Weird tracert problem

Burgo

So I have been having this strange tracert problem, I only get 1 hop the destination,2 hops if i go through the router.

Im on Upc using their cisco epc2425 as my modem and a buffalo whr-hp-g54 with dd-wrt as my router. Thinking it was just the router i isolated it, plugging straight into the modem but still get the same result.

I havent a clue whats going on and google hasnt been much help. 2 pcs and a laptop both give simialr results, all using xp (1 home,1 pro and one media center)
Heres an example :

C:\Documents and Settings\l>tracert boards.ie

Tracing route to boards.ie [89.234.66.107]
over a maximum of 30 hops:

1 45 ms 47 ms 44 ms ip-89-234-66-107.dedi.digiweb.ie [89.234.66.107]

Trace complete.

C:\Documents and Settings\>tracert google.com

Tracing route to google.com [74.125.127.100]
over a maximum of 30 hops:

1 199 ms 196 ms 198 ms pz-in-f100.google.com [74.125.127.100]

Trace complete.


Any one have any ideas?

cpu-dude

Burgo wrote: »

So I have been having this strange tracert problem, I only get 1 hop the destination,2 hops if i go through the router.

Im on Upc using their cisco epc2425 as my modem and a buffalo whr-hp-g54 with dd-wrt as my router. Thinking it was just the router i isolated it, plugging straight into the modem but still get the same result.

I havent a clue whats going on and google hasnt been much help. 2 pcs and a laptop both give simialr results, all using xp (1 home,1 pro and one media center)
Heres an example :

C:\Documents and Settings\l>tracert boards.ie

Tracing route to boards.ie [89.234.66.107]
over a maximum of 30 hops:

1 45 ms 47 ms 44 ms ip-89-234-66-107.dedi.digiweb.ie [89.234.66.107]

Trace complete.

C:\Documents and Settings\>tracert google.com

Tracing route to google.com [74.125.127.100]
over a maximum of 30 hops:

1 199 ms 196 ms 198 ms pz-in-f100.google.com [74.125.127.100]

Trace complete.


Any one have any ideas?

Well it looks like your tracert is just giving out the end result of the hops, strange. See my Google one (I removed previous hop locations).

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\documents and settings\>tracert google.com

Tracing route to google.com [74.125.127.100]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms
2 <1 ms <1 ms <1 ms
3 <1 ms <1 ms <1 ms
4 1 ms <1 ms <1 ms
5 1 ms <1 ms <1 ms
6 <1 ms 1 ms 1 ms
7 1 ms 1 ms 1 ms
8 1 ms 1 ms 1 ms
9 2 ms 1 ms 1 ms
10 55 ms 106 ms 106 ms
11 2 ms 2 ms 2 ms
12 2 ms 2 ms 2 ms
13 2 ms 2 ms 2 ms
14 2 ms 2 ms 2 ms
15 17 ms 17 ms 82 ms
16 85 ms 86 ms 85 ms
17 117 ms 112 ms 109 ms
18 156 ms 160 ms 156 ms
19 160 ms 161 ms 161 ms
20 160 ms 165 ms 163 ms
21 167 ms 164 ms 159 ms
22 166 ms 170 ms 176 ms
23 166 ms 161 ms 162 ms pz-in-f100.google.com [74.125.127.100]

Trace complete.

Looks like something is certainly preventing the entire tracert. Do you use any specific security software, network tools or VPN's?

Burgo

avg,spybot and windows firewall for security on all the machines.
no network tools that i can think of.
i use putty and realvnc on one pc.
Did a clean install of windows on a vm and same result.

Fergus

I noticed this the other day too, I have same router. I suspect UPC is interfering with/filtering ICMP traffic to prevent you from tracing routes. Not cool.

Burgo

i hope thats not the case,but i wouldnt be too suprised

bobcawley

I got NTL installed just last week and they gave me their Cisco EPC2524 all-in-one cable-modem/wireless router. Being a network engineer for my day job, this was one of the first things I noticed about the service. I tested it with both Mac OSX and Linux and also tried tcptraceroute. I'm seeing the same as you. What is happening is that the Cisco device is filtering out ICMP Type 11 (time exceeded) packets which are needed for the correct operation of traceroute.

I logged into the Cisco (point your browser at http://192.168.1.1/ and leave the username and password fields blank) but there are no options under the menus there to disable this behaviour. Unfortunately the software revision is displayed as epc2425-E10-5-v202r12812-090709cs_upc.bin and judging by the name the OS looks like it has been tuned for UPC, and given that they have just started supplying the Cisco EPC2524 as CPE in the last few weeks it will probably be a while before they will support a revised OS that doesn't have this "feature".

