jokerl90
join:2008-04-20
Blairsville, GA
| Firewall gone crazy
Hello fellow Windstreamers. First post here. Been having the same problems as some here, frequent disconnects and terrible support in that far away land.
What brings up this post is that my 4200 firewall is "jumping off the desk"! lol
2008-04-26 15:27:28 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=2209 DF=1 MF=0 byte-off=0
2008-04-26 15:27:28 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=2210 DF=1 MF=0 byte-off=0
2008-04-26 15:27:31 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=2560 DF=1 MF=0 byte-off=0
2008-04-26 15:27:31 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=28260 DF=1 MF=0 byte-off=0
2008-04-26 15:27:31 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=28261 DF=1 MF=0 byte-off=0
2008-04-26 15:27:34 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=28596 DF=1 MF=0 byte-off=0
2008-04-26 15:27:37 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=3448 DF=1 MF=0 byte-off=0
2008-04-26 15:27:40 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=29135 DF=1 MF=0 byte-off=0
2008-04-26 15:27:43 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=3272 DF=1 MF=0 byte-off=0
2008-04-26 15:27:43 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=3273 DF=1 MF=0 byte-off=0
2008-04-26 15:27:46 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=3734 DF=1 MF=0 byte-off=0
2008-04-26 15:28:08 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=576 id=5024 DF=0 MF=0 byte-off=0
2008-04-26 15:28:11 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=4454 DF=1 MF=0 byte-off=0
2008-04-26 15:28:11 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=576 id=29963 DF=0 MF=0 byte-off=0
2008-04-26 15:28:20 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=576 id=6079 DF=0 MF=0 byte-off=0
2008-04-26 15:28:23 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=576 id=30443 DF=0 MF=0 byte-off=0
2008-04-26 15:28:23 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=576 id=6027 DF=0 MF=0 byte-off=0
2008-04-26 15:28:32 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=7992 DF=1 MF=0 byte-off=0
2008-04-26 15:28:35 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=31258 DF=1 MF=0 byte-off=0
2008-04-26 15:28:35 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=576 id=7881 DF=0 MF=0 byte-off=0
2008-04-26 15:28:47 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=9621 DF=1 MF=0 byte-off=0
2008-04-26 15:28:56 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=11192 DF=1 MF=0 byte-off=0
2008-04-26 15:28:59 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=390 DF=1 MF=0 byte-off=0
2008-04-26 15:29:11 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=12823 DF=1 MF=0 byte-off=0
2008-04-26 15:29:44 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1272 len=1420 id=17871 DF=1 MF=0 byte-off=0
2008-04-26 15:29:47 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1289 len=1420 id=4090 DF=1 MF=0 byte-off=0
2008-04-26 15:29:59 GMT E |Firewall |D:19:0 TCP 69.10.233.10:80 -> 192.168.254.1:1291 len=1420 id=18650 DF=1 MF=0 byte-off=0
2008-04-26 15:50:32 GMT E |Firewall |D:19:0 TCP 216.239.122.193:80 -> 192.168.254.1:1684 len=40 id=30562 DF=0 MF=0 byte-off=0
2008-04-26 15:50:32 GMT E |Firewall |D:19:0 TCP 216.239.122.193:80 -> 192.168.254.1:1686 len=40 id=29794 DF=0 MF=0 byte-off=0
2008-04-26 15:51:40 GMT E |Firewall |D:19:0 TCP 216.239.116.65:80 -> 192.168.254.1:1695 len=40 id=6509 DF=0 MF=0 byte-off=0
2008-04-26 15:52:01 GMT E |Firewall |D:19:0 TCP 216.239.122.200:80 -> 192.168.254.1:1681 len=40 id=17427 DF=0 MF=0 byte-off=0
2008-04-26 15:52:12 GMT E |Firewall |D:19:0 TCP 216.239.122.220:80 -> 192.168.254.1:1805 len=40 id=55141 DF=0 MF=0 byte-off=0
2008-04-26 15:52:12 GMT E |Firewall |D:19:0 TCP 216.239.122.220:80 -> 192.168.254.1:1688 len=40 id=18022 DF=0 MF=0 byte-off=0
2008-04-26 15:52:12 GMT E |Firewall |D:19:0 TCP 216.239.122.220:80 -> 192.168.254.1:1653 len=40 id=19558 DF=0 MF=0 byte-off=0
2008-04-26 16:50:15 GMT E |Firewall |D:19:0 TCP 4.71.104.187:80 -> 192.168.254.1:2004 len=40 id=32324 DF=0 MF=0 byte-off=0
