Using Wireshark to troubleshoot wireless connections?
Philip Herlihy
"good" or even "excellent" wireless signal. I get the dreaded "Limited
or no connectivity" message. On one machine I've tried three access
points and four adapters (one at a time!).
I've started fooling around with Wireshark to try and identify what's
going on - I've wondered if changing MTU or RWIN parameters might help,
but I'd be very glad of any existing experience in this sort of thing,
perhaps a reference to a site somewhere?
Phil, London
John Wunderlich
news:bXBSl.119044$tb.1...@newsfe07.ams2:
"Limited or no access" indicates it could not negotiate a DHCP IP
address from the wireless router / access point. It's unlikely to be
a MTU or RWIN problem. MTU problems pop up when large packets are
exchanged (like file transfers). DHCP negotiation is all done with
small packets and is unlikely to be affected.
Your problem sits squarely within the network security realm. What
kind of security is being used on the wireless routers/access points?
WPA2 was not supported in Windows XP until SP3 came out (although
Windows does have a patch for SP2 and most vendor software would
support it). As a first step, I'd temporarily configure the
router/access point with no security and see if you can connect and
then go from there. Make sure the security used on the access point
is supported by the client.
Also beware of wireless client software that remember profiles. Once
you connect with (e.g.) an access point configured with no security,
then once security is enabled, you may not be able to connect until
you delete or edit the remembered profile.
HTH,
John
Philip Herlihy
Thanks, John - that's useful. Of course, as soon as it's pointed out,
it's obvious that DHCP must be using small packets, so that's probably
stopped me going down a lengthy blind alley. I've checked for old
profiles, and the security in use is the same as on other machines of
the same type, running the same version of Windows, and using the same
wireless cards - which is what makes it all so inexplicable. Worse,
occasionally I do get a connection! If ever there was an aspect of
computing under the control of gremlins, this has to be it...
I'll recheck everything - I must have missed something...
Phil
Philip Herlihy
Neat utility! Lots of fertile options - thanks!
Phil
John Wunderlich
If you have other computers available with the same wireless card, try
swapping cards and see if the problem follows the card or the computer.
It could be a marginal card.
Also consider nearby radio interference. Try moving the computer.
Make sure there's no 2.5GHz cordless phones, microwave ovens, etc.
nearby.
A firewall is also a possibility except that you say it does connect
once in a while.
Good Luck,
John
Philip Herlihy
Bizarrely, it seems to follow the computer. I've tried other cards. No
evidence (on the strength of an inexpensive meter) of any RF
interference, and moving the thing doesn't seem to make any difference.
It's quite happy with a cable!
Phil
John Wunderlich
> Bizarrely, it seems to follow the computer. I've tried other
> cards. No evidence (on the strength of an inexpensive meter) of
> any RF interference, and moving the thing doesn't seem to make any
> difference.
> It's quite happy with a cable!
>
Strange. Have you tried using the Device Manager to un-install then
re-install the adapter (after reboot)?
A shot-in-the dark might be a program "lspFix" and/or "WinsockXPFix"
which sometimes solves strange problems with the network stack.
Couldn't hurt to try:
<http://www.cexx.org/lspfix.htm>
<http://www.snapfiles.com/get/winsockxpfix.html>
Out of ideas...
John
Philip Herlihy
Thanks, John - worth a try!
If I do find anything I'll post back!
Phil
Philip Herlihy
Wireshark was certainly interesting to play with - even if it didn't
help me fix the problem. I found the office router can log packets and
dump them to a file which Wireshark can read. Did help me satisfy
myself that the problem is not at that level, and I learned a lot about
how the network is running.
After a lot of fiddling and study of all sorts of traces (including the
problem PC's firewall log) I've ended up with the finding that this
machine can readily pick up an IP address from the router via either of
two connected Access Points (one of the same make as the network card)
but nothing can ping or otherwise connect to that address. Not even the
router's own diagnostic ping can reach the address it's just handed out
(used icponfig /release to ensure that a new address was subsequently
being taken). I've also fiddled with every aspect of the wireless
parameters, including RTS/CTS and fragmentation thresholds,
systematically, one at a time. I did try the winsock fix; no joy there
either. At one point the card was claiming to be connected to an Access
Point but the AP didn't have it in its list of clients. After much
fiddling both ends agree on the connection, but it just doesn't work.
Other machines are happily connecting to the APs, and this machine is
working fine over an Ethernet cable. That's just how it's going to stay
- enough!
Phil
John Wunderlich
Strange problem!
It would be interesting to look at the routing table after it has
obtained a DHCP address. Bring up a command prompt then enter:
route print
It's acting like either a firewall is blocking or the default route
is not being set.
-- John
Philip Herlihy
> Philip Herlihy <thiswillb...@you.com> wrote in
..
>>
>> After a lot of fiddling and study of all sorts of traces
>> (including the problem PC's firewall log) I've ended up with the
>> finding that this machine can readily pick up an IP address from
>> the router via either of two connected Access Points (one of the
>> same make as the network card) but nothing can ping or otherwise
>> connect to that address. Not even the router's own diagnostic
>> ping can reach the address it's just handed out (used icponfig
>> /release to ensure that a new address was subsequently being
>> taken).