This filtering of particular types of ICMP packets really annoys me. I've sent two emails to broadbandsupport@upc.ie over the last week and they auto generate ticket numbers saying that they aim to get backet to me within 3 days - no response from them as yet.

I would gladly give back the all-in-one cable-modem/wireless router for one of their older cable modems that doesn't have wireless if it meant the device didn't do this filtering.
I tried asking around at work and a couple of the other network engineers also have NTL broadband but they have the older Scientific Atlanta cable modem which doesn't muck with the ICMP packets.

BTW, you may be able to get some information about the path taken by your packets by using the 'record route' option to ping. On Linux you use the -R option
brian@laptop:~$ ping -R www.rte.ie
PING www.rte.ie.nsatc.net (89.207.56.140) 56(124) bytes of data.
64 bytes from www.rte.ie (89.207.56.140): icmp_seq=1 ttl=59 time=10.8 ms
RR: laptop.local (192.168.1.10)
089-101-162048.ntlworld.ie (89.101.162.48)
84.116.238.5
ie-dub01a-ra4.aorta.net (213.46.165.249)
89.207.56.131
www.rte.ie (89.207.56.140)
www.rte.ie (89.207.56.140)
89.207.56.229
deg-gw-1.rte.ie (193.242.111.42)

For Windows XP, I believe the command is: tracert -r 9 www.rte.ie
Please complain about this "feature" to UPC. :mad:

h2s

Well I glad to see I'm not going mad, as I am having the same tracert issue. I have tried several programs including vizual route and all I see is the end result.

I am with them only about a month or so and I am in serious trouble with my gaming teenagers in the house, there is a mini-revolt about the UPC connection and I am been urged to go back to eircom.

They are having major problems with Warcraft and ventrilo, the connection keeps dropping frequently.

So I think I'll have to call eircom tomorrow morning.....

Fergus

I too will be complaining about this.

The internet is a collection of standards. Blocking any protocols defined by these standards, or parts thereof, makes UPC less than a complete 'internet service provider'. This issue falls into the arena of Net Neutrality. Censoring ICMP data being communicated between the user and a remote host is really no business of the ISP. However, I haven't yet checked if the fine print in the T&C covers this.

There's also the somewhat misleading advertising of the 'free wireless router'. I'm sure to many this implies a separate device being given to the user for free, whereas in fact it is extended functionality within a cable modem which (as I understand it) you do not own.

Burgo

Thanks for the info people ! I shall be ringing upc to complain about this as well as another matter :pac:

I have a feeling i will be searching ebay for a modem this weekend though

hightower1

Unless the modem is on UPC irl active list and provisioned for you'll need to search ebay for "paper weight" cause thats all it'll be.


Complaining to an ISP about this is a waste of time. Be realistic they are here to sell broadband access to residential customers for surfing, streaming, downloading and uploading anything else is not standard ISP territory and is just the "under the hood mechanics" of it. As long as your on a major ISP your restricted by the technical level of your peers, if its not common use of bb then they wont supply it.

And what are they going to do ????... release a brand new boot file for every customer just so you can tracert and see every hop? Thats ridiculous.

What you pay them for is residential bb access for surfing..... it didnt stipulate in their contract that you'll be able to see every hop of your tracert you may want to run. Get real.

Burgo

its moreso the fact that its just recent customers like myself who have the cisco modem that seem unable to use tracert while older customes who have the netgrear etc have no problems doing it.

bobcawley

hightower1 was fairly close in predicting the UPC response that I got to my email query:

"In relation to your below e-mail and query on trace routes through the EPC 2425 unfortunately it is not possible to configure the modem/router to show all hops in a tracert.
These apply a set boot file assigned by the CMTS at power up and are nationally applied, we cannot create and assign a specific boot file to a specific modem.
As availability to view all hops in a tracert is not required nor will interfere with the broadband use we would not include this as a feature on the modem.
I do apologise for this but residential broadband access does not require this as a standard."

I can understand and accept that UPC can't fix it on a per user basis. I however maintain that they still shouldn't be doing it at all in the first place. Traceroute responses are ICMP packets (Internet Control Message Protocol), i.e. a control protocol to ensure the correct operation of the Internet. If they start blocking ICMP Type 11 (Time exceeded)
packets, why not go the whole way and block ICMP Type 8 (Echo request) and ICMP Type 0 (Echo replies)? That would mean that ping wouldn't work. Can you imagine the uproar then?