2008-04-26 17:02:18 GMT E |Firewall |D:19:0 TCP 4.71.104.187:80 -> 192.168.254.1:2086 len=40 id=54424 DF=0 MF=0 byte-off=0
2008-04-26 17:04:11 GMT E |Firewall |D:19:0 TCP 216.239.122.200:80 -> 192.168.254.1:2069 len=40 id=6143 DF=0 MF=0 byte-off=0
2008-04-26 17:05:00 GMT E |Firewall |D:19:0 TCP 216.239.122.220:80 -> 192.168.254.1:2078 len=40 id=17825 DF=0 MF=0 byte-off=0
2008-04-26 17:10:41 GMT E |Firewall |D:19:0 TCP 208.66.64.210:80 -> 192.168.254.1:2263 len=40 id=55957 DF=0 MF=0 byte-off=0
2008-04-26 17:15:06 GMT E |Firewall |D:19:0 TCP 207.126.123.20:80 -> 192.168.254.1:2217 len=40 id=29436 DF=1 MF=0 byte-off=0
2008-04-26 17:15:24 GMT E |Firewall |D:19:0 TCP 216.239.116.152:80 -> 192.168.254.1:2249 len=40 id=58798 DF=0 MF=0 byte-off=0
2008-04-26 17:15:24 GMT E |Firewall |D:19:0 TCP 216.239.116.65:80 -> 192.168.254.1:2256 len=40 id=31918 DF=0 MF=0 byte-off=0
2008-04-26 17:15:24 GMT E |Firewall |D:19:0 TCP 216.239.116.157:80 -> 192.168.254.1:2225 len=40 id=23215 DF=0 MF=0 byte-off=0
2008-04-26 17:15:26 GMT E |Firewall |D:19:0 TCP 168.75.65.85:80 -> 192.168.254.1:2226 len=40 id=26788 DF=1 MF=0 byte-off=0
2008-04-26 17:15:34 GMT E |Firewall |D:19:0 TCP 64.213.200.106:80 -> 192.168.254.1:2261 len=40 id=28957 DF=0 MF=0 byte-off=0
2008-04-26 17:16:13 GMT E |Firewall |D:19:0 TCP 207.171.191.245:80 -> 192.168.254.1:2262 len=40 id=12510 DF=1 MF=0 byte-off=0
2008-04-26 17:16:16 GMT E |Firewall |D:19:0 TCP 64.191.203.30:80 -> 192.168.254.1:2248 len=40 id=53754 DF=0 MF=0 byte-off=0
2008-04-26 17:16:56 GMT E |Firewall |D:19:0 TCP 192.156.198.235:80 -> 192.168.254.1:2210 len=40 id=30980 DF=1 MF=0 byte-off=0
2008-04-26 17:17:06 GMT E |Firewall |D:19:0 TCP 207.126.123.29:80 -> 192.168.254.1:2224 len=40 id=15806 DF=1 MF=0 byte-off=0
2008-04-26 17:17:06 GMT E |Firewall |D:19:0 TCP 207.126.123.20:80 -> 192.168.254.1:2246 len=40 id=11966 DF=1 MF=0 byte-off=0
2008-04-26 17:34:45 GMT E |Firewall |D:19:0 TCP 4.71.104.187:80 -> 192.168.254.1:2370 len=40 id=13730 DF=0 MF=0 byte-off=0
2008-04-26 17:38:25 GMT E |Firewall |D:19:0 TCP 216.239.122.200:80 -> 192.168.254.1:2352 len=40 id=34105 DF=0 MF=0 byte-off=0
2008-04-26 17:38:26 GMT E |Firewall |D:19:0 TCP 216.239.122.220:80 -> 192.168.254.1:2363 len=40 id=59065 DF=0 MF=0 byte-off=0
Is this something I should be worried about? Contact the abuse e-mail from the whois for the IP's? Could someone please tell me what len,id,DF,MF,byte-off means?
I hope the copy and paste from the system log is not too long. I wanted to show the scope of what is happening.
Many thanks! |
|
Seph83
Gone Insane
Premium
join:2004-04-29
Blairsville, GA
 ·Windstream
1 edit | Hello fellow Blairsvillian! Unfortunately, I've never looked at the 4200's firewall log so I'm not sure what it's supposed to look like, and can't access it myself, because I have it running as a bridge, with an El Cheapo Linksys doing the routing. I'm sure someone will be along soon to help with that one.
As far as frequent disconnects, check your SNR and Attenuation to make sure your margins are where they should be. Your SNR should be above 12 or 13(ideally above 15) and your Attenuation should be below 60. To check those click "Status and Statistics" on the 4200's menu, and then click "DSL". Also, do you know which Remote Terminal you are on, and how far you are from it?
--
"I've Gone to Find Myself. If I Get Back Before I Return, Keep Me Here!!" |
|
jokerl90
join:2008-04-20
Blairsville, GA
| reply to jokerl90
Hey there Seph, glad to see someone else from B'ville here!Sometimes I think I might have better luck catching a satellite signal with a washtub than using WS. lol
My SNR is all over the place, from -2 to 10. Atten stays around 57 to 58. WS tech has changed NID, removed taps, and changed pin. Dsl has been stable the past few days, I'm taking a step back at the moment before diving into it again. |
|
AZinOH
join:2007-04-25
Swanton, OH
·Windstream
| With those stats, I can understand why you were having problems. What are the stats now, after the tech did his work? What modem are you using? Did the tech offer to swap it out? If no, am guessing the tech saw some improvement and didn't think it was a modem problem.