...
>
> Strange problem!
> It would be interesting to look at the routing table after it has
> obtained a DHCP address. Bring up a command prompt then enter:
> route print
> It's acting like either a firewall is blocking or the default route
> is not being set.
> -- John
I'll try this when I next get access to the machine - Thanks!
I did check the main router firewall and the XP SP2 firewall.
Phil
Philip Herlihy
The output of the "Route Print" command is at:
http://cid-2e572770a3a5cd55.skydrive.live.com/self.aspx/Public/rp.txt
10.0.0.138 is the Ethernet adapter; 10.0.0.204 the wireless. Not much
used to reading these recently, but it looks ok to me.
Also tried a different SSID, using only lower-case alpha characters.
Same lack of functioning.
I conclude that this problem is due to pixies stealing the packets.
This is where I give up!
While you're on skydrive, there are some particularly lovely English
songs here:
https://cid-2e572770a3a5cd55.skydrive.live.com/self.aspx/SJB/EnglishSongs.mp3
It's not all Led Zepplin over here (although they're good too). Showing
my age a bit perhaps...
Phil
John Wunderlich
The routes look good to me too.
Your wired connection has priority over the wireless, so I assume that
you unplug your wired connection when testing the wireless.
-- John
Philip Herlihy
No, all I've done is try to establish an incoming connection by pinging
10.0.0.204, or trying to connect a VNC client to that address. I've
checked the machine's firewall, and set specific permissions per
adapter, no joy.
Phil
John Wunderlich
>> The routes look good to me too.
>> Your wired connection has priority over the wireless, so I assume
>> that you unplug your wired connection when testing the wireless.
>>
>>
>> -- John
>
> No, all I've done is try to establish an incoming connection by
> pinging 10.0.0.204, or trying to connect a VNC client to that
> address. I've checked the machine's firewall, and set specific
> permissions per adapter, no joy.
>
When a ping packet comes into the wireless address 10.0.0.204, the
computer tries to send the ping back. According to the routing
table, the wired connection (10.0.0.138) has priorty on outgoing
packets to the 10.0.0.x subnet (metric 20 vs. 40), so the return ping
goes out the 10.0.0.138 port. When the return ping arrives at the
sending computer with an origin of 10.0.0.138 instead of 10.0.0.204,
it discards it (because it came from the wrong device) and you don't
see a response.
A similar thing will happen on all incoming connections to your
wireless adapter... The return packets will exit on the wired port
and confuse the sending device.
If you physically unplug the wired connection, then the wireless
connection will become the priority connection and things may start
working.
HTH,
John
Philip Herlihy
Thank you for an elegant (startling!) analysis. I'll certainly try this
once more - maybe, just maybe, after all that twiddling it'll work?
It seems very surprising that Ping works this way - this won't be the
only machine out there with more than one network adapter!
Phil
John Wunderlich
> It seems very surprising that Ping works this way - this won't be
> the only machine out there with more than one network adapter!
>
It's not "ping" that works this way, it's the Network Stack that sits
between the NICs and the Applications (e.g. ping) that receive and send
packets. An application will generate a data packet and send it to the
network stack which will take care of adding TCP and Ethernet headers,
checksums, etc, before directing it to the appropriate NIC to send to
the network.
You're right. Lots of machines have more than one network adapter.
The catch in your case is that both adapters connect to the same
subnet. The norm is to have one NIC connecting to one subnet and the
other NIC connected to a different, perhaps small, local subnet. Just
Google for "multiple nics same subnet" and you will see the problems
that people have.
-- John
Philip Herlihy
Quite an education!
Thanks, John!
Phil
Philip Herlihy
Most definitely an education. Once I got the user to disconnect the
Ethernet cable, the connection worked: I can ping the adapter and she
can browse the web - all wireless.
So, one of my tweaks must have fixed things, but since I was operating
remotely via cable, that was obscuring the results. I guess if I wanted
to try this again I'd set up a (non-persistent) route through the
wireless adapter using "Route Add" for just one target address, and
fiddle around until I could connect to that.
Thank you for your patient and invaluable help.
Best wishes,
Phil (happy now)
John Wunderlich
> I guess if I wanted to try this again I'd set up a
> (non-persistent) route through the wireless adapter using "Route
> Add" for just one target address, and fiddle around until I could
> connect to that.
"Route Add" should work. Alternatively, you could also change the
default metric for the wireless interface to have higher priority
(lower metric) than the wired connection -- with different side-
effects, of course.
> Thank you for your patient and invaluable help.
> Best wishes,
>
> Phil (happy now)
>
Glad to help. Thanks for the feedback.
-- John
John Wunderlich
> I guess if I wanted to try this again I'd set up a
> (non-persistent) route through the wireless adapter using "Route
> Add" for just one target address, and fiddle around until I could
> connect to that.
"Route Add" should work. Alternatively, you could also change the
default metric for the wireless interface to have higher priority
(lower metric) than the wired connection -- with different side-
effects, of course.
> Thank you for your patient and invaluable help.
> Best wishes,
>
> Phil (happy now)
>
Glad to help. Thanks for the feedback.
-- John