Cox → Why all the *'s

What are the 3 speeds on each hop? My middle one is all *'s no matter where I tracert to.

Microsoft(R) Windows DOS
(C)Copyright Microsoft Corp 1990-2001.

C:\DOCUME~1\RICHAR~1>tracert cox-internet.com

Tracing route to cox-internet.com [66.76.2.80]
over a maximum of 30 hops:

1 21 ms * 14 ms cdm-66-233-xx.x.eldr.cox-internet.com [66.233.xx.x]
2 15 ms * 15 ms eldrsysc01-fex0000.ed.dl.cox-internet.com [208.1
80.192.129]
3 31 ms * 30 ms jsbrbbrc01-atm0401-0002.ma.dl.cox-internet.com [
66.76.112.133]
4 46 ms * 46 ms cdm-208-180-108-145.fayt.cox-internet.com [208.1
80.108.145]
5 62 ms * 58 ms cdm-66-45-41.tyrd.cox-internet.com [66.76.45.41]

6 61 ms * 62 ms tyrdbbrc02-gex0201.ma.dl.cox-internet.com [66.76
.45.30]
7 62 ms * 62 ms pw1.cox-internet.com [66.76.2.80]

Trace complete.

C:\DOCUME~1\RICHAR~1>

I believe that Cox Express is blocking ICMP traffic to some extent. Some from the AR areas have said that there pings have been blocked. If you have questions about it you need to to call tech support as the techs here may not have access to the info you need. Cox express is very sensitive about there info

Something is getting blocked. Look at this ping plotter graph. I am getting this every where I try to trace. Nothing in between and showing all PL's.
[text was edited by author 2003-09-28 09:02:33]

Edit: I am cox-internet.com now, not Cox express.

[text was edited by author 2003-09-28 09:04:43]

Also Cox is now pinging my IP address about once every minute while I am online. ZA is blocking them but I still get the alerts. This has been going on for weeks now. Over 200 pings in the last 3 1/2 hours from Cox. Don't know why.

cox-internet.com AKA Cox Express. The better system to be on would be Cox HSI, known as cox.net.

what is it saying? You may be getting some from the DNS and you need to let it in, but there are lots of other ones from users on cox that have the worm and they may be the ones causing the problems.

Going on three weeks here in Russellville AR
and its still crap, and cox just doesnt care. Everybody I have talked to on the phone says that they know about it, but no body can do anything.

And apprently they dont really want to either.

I am sorry you got the impression that we don't care about or are unable to resolve technical issues that impact your service....this could not be further from the truth.

Could you IM me or with your account and the names of the people who made this claim?

I will find out exactly what is going on with your service and get you an explanation as to what we are doing to resolve the issues.

As for why you might be seeing non-responsive hops with a trace...keep in mind that we are still lowering the priority for ICMP traffic in some areas due to issues such as the recent round of worms and viri....this means that devices in our network may ignore ICMP traffic in order to give priority to actual network traffic. This does not mean that the device is offline or overloaded. It is important to note that ICMP (ping, traceroute) is not an indication of performance or throughput....it is possible to have low ping times and poor performance and the opposite is true as well. ICMP is a useful tool in locating points of failure during outages but its results need to be considered in context with other information.

This is what it shows...constant pings against my ISP address from the Cox server.
[text was edited by author 2003-10-01 09:39:50]

How much bandwidth does it cost Cox to ping every customer they have at this rate?

I was trying to track down the source of the ICMP request you posted to potentially open an abuse ticket in the event this was an infected host.

But I am showing that according to ARIN, the IP you list 68.74.102.250 allocated to Ameritech Electronic Commerce and not us.

Thats 66.74.102.250. Not 68.74.102.250

Ah...so it is...next time I will enlarge the screenshot more.

OK 66.74.102.250 isn't Cox either...According to ARIN it is Road Runner.

Search results for: 66.74.102.250

OrgName: ROADRUNNER
OrgID: RRWE
Address: 13241 Woodland Park Road
City: Herndon
StateProv: VA
PostalCode: 20171
Country: US

NetRange: 66.74.0.0 - 66.75.255.255
CIDR: 66.74.0.0/15
NetName: RR-WEST-2BLK
NetHandle: NET-66-74-0-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.RR.COM
NameServer: DNS2.RR.COM
NameServer: DNS3.RR.COM
NameServer: DNS4.RR.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2001-01-30
Updated: 2003-02-11

TechHandle: ZS30-ARIN
TechName: ServiceCo LLC
TechPhone: +1-703-345-3416
TechEmail: abuse@rr.com

OrgAbuseHandle: ABUSE10-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-703-345-3416
OrgAbuseEmail: abuse@rr.com

OrgTechHandle: IPTEC-ARIN
OrgTechName: IP Tech
OrgTechPhone: +1-703-345-3416
OrgTechEmail: abuse@rr.com

# ARIN WHOIS database, last updated 2003-10-01 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

I am making a log file on these. The IP address pinging me changes with every ping. But they are all Cox IP addresses.

And here's the log just since I have been typing this message. These are all pings against my IP address:

ZoneAlarm Logging Client v2.6.362
Windows NT-5.1.2600-Service Pack 1-SP
type,date,time,source,destination,transport
FWIN,2003/10/02,08:48:42 -5:00 GMT,66.74.223.237:0 ICMP (type:8/subtype:0)
FWIN,2003/10/02,08:49:46 -5:00 GMT,66.75.41.181:0 ICMP (type:8/subtype:0)
FWIN,2003/10/02,08:49:51 -5:00 GMT,66.76.127.51:0 ICMP (type:8/subtype:0)
FWIN,2003/10/02,08:50:10 -5:00 GMT,66.76.114.142:0 ICMP (type:8/subtype:0)
FWIN,2003/10/02,08:50:14 -5:00 GMT,66.75.203.8:0 ICMP (type:8/subtype:0)
FWIN,2003/10/02,08:50:48 -5:00 GMT,66.74.177.212:0 ICMP (type:8/subtype:0)
FWIN,2003/10/02,08:51:55 -5:00 GMT,66.75.192.196:3569 TCP (flags:S)
FWIN,2003/10/02,08:52:07 -5:00 GMT,66.76.127.73:0 ICMP (type:8/subtype:0)

All of these are Cox IP addresses.
[text was edited by author 2003-10-02 10:05:02]

You are 100% correct. Cox probably pinged me once and that was the addy I used to check the ISP source and since they are both 66.xx.xx.xx I just assumed they were the same.

Any idea why RR is pinging me every 30 secs and what can I do to stop it?
[text was edited by author 2003-10-02 10:18:35]

"Roadrunner" isn't pinging you, some of their Nachi worm infected subscribers probably are though. And they aren't going after you specifically. They are going thru the entire 66.00.00.00 address space trying to find vunerable machines.

They best thing would be to report them to the RR abuse dept. as I imagine bbeesly will do with the Cox IP's you've logged. It may take them a while to get them shut down/patched/etc. No doubt they are swamped as Cox is.