I don't know anything about the firewall log...but mine looks similar. |
|
jokerl90
join:2008-04-20
Blairsville, GA
| reply to jokerl90
Yes tech did give me a new modem. The work the tech did was over a period of a couple of weeks.
The SNR and ATTN numbers are current. At the moment they are sitting at 10/58. Most of last night into early morning the SNR numbers were -4,-3.5,.5, 2,3,4,etc. ATTN was steady at 58.
But during this time had no disconnects and speed tests were about normal.
About the speed, my connection is 1.5/384. I use Speakeasy speed test to Atlanta (about 100 miles away). I usually get 1.325/325 which I think is ok. Question about the speed test, the needle on the "meter" will jump above 768k then dip below 768k, then slowly climb to 1300's by the end of the download test. Is this ok? |
|
AZinOH
join:2007-04-25
Swanton, OH
·Windstream
| IMHO, 10/58 is still poor, but I don't know how far you are from the CO/RT. By contrast, I have the same 1.5/384 and am getting 29-31/17.5 at a distance of .5 mi from the RT and .75 mi from the CO. FWIW, I had SNR/Atten problems initially until the tech rewired the phone jack for me. Since then, I've been golden.
I prefer the speed test on DSLR to any other I've used (Tools menu), but I don't trust the Flash. I use the Sun Java exclusively. You will need to install Java to make use of it. |
|
Seph83
Gone Insane
Premium
join:2004-04-29
Blairsville, GA
·Windstream
| reply to jokerl90
Sorry for taking so long to reply, I've been working all day. If you want to see where your RT might be, check this map that I made back last July: »maps.google.com/maps/ms?f=q&view···427&z=11
There's at least one RT that's missing from it, the one near Poteete Creek Rd, off of GA-325, because I've never seen it to know exactly where it's at. But maybe this map will help a bit, to give you a very rough idea how far you might be. With a 58 Attenuation, you are probably barely within 1.5/384 range(18,000-21,000 feet wire distance). Might be time to pay a visit to the Tech Office which is on my map, located at 835 River Rd.  Tell 'em some crazy guy who used to keep bugging them about 3mb and DSL on past the bowling alley sent ya.
--
"I've Gone to Find Myself. If I Get Back Before I Return, Keep Me Here!!" |
|
jokerl90
join:2008-04-20
Blairsville, GA | reply to jokerl90
Thanks for the map! I live a little past Ivy Gap off of pleasant hill rd. (past the golf course) Rough guess puts me a little over 8000 ft from the B'ville CO in town.
For a small world kind of thing, I knew Pearl Wright when I was very young. |
|
Seph83
Gone Insane
Premium
join:2004-04-29
Blairsville, GA
·Windstream
| For living that close to town you should have a more stable connection than that. Probably got some squirrel/rat chewed lines or something crazy. Next time it rains, see if that SNR gets even worse.
--
"I've Gone to Find Myself. If I Get Back Before I Return, Keep Me Here!!" |
|
austin_d756
join:2007-06-20
united state
| reply to jokerl90
Your firewall would only show that if there was a incoming connection trying to be made.
It looks as if you have a service(s) running on the following ports, or a application or user is trying to connect to them.
1260-1299
and in the 2263 range.
Check if you would have any services\programs open on those ports and that may be the culprit.
Also, if you have a torrent application that may also cause all the incoming connections. |
|
jokerl90
join:2008-04-20
Blairsville, GA
| reply to jokerl90
Hey Austin, Thanks for the reply. I'll check for the service, application you spoke of. No torrent app for sure.
Seph, after the rain sunday and monday, my snr went up to 20's, attn went down a little. Right now snr is 4 and attn is 56. Speed is about the same.
I'm working this week (finally). Not much time to look at it.
I thought the wiring from the NID to wall jack was good, I'm not so sure now. Need to look at it again, also maybe do a homerun. |
|
Seph83
Gone Insane
Premium
join:2004-04-29
Blairsville, GA
·Windstream
| SNR 4? I'm not even sure how you are viewing this page with that low. Yeah, a straight home run from NID to the DSL modem isn't a bad idea at all, I've got about a 15 foot one myself. Though one day I need to call WS and get a new NID, since mine has been getting rain in it for ages.
By the way, Joker, you have an IM.
--
"I've Gone to Find Myself. If I Get Back Before I Return, Keep Me Here!!" |
|
jokerl90
join:2008-04-20
Blairsville, GA
| reply to jokerl90
Could it be that those SNR and ATTN numbers are not correct? I just found out what they mean recently from reading info on this site, so I'm no expert at all.
I play COD4 on servers in England regularly with a ping on the server of 140-160 and with a SNR very low and ATTN at 58. |
|
