BEFSR41 Intermittent Connection

les moore · July 29, 2009

Had everything working fine for some time, when nearby lightning fried the modem and router (both on UPS). Router was replaced with exact same model/version, and the modem is still a Motorola surfboard, although I don't know if there was some kind of model change. The true weirdness is that I had no problems before.

The problem now is that the connection is dropped every few hours. If I bypass the router it seems to work fine, so it seems it is router-based, and the connection is restored by power cycling the router.

Linksys says everything is set up right, but it seems like with the original router we did some stuff in Windows (although nothing should have changed there).

Here are the various stats, and changes I've made based on info in the forums:

router: Linksys BEFSR41 v.4.3

modem: Motorola surfboard SB5101

Comcast cable

Windows XP SP3

Pentium 4, 1.9 GHz

Avira antivirus

firewall and port forwarding works, port set in high part of range

Glasnost test says there is no indication that the ISP is limiting BitTorrent traffic,

although their main page suggests Comcast is blocking hosts

in uTorrent, if I let it run free, I see maximum rates of around 130kB/s upload,

but I have set to the conservative settings listed for 128kbits/s,

which if kB is 8 x kbits would seem *really* conservative if I understand correctly:

upload 22 (also alternate upload when not dl)

global max conn 60

max peers/torrent 35

upload slots/torrent 3

max active 2

active downloads 1

use additional upload slots unchecked

network status is green

net.max_halfopen *4

bt.connect_speed *10

peer.resolve_country false

bt.transp_disposition *5

peer.lazy_bitfield true

DHT disabled

UPnP disabled

NAT-PMP disabled

Protocol Encryption out forced/in not allowed (changed from enabled/allowed)

Resolve IPs disabled (never would have found this - right-click in PEERS window/tab of a torrent)

Anything that could be mentioned to Linksys?

I would also consider ditching this router,

are there any recommendations for a router that can handle lots of connections?

(if that in fact is the problem).

Would appreciate any suggestions. As it is, the P2P is not very useful unless I'm around to constantly monitor it and restore the connection.

Switeck · July 30, 2009

Have you checked your router/firewall/uTorrent logs to see if the total connection traffic load on the router is light?

There could be other networking software contributing/causing the router crashes.

les moore · July 30, 2009

Not sure exactly what you mean by the logs. TivoServer and related stuff is loaded, but that's not unusual. Here are logs from HijackThis and ProcessExplorer:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:09:34 AM, on 7/30/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe

C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe

C:\Program Files\TiVo\Desktop\TiVoNotify.exe

C:\Program Files\TiVo\Desktop\TiVoServer.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\PROGRA~1\FOXITR~1\FOXITR~1.EXE

C:\WINDOWS\SYSTEM32\notepad.exe

C:\PROGRA~1\MOZILL~2\THUNDE~1.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\1Video\Super\SUPER.exe

C:\Program Files\Avira\AntiVir Desktop\avnotify.exe

C:\Program Files\1Utilities\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer

O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify

O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer

O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe

O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://*.mcafee.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159190580781

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab

O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -

O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{7EC32425-C16A-4DD1-8BBB-57F4681A6902}: NameServer = 68.87.68.166,68.87.74.166

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\1Utilities\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe

O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

--

End of file - 7243 bytes

**********

Process PID CPU Description Company Name

System Idle Process 0 95.38

Interrupts n/a Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4

smss.exe 440 Windows NT Session Manager Microsoft Corporation

csrss.exe 528 Client Server Runtime Process Microsoft Corporation

winlogon.exe 552 Windows NT Logon Application Microsoft Corporation

services.exe 596 1.54 Services and Controller app Microsoft Corporation

svchost.exe 800 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 888 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 956 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 988 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1088 Generic Host Process for Win32 Services Microsoft Corporation

spoolsv.exe 1308 Spooler SubSystem App Microsoft Corporation

sched.exe 1388 Antivirus Scheduler Avira GmbH

svchost.exe 1440 Generic Host Process for Win32 Services Microsoft Corporation

avguard.exe 1528 Antivirus On-Access Service Avira GmbH

AppleMobileDeviceService.exe 1544 Apple Mobile Device Service Apple Inc.

mDNSResponder.exe 1560 Bonjour Service Apple Inc.

jqs.exe 1692 Java Quick Starter Service Sun Microsystems, Inc.

mdm.exe 1760 Machine Debug Manager Microsoft Corporation

nvsvc32.exe 1820 NVIDIA Driver Helper Service, Version 71.89 NVIDIA Corporation

svchost.exe 1912 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1992 Generic Host Process for Win32 Services Microsoft Corporation

TiVoBeacon.exe 2028 TiVo Beacon Service Process TiVo Inc.

