Re: Comcast problems again

Thank you for responding. The reason I posted is I thought I recalled from years ago that comcast attempted to prevent people from using multiple computers via NATting. Possibly by blocking or intentionally slowing alternate ports used in NAPT 

Ping & traceroute never failed. I don't know the IP address for comcast, yahoo, et all, so I always did ping by DNS name so DNS worked too. 

Gathering data is hard because I have to reconfigure the network, shut down computers, go downstairs to reset cable modem each time. I have two computers, I used a winblows notebook and an ubuntu desktop. My internal network is convoluted because I have (not used for years) a cisco home lab and multiple segments. Not wanting to permanently allocate one of only a couple of routers with multiple ethernet ports, I have a small cisco (802) off of my main switch. It is the default router, either routing back to some other cisco lab off of the main switch or to the IPCOP machine also on the main switch. Slows my ethernet a little bit as traffic goes two ways over 10MB/Sec but I still get 3 MB/S download off of the net and has only been an issue in one online game system related app where I get t
 ypically 60-100 successes out of 175 while others get 80-120 (this app creates many web connections in a few seconds and ends them). 

Traceroute: Works as well as expected I think. Interesting that through IPcop, winblows works or at least gets further on many websites than linux which always eventually droped into "no response" I can give number of hops found for a number of sites if you want, but I doubt it matters. In all cases the last hop had the name of the target as part of the name, or was number only, so these were probably the targets' firewalls. 

It seems to be a byte rate issue, which is what I first thought, but then decided maybe not.. some data is getting through but not much. That means ping/traceroute have no problem, but web & mail do. IPcop shows data rates on the order of hundreds of bytes per second. I suppose something could be causing the IPCOP machine to be slow, but the web interface to it responds quickly so that seems unlikely. IPCOP does not report any errors on its interfaces. 

Some specific observations from today's attempt: 

Both winblows and Linux got the google search page after more than a minute. 
Linux got autocompletion suggestions as I typed in "masquerade linux howto". 
Winblows got suggested websites as I typed in "masquerade linux howto". 
Linux (only) succeeded on the first search I made, after several minutes. 
Subsequent attempts (both) did not even get the google home page after 5 or 10 minutes. 
Opening a search item (both) in a new tab got nowhere after 10 minutes. 
Clicking on the "cached" link (both) got the little box at the top identifying the date it was cached from, but nothing else. 
(prevuiosly) Thunderbird said it was connecting ang getting mail, but did not show any progress after many minutges. 

My firewall machine is very old, and I am worried about how to back it up (and I don't remember how I set it up, just following a cookbook), so maybe I should just start over with a Masquerading machine on newer hardware that has USB for backup. 

Does LEAF do standard NATting or Masquerading? From a quick scan of its website it seems to be NAT. Do you know of a "firewall" distro that does Masquerading? Might be more secure than normal NAT anyway. I'd love a Masquarading firewall that runs from a CD + floppy for parameters+ USB memory stick for dynamic data, like IP leases given out. The floppy would mean I can retain the previous set of parameters, also I could set up firewalls for friends, and just hand them a new floppy and new CD for upgrades. 

Just read the wikipedia article on masquerading, which seemed to call NAT just one form of masquerading, so now I am confused as to the differences between standard NAT like IPCOP and a "masquerading" interface as suggested to be an aternative. Other sources implied a NAT box could be identified from an external perspective (so comcast could intentionally make it not work) but a masquerade could not be differentiated from a singe computer.. 

--Carey 

----- "Trev Peterson" <[email protected]> wrote: 


I run on comcast business behind a leaf (linux firewall somewhat like 
ipcop) with no problems. I would recommend a bit of troubleshooting to 
find out exactly where the problem is: 

1. make sure DNS resolution is working (comcast has had DNS issues 
several times in the past). Try ping google.com and makes sure you get 
an address to ping. 

2. Trace the IP path along the route email and web use to see where it 
is blocked. 
tcptraceroute -n google.com 80 (this will trace the web traffic to 
google) 
traceroute -n <name of your mail provider> 25 (this will trace smtp 
to your email provider) 

If you are not sure what to make of the output cut and paste it and send 
it to me. I'll explain where the problem is. Hope this helps,

-- 
Linux Users Of Northern Illinois (Chicago) - Technical Discussion 
http://luni.org/mailman/listinfo/luni