I can also accept that they are well within their rights as a network operator to configure their routers to not generate ICMP Type 11 responses, so that users cannot see their network equipment - we would then just see asterisks for the hops involving UPC equipment but the rest of the path would be shown. But filtering out particular ICMP packets from all devices that are out on the Internet as a whole is just fascist and out of order.

watty

Routers, DHCP, DNS and email servers etc are often specifically programmed to ignore (or respond slowly) ICMP directed direct at them to avoid DDOS attacks.

tracert has not been much use on the Internet for some time to give reliable intermediate results as the routers that do honour a direct ping will not respond quickly.

As a result the intermediate hops appear slower than the end to end

C:\WINDOWS>tracert www.heanet.ie

Tracing route to samhain.heanet.ie [193.1.219.57]
over a maximum of 30 hops:

  1     1 ms    <1 ms    <1 ms  192.168.0.1
  2    11 ms    14 ms    11 ms  83.147.171.1
  3    19 ms    20 ms    18 ms  gi-5-1.dub-deg-br1.net.digiweb.ie [83.147.162.22]
  4    20 ms    22 ms    19 ms  te0-0-0-1-cr2-cwt.hea.net [193.242.111.16]
  5    17 ms    16 ms    17 ms  te5-1-blanch-sr1.services.hea.net [193.1.236.2]

  6    24 ms    20 ms    26 ms  samhain.heanet.ie [193.1.219.57]
Trace complete.

Note hop 4

another one

C:\WINDOWS>tracert www.bbc.co.uk

Tracing route to www.bbc.net.uk [212.58.251.197]
over a maximum of 30 hops:

  1     1 ms    <1 ms     1 ms  192.168.0.1
  2    19 ms    12 ms    21 ms  83.147.171.1
  3    17 ms    48 ms    18 ms  gi-5-1.dub-deg-br1.net.digiweb.ie [83.147.162.22]
  4    27 ms    27 ms    25 ms  83.245.126.93
  5   185 ms   204 ms   223 ms  212.58.238.129
  6    32 ms    29 ms    31 ms  212.58.239.58
  7    27 ms    26 ms    44 ms  www-nonuk-vip.telhc.bbc.co.uk [212.58.251.197]

Trace complete.

Spot the routers avoiding Pings Of Death?

OR Could be momentary congestion?

Even a Ping on an "end point" isn't an entirely reliable measure of latency anymore, it's more an indication.

Pinging [url]www.bbc.net.uk[/url] [212.58.251.197] with 32 bytes of data:

Reply from 212.58.251.197: bytes=32 time=36ms TTL=123
Reply from 212.58.251.197: bytes=32 time=29ms TTL=123
Reply from 212.58.251.197: bytes=32 time=27ms TTL=123
Reply from 212.58.251.197: bytes=32 time=34ms TTL=123

Ping statistics for 212.58.251.197:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 27ms, Maximum = 36ms, Average = 31ms

Pinging samhain.heanet.ie [193.1.219.57] with 32 bytes of data:

Reply from 193.1.219.57: bytes=32 time=21ms TTL=60
Reply from 193.1.219.57: bytes=32 time=15ms TTL=60
Reply from 193.1.219.57: bytes=32 time=22ms TTL=60
Reply from 193.1.219.57: bytes=32 time=18ms TTL=60

Ping statistics for 193.1.219.57:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 15ms, Maximum = 22ms, Average = 19ms

You can see the tracert is a little odd. It's really only useful to tell you the route outside your own ISP. Timings are only going to be meaningful on a large network of your own.

Fergus

Granted its residential broadband, they are within their rights, etc, but I still agree with bob that the substantive point still remains. There should be no need to block or interfere with traffic between a remote host and the end user, unless it is actually impeding network operation.

We've also seen ISPs take other actions like redirecting non-existent DNS lookups to their own landing pages. Where do you draw the line?

Dardania

You should complain to them that you can't route to a particular part of the internet, to which they should ask you to do a traceroute?

watty

Burgo wrote: »

I have a feeling i will be searching ebay for a modem this weekend though

It's against T&C.

Also only Modems that they supply will work. Even if you were allowed to put your own modem (and UPC would still have to get its identity from you and provision it), unless it's a model + Firmware combination in their database they can't make it connect even if they wanted to.

Also there are 2 common bandwidths and 2 rare bandwidths for Cable. Modems using a physical SAW IF filter rather than DSP, need the correct bandwidth of filter.