WDBtnMgrSvc.exe 228 WD Drive Manager Service WDC

MsPMSPSv.exe 344 WMDM PMSP Service Microsoft Corporation

iPodService.exe 2620 iPodService Module Apple Inc.

alg.exe 2648 Application Layer Gateway Service Microsoft Corporation

lsass.exe 608 LSA Shell (Export Version) Microsoft Corporation

explorer.exe 1280 Windows Explorer Microsoft Corporation

WDBtnMgrUI.exe 1132 1.54 WD Drive Manager WDC

avgnt.exe 1156 Antivirus System Tray Tool Avira GmbH

iTunesHelper.exe 1180 iTunesHelper Module Apple Inc.

ctfmon.exe 1192 CTF Loader Microsoft Corporation

TiVoTransfer.exe 1208 TiVo Transfer Service Process TiVo Inc.

TiVoNotify.exe 1224 TiVo Notify Service Process TiVo Inc.

TiVoServer.exe 1268 TiVo Server Service Process TiVo Inc.

firefox.exe 2156 Firefox Mozilla Corporation

FOXITR~1.EXE 2540 Foxit Reader, Best Reader for Everyday Use! Foxit Software Company

uTorrent.exe 1864 µTorrent BitTorrent, Inc.

notepad.exe 3044 Notepad Microsoft Corporation

THUNDE~1.EXE 2928 Mozilla Thunderbird Mozilla Corporation

notepad.exe 3232 Notepad Microsoft Corporation

procexp.exe 4012 1.54 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

avnotify.exe 2952 Notification Tool Avira GmbH

notepad.exe 720 Notepad Microsoft Corporation

notepad.exe 2964 Notepad Microsoft Corporation

Switeck · July 30, 2009

I meant the router pages that show incoming and outgoing connections...your router won't handle more than 100 connections at once without problems.

TCP View (from same place you got Process Explorer) can also show connected ips.

Process Explorer can also show uTorrent.exe's connected DLL list...which might show if "strange" (non-Microsoft) DLLs are trying to control uTorrent.

les moore · July 30, 2009

Thanks for your comments. I have setup (or tried) the log for my router at 192.168.1.1, but I'm not seeing anything there. May have to talk to Linksys to get that working.

BTW, For anyone playing along, I got Process Explorer and TCPView from technet.microsoft.com

Can't figure what you mean about viewing the DLLs via Process Explorer. For some reason the help files for TCPView and Process Explorer don't work. Anyway, this is from TCPView doing "save as":

[system Process]:0 TCP Office:8100 localhost:1751 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1774 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1858 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1798 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1826 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1818 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1850 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1842 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1790 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1786 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1782 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1810 TIME_WAIT

[system Process]:0 TCP office:59259 bb116-15-168-88.singnet.com.sg:1431 TIME_WAIT

[system Process]:0 TCP office:59259 97-122-213-248.hlrn.qwest.net:59236 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1853 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1833 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1862 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1857 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1837 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1793 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1861 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1809 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1825 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1882 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1865 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1817 TIME_WAIT

[system Process]:0 TCP office:59259 189.216.121.101:64621 TIME_WAIT

[system Process]:0 TCP office:59259 hsi-kbw-091-089-066-166.hsi2.kabelbw.de:42829 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1886 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1873 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1849 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1796 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1781 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1856 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1772 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1800 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1816 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1784 TIME_WAIT

[system Process]:0 TCP office:59259 rcwifi-modoc-s2mt.nas.oibw.net:50422 TIME_WAIT

[system Process]:0 TCP office:59259 adsl2-3.lsf.forthnet.gr:2042 TIME_WAIT

[system Process]:0 TCP office:59259 203.166.203.48:1122 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1776 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1879 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1848 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1779 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1836 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1872 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1871 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1819 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1803 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1791 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1827 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1875 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1767 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1775 TIME_WAIT

[system Process]:0 TCP Office:8200 localhost:1811 TIME_WAIT

[system Process]:0 TCP office:59259 82-42-230-51.cable.ubr19.live.blueyonder.co.uk:3315 TIME_WAIT

[system Process]:0 TCP office:59259 rcwifi-modoc-s2mt.nas.oibw.net:50347 TIME_WAIT

[system Process]:0 TCP office:59259 c188-252.icpnet.pl:58145 TIME_WAIT

[system Process]:0 TCP office:59259 97-122-213-248.hlrn.qwest.net:59215 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1799 TIME_WAIT

