Lost connection to internet after a while, but able to ssh to gateway
 

Hi!

I'm having a strange problem with my network.

My network configuration is as follows:

I have machine working as gateway/firewall and dhcp server. I have my linux box and 2 others running winxp for the rest of the family.

This configuration has been working for months but the last few days. I keep losing connection to the internet in my linux box but the others are fine.

I'm able to ssh to my gateway and from there I can access the internet. But not from my computer. If I restart my network I get internet back to lose it again some time later. I'm not sure, but it seems to happen mostly when I'm not using the internet for a "long" period of time.

In an attempt to debug this problem, I ran

(eth1 being my internal network interface)

and I tried

from my box. This icmp requests don't appear in the tcpdump so I looks like that packages originating from my box to the network aren't even reaching my gateway even thou I can ping my gateway and ssh to it.

Where can my problem be? :confused:

Off the top of my head, I'd suspect networking issues on your box (heh, i know, not very helpful.)

Most likely, I suspect you pinged/sshed your gateway via IP, which works. But you pinged google by it's name, thus indicating that your DNS resolution wasn't working. I'd go down that path, and also on the box that is having troubles, verify that you still have an ip/valid gateway/valid DNS/etc. Could also be a nasty spyware that replaces your chosen DNS servers with their own.

Next time try pinging your ISP Gateway, then DNS. Also if you know the IP of say Yahoo or someone try typing that in your browser to bypass DNS, this will help eliminate DNS as part of the problem.

I'm not familiar w/ tcpdump but are your ICMP requests returned from your gateway?

Well, google was only an example. To be sure about hostname resolution, I pinged a computer at my university using it's ip address. It didn't work from my box but worked from my gateway. So this leaves hostname resolution out... or at least is not the only problem...


tcpdump prints (in a formated way) the headers of packets that go through a network interface.

So if I type tcpdump -i eth1 I'm telling it to dump the header of every packet coming or going through eth1. I used in on my gateway to listen eth1, my internal network card so I should be seeing icmp requests coming from my box and directed to an exterior IP address.

Those requests would then go out through eth0 but I woudn't see them because I was only dumping eth1. The responses would also come from eth0 and my gateway should send them to my box via eth1 and I should also see them.

When that strange problem happens, I don't see the requests reaching my gateway unless I'm pinging my gateway. When it happens again, I will also try pinging other IP address in my local network.

Runnig ifconfig I can see I still have the IP address I should have. How can I see if the gatewat address is set correctly? And if it isn't set correctly, why does it get unset :confused:

route -n would tell you what your gateway is currently set to. I'd also recommend doing an arp -an on the afflicted computer so you can see the arp addressess. If you see <incomplete> where the ip of the router is, you are suffereing from a layer1 or layer2 problem.

Really wierd that the tcpdump doesn't show anything. Man you' ve got a tough one. I'll try to think of something else, but checking the GW can't hurt. Maybe try a traceroute?
As for your DHCP are there plenty of leases? If wireless, check to see someone hasen't snatched the last address.
Also maybe try a ping for a while and see if it happens when the machine is not on the internet but is actively pinging another machine on your network. If you start to have hardware problems it will be really hard to diagnose, and the ping will at least keep the NIC busy. If you have 2 NIC's try the other one just to see.

Well... 2 days passed and it didn't happen again! :confused:

Anyway, thanks for your help. I really learn with your comments and if it happens again, I have some more ideas to debug the problem. ;)