Some computers on LAN have Internet access, others don't

Problem began suddenly this evening

[MatthewHSE]

I have a home wired LAN with seven computers on it. They've all been working fine for months, with no configuration changes or new software installations. Suddenly, this evening, two computers on the LAN have only spotty Internet access. The problem has been so erratic that I can't do much more than list the following facts about these two computers:

• One is Windows XP, the other is Windows 2000.
  
• Both are fully patched and running updated copies of AntiVir.
  
• The whole LAN is behind a hardware firewall (actually our firewall/router)
  
• These computers now cannot reach most websites most of the time.
  
• They can reach some websites some of the time.
  
• Both are maintaining a great LAN connection to the rest of the network.
  
• Both go in and out of having POP3 access.
  
• Skype is staying connected on the computer that has it installed.
  
• Nothing dodgy has happened today (no suspicious e-mails, etc.)
  
• Problem apparently began at the same time.
  
• Rebooting didn't help.
  
• DSL modem is connected to router with ethernet, router is connected to network switch with ethernet, computers connect to network switch with ethernet.
  
• Resetting the router didn't help.
  
• Changing ports on ethernet switch didn't help.
  
• A working computer still works when changed to one of the ethernet ports previously used by the two problem computers.
  
• HOSTS files are not corrupted or changed.
  
• Computers haven't slowed down and don't exhibit obvious signs of spyware or malware (no popups, no "messages," Internet works fast when it works at all, etc.)
  
• The ethernet switch, router, and modem seem to be mostly idle (except when another computer on the LAN is doing something).

So there you have it - the sum total of all the troubleshooting and factfinding I've been able to think of so far. At the moment, I've disconnected the ethernet cables from these two computers and am running virus scans. If the problem isn't fixed in the morning I'll be running RootkitRevealer as well. But I really don't think this is malware causing this problem - it just doesn't seem right for that. Everything *seems* clean.

I'm at the end of my rope. Is there anything else I can/should try?

Thanks in advance,

Matthew

[jdMorgan]

Are you using DHCP? Do the "offline" computers have valid LAN IP addresses and DNS server info (passed from the router, usually)? Use Start->Run->Cmd->ipconfig /all to find out.

How is DNS configured? Has your host changed their DNS server subnet?

If flushing the DNS cache on a "working" machine causes it to stop working, this would indicate a DNS distribution problem. Start->Run->Cmd->ipconfig /flushdns

I guess a safer approach would be to try accessing a few Web sites using their IP address instead of the domain name from one of your non-working computers. If that makes it work then again, a DNS problem is indicated. When testing this be aware that many sites will redirect from the IP address to their domain; But if this redirect even starts to happen (see the address bar change), then the connection to the IP address must in fact have worked.

Without knowing the specific error message you're seeing those are just guesses.

Jim

[MatthewHSE]

Hi, thanks for the ideas. We're using static LAN IP's, not DHCP. The DNS settings with our ISP hadn't changed since the settings on the "offline" computers were the same as the "online" computers. I honestly didn't try any ipconfig stuff last night, probably just because it was late...

Anyway, after being turned off all night, the WinXP computer works fine this morning, but the W2K machine is still having problems. However, I tried your suggestion about visiting sites with their IP address (<blush>should have thought of that myself</blush>) and it worked great. So DNS does seem to be the issue.

With DHCP disabled, the

ipconfig /release

and

ipconfig /renew

commands don't work. I tried the dnsflush on the offline computer just for fun and it's still offline (probably no surprise). I'll try it on an online computer in a bit and see what happens.

I should also mention that the "error message" I'm getting is simply the usual "server could not be found" error. I've tried several browsers and attempted a few pings with the same error.

[MatthewHSE]

If flushing the DNS cache on a "working" machine causes it to stop working, this would indicate a DNS distribution problem.

I flushed the DNS this morning on one of the online computers and it stayed online. I gather that this eliminates some possible issues, but I'm a little fuzzy as to what they might be.

I'm burning a live CD of Ubuntu right now and will see if I can get online with it on the remaining "problem" computer. I'll post back with details either way; in the meantime, further suggestions are still welcome! ;)

[kaled]

It's always worth checking the connection settings for the browser. My ISP suffered some sort of DNS failure yesterday but I managed to keep working by using a proxy server. Might you (or someone else) have set up a proxy server on the faulty machine and failed to restore the normal settings when no longer required?

Not likely, but easy to check!

Kaled.

[MatthewHSE]

Browser settings were some of the first things I checked - no changes from where I'd left them months ago.

However, the problem appears to have fixed itself. Both "offline" computers are online again, with no apparent problems.

I'm ready to chalk this up to some kind of DNS problem, but why on earth would it only affect two computers without any settings on them changing? If the ISP had made changes, surely it would have affected our whole network since we all connect through the router, right?