Summary:
1) You need to be expert on Cable Modems to buy the Correct spec of Cable Modem even if you work for UPC.

2) Every Cable Modem in the World is unique. Only the ones issued by UPC are in their database.

3) Many modems that physically could work, even UPC can't easily make them work as they don't have configuration information. Even slightly different Models from same maker have to download different configuration files from UPC at power on "Boot/Ranging" phases etc.

Bottom Line:
You can't fit your own Cable Modem.

B1r0

Hi all,

It's a couple of weeks I've got UPC 20Mb cable broadband with the Cisco EPC2425 s**t :mad:.

I too tried the traceroute, but it is giving me only asterisks, not even the final destination is reached.

My problem is different though.
I'd like to use my own firewall and use the PPPoE protocol to have the public IP on its external interface.

But I didn't find any way to set the cisco in a sort of bridging mode.

bobcawley: do you or some of your friend tried something similar?
I have also an old motorola when I had upc broadband 2 years ago. It is a Euro-DOCSIS 2.0.
Do you think it can be found a firmware for it that allow me the bridging feature?

The DynDNS option on the cisco does not work either and it pisses me off a lot I cannot ssh to the router to change the settings in cli mode :mad::mad::mad:.

Has anyone good news?

bobcawley

Ok, an update on progress after I complained about this. I made it clear that I wasn't happy about tracreroute not working and that I was prepared to cancel the service. It was then put through NTL's complaints process. Once they understood that I was prepared to forego the wireless router option they were able to agree to swapping out the Cisco EPC 2425 for the older Scientific Atlanta EPC 2203, which bridges the frames onto the cable infrastructure and doesn't have any of the hidden routing/firewall features of the EPC2425. I've attached my old Netgear wireless router to the EPC2203 to give me wireless access in the house. Problem solved.

Just a word about NTL. Contacting them via email is a pain - they may or may not get back to you within the three days they aim to. Contacting their technical support via phone is painful also if you don't get put through to their second line support people because of the queue. The idea of a callback within 24 hours didn't happen in my case. However, their support folk and their complaints people were always polite, friendly, reasonably competent and helpful. Their complaints procedure worked for me. Their complaints people were very thorough in following up and calling back. Even after their systems had registered the change of modem and they could see it was working, their complaints team came back to me to check I was happy. My experience wasn't as bad as some of the disaster stories I've heard about NTL customer support in the past. It may have helped that I'm fairly familiar with networking topics and knew what I was talking about, but they definitely seem to be improving.

If you are stuck on the EPC2425 and not willing to swap it for the older bridged ethernet solution (EPC2203) and use your own wireless router then all is not lost. I had a chat with one of their technical people and the traceroute problem is one of three issues with the newly deployed EPC2425 that they have seen. The other two problems were the EPC2425 filtering out some IRC packets and some multicast beacon issue with wireless network discovery which I didn't quite understand. NTL accept them as problems and are testing a new version of the software for the EPC2425 which they will be able to push out to upgrade the installed base. So, if you are prepared to wait, the traceroute problem will in time get fixed. Having been burned once by the EPC2425 magically filtering packets I wasn't prepared to wait and wanted the simpler NTL bridged device and a wireless router that I have full control over.

Now that I am happy with their broadband solution, I'm now going to move my phone across also.

B1r0

After I have been waiting 5 days an answer to my email (bobcawley warned us), I just contacted the NTL/UPC broadband support by phone.
They told me they do NOT have the EPC2203 and it is not sold anymore!!!
The girl I spoke with was adamant about it.
When I threatened to cease the contract she just pulled me to the accounts department.

I'm really disappointed.

The connection speed is amazing but the modem the provide is pure crap.

I work as network engineer and my company (that is paying for our broadband) was going to ask all its engineers to adopt NTL's broadband.
But now that we cannot bridge the connection to our personal firewall and there are these problems with the ICMP packets (that "maybe" will be fixed), the company dropped the idea.

NTL has lost at least 5 sales leads.

I'm not going to leave NTL soon, but as another provider is giving the same broadband deal, it will be an easy jump for me to swap.

I'm sorry I vented out my rage on you here.
I thought that writing a post could help me cool down, hoping someone at NTL will read it and maybe help us.

_CyRuSS_

hi all,

I have the same problem on my laptop (XP Home) and my PC (Win 7) with not being able to tracert, exact same issue you guys are having.

