strange IP problem

[bjdobs]

XP HOME

High speed ISP using dynamic IP/DNS ... ipconfig, grc.com and ISP confirm the same IP however PC anywhere host doesn't appear to connect from a remote plus whatismyip.com and whatismyipaddress.com give a different IP address ... there is no proxy and the TCPIP is set for auto IP/DNS

has anyone encountered a problem like this?

 

[gpalmer711]

I can only speak about my ISP NTL in UK. They use the Cable Set Top Boxes to connect you to the Internet at Broadband speeds. This means that although you may not have a proxy installed on your machine, they are using them on their end. This is the IP address that is picked up at the two websites that you mentioned. If you are tring to connect to YOUR pc from another, you should use the IP Address from ipconfig.

You should also check to see if the Microsoft Internet Connection Firewall is enabled, and if so configue access on whatever port PC Anywhere uses.

Take a look at

http://support.microsoft.com/?kbid=283673

and

http://support.microsoft.com/default.aspx?scid=kb;en-us;324731

Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk

 

[bjdobs]

If I drop another PC in place of this one I have no problems with PC Anywhere or whatismyip.com so I don't think this is an ISP issue.

Its almost as if a spoofing process is running on this box ... Trojan? Virus? Both PC's that I am using have XP and NIS firewalls ... PCA is set up identically on both machines ... I have even turned off the firewall momentarily to see if Norton is doing something but to no avail.

I think I need to find an on line scanner other then symantec as whatever is going on has gotten by Norton.

 

[bcastner]

The issue is confusing, but please try the utility discussed in faq779-4625

 

[nrunge]

I would check logs from NIS or run a program like Ethereal to capture the data from your NIC to see what is going on, this will be especially helpful in diagnosing the norton problem.

 

[gpalmer711]

If you are looking for an online virus check take a look at Smah's great faq FAQ760-3862

I would recommend the Trend Micro and Panda virus checkers.

If I drop another PC in place of this one I have no problems with PC Anywhere or whatismyip.com so I don't think this is an ISP issue.

My PC is setup ok and I get the sort of problems you are discussing about with the whatismyip.com site because they are catching my ISP's Proxy ip and not my own.

Even though you are using NIS firewall, have you checked to see if the MS ICF is enabled? If it is it would deffinatly stop connections to your machine by PCanywhere.

If you know what port PCAnywhere is trying to connect to you could try pinging that port number from a remote machine to see if you it is open or closed.

Also check Norton FireWall to make sure that the PCanywhere software is not set to "Block All"


Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk

 

[noellees1]

Could the mac adress of your ethernet device be messed up or something ?? just an idea i know some isps need mac adresses for each pc using the service.

http://www.spano.co.uk

The way web design should be

 

[bjdobs]

ran winsockfix ... no change

reinstalled PCA ... no change

deleted all cookies and temp internet files ... no change

This looks like two separate issues:

1) This machine has 3 users defined, only one user login has the problem with whatismyip.com

2) because PCA is a kernel like process (runs prior to the user login) none of the user level logins make any difference to the host mode. PCA is set up with the default ports ... the program list in NIS list PCA as automatic

I will try the remote ping plus see if I can find any NIS logs that show an issue ... although with NIS off there is still no change so I still think there is a system level problem for item 2 ... and an IE config level issue for item 1

 

[bjdobs]

Update:

installed ethereal on 2 machines to monitor PCA traffic ...

the Host (problem pc) gets the UDP and SYN TCP messages sent by the remote PC ... the HOST PC does not respond

on the remote I connected to a known PCA Host and the Host responded immediately to the UDP message then does a wack of TCP transactions

As for the traffic in for whatismyip.com ... cant make any sence out of the packets ... suspect the data being sent is either as hex and passed to a javascript or possibly as a gif file ... there is alot of port 8080 traffic but nothing that stands out.

 

[bjdobs]

Correction

whatismyipaddress.com has no readable IP response

whatismyip.com responds after one poke at port 8080

the reponse has an incorrect ip in plain text

 

[bjdobs]

At wits end ... I have done a complete update install of XP including reapplying all the critical and regular updates ... stripped IE and reinstalled ... this one has me completely stumped ... obviously there must be one or more registry entries that are involved and they weren't affected by reinstalling the OS or a regclean by Norton