I am posting here as a last ditch attempt for some help with a problem any PC on our internal network is having with accessing the internet.

We have an ADSL connected through WAN1 on a Symantec 200R VPN firewall. Our internal network is sitting behind the firewall - firewall does all our NAT from the LAN onto the Internet - Its a fairly standard setup.

On accessing the internet (we have been using the ping utility to test this) we are experiencing MASSIVE packet loss between our internal network and the outside world - into the region of 70% packet loss. We have ruled out the ADSL connection by connecting a laptop into the back of the ADSL router directly, and configuring the laptop as required - we experience 0% packet loss and good ping times.

We also ruled out the firewall by actually replacing it with a windows XP box and internet connection sharing (Probably not the most wonderful of replacements, though it worked, and we experienced exactly the same effects).

There also appears to be a pattern to where the packet loss is occuring - here is a cut and past from a ping to google.co.uk from a box sitting behind the firewall on our internal network.

PING google.akadns.net (216.239.39.99): 56 data bytes
64 bytes from 216.239.39.99: icmp_seq=0 ttl=48 time=383.4 ms
64 bytes from 216.239.39.99: icmp_seq=26 ttl=48 time=255.1 ms
64 bytes from 216.239.39.99: icmp_seq=27 ttl=48 time=233.3 ms
64 bytes from 216.239.39.99: icmp_seq=28 ttl=48 time=277.8 ms
64 bytes from 216.239.39.99: icmp_seq=29 ttl=48 time=275.9 ms
64 bytes from 216.239.39.99: icmp_seq=30 ttl=48 time=280.2 ms
64 bytes from 216.239.39.99: icmp_seq=31 ttl=48 time=267.0 ms
64 bytes from 216.239.39.99: icmp_seq=32 ttl=48 time=286.8 ms
64 bytes from 216.239.39.99: icmp_seq=33 ttl=48 time=221.7 ms
64 bytes from 216.239.39.99: icmp_seq=34 ttl=48 time=235.3 ms
64 bytes from 216.239.39.99: icmp_seq=35 ttl=48 time=315.0 ms
64 bytes from 216.239.39.99: icmp_seq=36 ttl=48 time=304.9 ms
64 bytes from 216.239.39.99: icmp_seq=56 ttl=48 time=185.5 ms
64 bytes from 216.239.39.99: icmp_seq=57 ttl=48 time=209.6 ms
64 bytes from 216.239.39.99: icmp_seq=58 ttl=48 time=203.7 ms
64 bytes from 216.239.39.99: icmp_seq=59 ttl=48 time=278.1 ms
64 bytes from 216.239.39.99: icmp_seq=60 ttl=48 time=344.2 ms
64 bytes from 216.239.39.99: icmp_seq=86 ttl=48 time=181.6 ms
64 bytes from 216.239.39.99: icmp_seq=87 ttl=48 time=212.9 ms
64 bytes from 216.239.39.99: icmp_seq=88 ttl=48 time=264.6 ms
64 bytes from 216.239.39.99: icmp_seq=89 ttl=48 time=329.1 ms
64 bytes from 216.239.39.99: icmp_seq=90 ttl=48 time=334.0 ms
64 bytes from 216.239.39.99: icmp_seq=91 ttl=48 time=363.8 ms
64 bytes from 216.239.39.99: icmp_seq=92 ttl=48 time=358.8 ms
64 bytes from 216.239.39.99: icmp_seq=93 ttl=48 time=380.3 ms
64 bytes from 216.239.39.99: icmp_seq=94 ttl=48 time=379.7 ms
64 bytes from 216.239.39.99: icmp_seq=95 ttl=48 time=380.6 ms
64 bytes from 216.239.39.99: icmp_seq=96 ttl=48 time=466.4 ms
64 bytes from 216.239.39.99: icmp_seq=116 ttl=48 time=180.0 ms
64 bytes from 216.239.39.99: icmp_seq=117 ttl=48 time=217.2 ms
64 bytes from 216.239.39.99: icmp_seq=118 ttl=48 time=252.7 ms
64 bytes from 216.239.39.99: icmp_seq=119 ttl=48 time=296.2 ms
64 bytes from 216.239.39.99: icmp_seq=120 ttl=48 time=464.0 ms

--- google.akadns.net ping statistics ---
143 packets transmitted, 33 packets received, 76% packet loss
round-trip min/avg/max = 180.0/291.4/466.4 ms

Pinging our IP from an external machine does not reflect this problem.

If anyone has any suggestions as to what could possably be causing this behaviour I would be extremely glad to hear it. Any good applications to monitor network traffic for abnormalities would also be appreciated.

Thanks in advance for any help,
Ben.

I don't know if it is at all relevant but I had a similar problem when I first went onto my cable modem. I was getting constant packet loss but not to the degree you are. After many hours trying to find the cause it eventually turned out the be the nameserver setup. Without setting up nameserver entries I go packet loss. Put them in (after finding out what they where on on my ISP's network) and the packet loss dropped to 0%.

I doubt this is what you problem is but you might want to have a look at this and other DNS settings.

Paul

We finally managed to track down the cause of this packet loss. Turned out that 4 of out Windows XP clients had been infected by the W32.Welchia virus which exploits a bug in Microsoft RPC. The nature of the virus caused the network to be flooded with scans of IP addresses in order to find other vulnerable machines - hence the pattern to the packet loss, as each of the 4 PC's performed their scans.