Only difference is, I do not have the Cisco modem with built in wireless router... I have the older Scientific Altantic EPC2203. Revision epc2203-E10-5-v202r1262-080522c

So by the looks of it, this has nothing to do with their new modems, as it is affecting their old modems too... so wouldn't bother trying to change modem unless you want to bridge it to your own router.

Oh as for NTL saying they didn't have the old modem anymore, I find that unlikely, sure they take peoples old modems away, i'd say they have loads of them. I know for me they tried to give me the new one with the built in wireless, and the guy who installed it saw I already owned a wireless router, he went back to the van and got me a new EPC2203, telling me the new modems with built in wireless were rubbish anyway so i was better off with the Scientific Atlantic one.

anyway, I don't see why UPC would block tracert replies... I often use tracert to try and figure out if the internet is slow because of my isp or because of other servers... handy for gaming too when getting bad ping to your GSP with who you rent a server off, and you need to show them proof that you're getting crap traces... oh well.

bonzodog2

EPC 2203/WGR614
---
C:\WINDOWS\system32>tracert www.rte.ie

Tracing route to www.rte.ie.nsatc.net [89.207.56.140]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms wgr614 [192.168.1.1]
2 * * * Request timed out.
3 11 ms 11 ms 18 ms 089-101-162225.ntlworld.ie [89.101.162.225]
4 26 ms 27 ms 11 ms 84.116.238.2
5 10 ms 27 ms 11 ms 84.116.238.34
6 29 ms 25 ms 16 ms deg-gw-1.rte.ie [193.242.111.42]
7 11 ms 28 ms 13 ms www.rte.ie [89.207.56.140]

Trace complete.

C:\WINDOWS\system32>
---

_CyRuSS_

very weird, i have EPC 2203 also...

>tracert www.rte.ie

Tracing route to www.rte.ie.nsatc.net [89.207.56.140]
over a maximum of 30 hops:

1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 40 ms 51 ms 87 ms www.rte.ie [89.207.56.140]

Trace complete.

the_law

EPC2203 / WHR-G54S(Tomato)

Tracing route to www.rte.ie.nsatc.net [89.207.56.140]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 10.0.0.1
2 * * * Request timed out.
3 25 ms 10 ms 16 ms 089-101-173033.ntlworld.ie [89.101.173.33]
4 29 ms 27 ms 8 ms 84.116.238.6
5 29 ms 7 ms 32 ms deg-gw-1.rte.ie [193.242.111.42]
6 9 ms 28 ms 23 ms www.rte.ie [89.207.56.140]

Trace complete.

6 hops for me too. As you can see, the first hop latency for me is variable...

_CyRuSS_

very very weird!

I definitely have the same modem as you and definitely used to work... unless its my router (seems odd though since others here had this very same issue with the other modem)... or else i have a different config file on my modem maybe? i will try connecting laptop directly to modem later and try again

epc2203-E10-5-v202r1262-080522c.bin

srdjan.rosic

If I bought a modem from ebay in order to replace the trully-messed-up-semi-breaks-whenever-I-start-downloading-something-cisco, how would I "provision" it with ntl upc?

For example, with comcast in the states, I was able to ring them up and tell them my MAC address, and they would ""provision"" it, meaning they'd enter the new mac address in their database or smtn and that was it. Does anyone know whether upc can do it?

The alternative would be, I presume, to just configure my modem's firmware with stupid cisco's mac address, that would probably work but that kind-of goes against the principle of macs, right ?

Btw, is there any place in Dublin that sells eurodocsis cable modems ? so I wouldn't have to pay shipping ?

_CyRuSS_

srdjan.rosic wrote: »

If I bought a modem from ebay in order to replace the trully-messed-up-semi-breaks-whenever-I-start-downloading-something-cisco, how would I "provision" it with ntl upc?

For example, with comcast in the states, I was able to ring them up and tell them my MAC address, and they would ""provision"" it, meaning they'd enter the new mac address in their database or smtn and that was it. Does anyone know whether upc can do it?

The alternative would be, I presume, to just configure my modem's firmware with stupid cisco's mac address, that would probably work but that kind-of goes against the principle of macs, right ?

Btw, is there any place in Dublin that sells eurodocsis cable modems ? so I wouldn't have to pay shipping ?

technically they could do it over the phone, but i dont think they do... as far as i know the only cable modems you can use on their network are modems that are supplied by them (that way they know it hasn't been hacked to uncap the connection)

likewise, i don't know of anywhere where you can buy a modem in Dublin as it is of no use