i would have to make dreaded call to ISP again once i got back.

i just now powered up, and i am able to get online again, - at least for now.

was this just a glitch, or indicative of something particular screwing up again?
what am i looking for if/when this should happen again?
{ i think i will go postal if i have to deal w/front desk help again }.

thank* you

p.s. - { i hope i am not infected w/something now.. } ~

i did not see the words "Firewalled" in the Network Connections window, which kind of freaked me out because they were Firewalled before, so i went to check if "On" was ticked, and it was, so i do not understand that. i then clicked the "OK" button again, and after a few secs the Connection Properties showed "Connected, Firewalled".

now i have checked System Event Viewer, and found these:

System Event Viewer:

ERROR - 10:44:22AM
Product: Windows Operating System
ID: 17
Source: W32Time
Version: 5.2
Symbolic Name: MSG_MANUAL_PEER_LOOKUP_FAILED_RETRYING
Message: Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer '%1'. NtpClient will try the DNS lookup again in %3 minutes. The error was: %2

Explanation
The name of the time source, a manually configured peer, cannot be resolved.


User Action
Do one or more of the following:

Verify that the DNS name for the time source is a valid name.
Verify that the time source is available on the network by pinging the server.


______________________________
WARNING - 11:35.14AM

Product: Windows Operating System
ID: 4226
Source: Tcpip
Version: 5.2
Symbolic Name: EVENT_TCPIP_TCP_CONNECT_LIMIT_REACHED
Message: TCP/IP has reached the security limit imposed on the number of concurrent (incomplete) TCP connect attempts.

Explanation
The TCP/IP stack in Windows XP with Service Pack 2 (SP2) installed limits the number of concurrent, incomplete outbound TCP connection attempts. When the limit is reached, subsequent connection attempts are put in a queue and resolved at a fixed rate so that there are only a limited number of connections in the incomplete state. During normal operation, when programs are connecting to available hosts at valid IP addresses, no limit is imposed on the number of connections in the incomplete state. When the number of incomplete connections exceeds the limit, for example, as a result of programs connecting to IP addresses that are not valid, connection-rate limitations are invoked, and this event is logged.

Establishing connection–rate limitations helps to limit the speed at which malicious programs, such as viruses and worms, spread to uninfected computers. Malicious programs often attempt to reach uninfected computers by opening simultaneous connections to random IP addresses. Most of these random addresses result in failed connections, so a burst of such activity on a computer is a signal that it may have been infected by a malicious program.

Connection-rate limitations may cause certain security tools, such as port scanners, to run more slowly.


User Action
This event is a warning that a malicious program or a virus might be running on the system. To troubleshoot the issue, find the program that is responsible for the failing connection attempts and, if the program might be malicious, close the program as follows.

To close the program

At the command prompt, type
Netstat –no
Find the process with a large number of open connections that are not yet established.
These connections are indicated by the TCP state SYN_SENT in the State column of the Active Connections information.
Note the process identification number (PID) of the process in the PID column.
Press CTRL+ALT+DELETE and then click Task Manager.
On the Processes tab, select the processes with the matching PID, and then click End Process.
If you need to select the option to view the PID for processes, on the View menu, click Select Columns, select the PID (Process Identifier) check box, and then click OK.

--- how do i find the program that is responsible for the failing connection attempts and, if the program might be malicious... " if this is what has now happened ?!



thank* you

[FlyingPenguin]

It's not unusual to lose the connection once in a while. Whenever it happens the first thing you should do is power cycle the modem (turn it off and then on again). That's the first thing the ISP will have you do anyway and 90% of the time it works.

Sometimes the DSL is just down for a while.. Worth calling to find out if there's an outage but no sense in getting bent out of shape. Usually it's back in an hour. You can have the modem connected and have a DSL light and be able to ping the modem, but DSL can still be down if it's a problem on their end.

Ignore the W32Time errors. That's just the service that syncronizes your clock. If the time server doesn't respond promptly (happens all the time because millions of PCs are checking the time) or if you lose your Internet connection while it tries to check the time, you get the error. No big deal.

Not sure about the 2nd error but if it only happens once in a blue moon don't worry. The Windows TCP/IP stack has always been a little buggy and you'll occasionally see a weird error.

[darcy]

ok, thank you for that, FP. i guess i am still waiting for something to go wrong w/this router : )

Not sure about the 2nd error but if it only happens once in a blue moon don't worry. The Windows TCP/IP stack has always been a little buggy and you'll occasionally see a weird error.

i just took a longer scroll in System Event Viewer, - and seems this "Warning" has been occurring since feb 2, just about every day.

[darcy]

well, here i am again,, w/same crap speeds i was getting when i 1st posted about this in feb.

started saturday and is still going on. i am just reviewing my thread here to refresh myself b4 dealing w/ISP.

@#$%^ ~ 'nuf said : )