[system Process]:0 TCP office:59259 97-122-213-248.hlrn.qwest.net:59215 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1835 TIME_WAIT

[system Process]:0 TCP office:59259 97-122-213-248.hlrn.qwest.net:59215 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1883 TIME_WAIT

[system Process]:0 TCP office:1117 77-21-61-114-dynip.superkabel.de:31651 TIME_WAIT

[system Process]:0 TCP Office:1777 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1778 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1795 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1794 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1815 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1814 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1831 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1830 localhost:8100 TIME_WAIT

[system Process]:0 TCP office:59259 c-76-21-32-203.hsd1.ca.comcast.net:41328 TIME_WAIT

[system Process]:0 TCP Office:1851 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1852 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1867 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1866 localhost:8100 TIME_WAIT

[system Process]:0 TCP office:1845 ppp-58-65.98-62.inwind.it:1755 TIME_WAIT

[system Process]:0 TCP office:59259 c-76-21-32-203.hsd1.ca.comcast.net:41328 TIME_WAIT

[system Process]:0 TCP office:1840 80-47-30-63.lond-hex.dynamic.dial.as9105.com:23025 TIME_WAIT

[system Process]:0 TCP Office:1884 localhost:8100 TIME_WAIT

[system Process]:0 TCP Office:1885 localhost:8100 TIME_WAIT

alg.exe:2648 TCP Office:1050 Office:0 LISTENING

AppleMobileDeviceService.exe:1544 TCP Office:27015 localhost:1033 ESTABLISHED

AppleMobileDeviceService.exe:1544 TCP Office:27015 Office:0 LISTENING

avnotify.exe:2952 UDP Office:2081 *:*

firefox.exe:2156 TCP Office:1170 localhost:1169 ESTABLISHED

firefox.exe:2156 TCP Office:1162 localhost:1161 ESTABLISHED

firefox.exe:2156 TCP Office:1161 localhost:1162 ESTABLISHED

firefox.exe:2156 TCP Office:1169 localhost:1170 ESTABLISHED

iTunesHelper.exe:1180 TCP Office:1033 localhost:27015 ESTABLISHED

jqs.exe:1692 TCP Office:5152 localhost:1316 CLOSE_WAIT

jqs.exe:1692 TCP Office:5152 Office:0 LISTENING

LogViewer.exe:2324 UDP Office:4458 *:*

LogViewer.exe:2324 UDP Office:snmptrap *:*

lsass.exe:608 UDP Office:isakmp *:*

lsass.exe:608 UDP Office:4500 *:*

mDNSResponder.exe:1560 TCP Office:5354 Office:0 LISTENING

mDNSResponder.exe:1560 UDP Office:57181 *:*

mDNSResponder.exe:1560 UDP Office:5353 *:*

mDNSResponder.exe:1560 UDP Office:1025 *:*

svchost.exe:1912 UDP Office:1900 *:*

svchost.exe:1912 UDP office:1900 *:*

svchost.exe:888 TCP Office:epmap Office:0 LISTENING

svchost.exe:956 UDP Office:ntp *:*

svchost.exe:956 UDP office:ntp *:*

System:4 TCP office:netbios-ssn Office:0 LISTENING

System:4 TCP Office:microsoft-ds Office:0 LISTENING

System:4 UDP office:netbios-ns *:*

System:4 UDP office:netbios-dgm *:*

System:4 UDP Office:microsoft-ds *:*

THUNDE~1.EXE:2928 TCP Office:3966 localhost:3965 ESTABLISHED

THUNDE~1.EXE:2928 TCP Office:3965 localhost:3966 ESTABLISHED

TiVoBeacon.exe:2028 TCP Office:2190 Office:0 LISTENING

TiVoBeacon.exe:2028 TCP Office:8100 Office:0 LISTENING

TiVoBeacon.exe:2028 UDP Office:2190 *:*

TiVoServer.exe:1268 TCP Office:4430 Office:0 LISTENING

TiVoServer.exe:1268 TCP Office:8080 Office:0 LISTENING

TiVoTransfer.exe:1208 TCP Office:8200 Office:0 LISTENING

uTorrent.exe:1864 TCP office:1399 59.95.129.55:24685 ESTABLISHED

uTorrent.exe:1864 TCP office:4139 bl10-200-5.dsl.telepac.pt:18324 ESTABLISHED

uTorrent.exe:1864 TCP office:1675 c-76-24-40-97.hsd1.ma.comcast.net:6881 ESTABLISHED

uTorrent.exe:1864 TCP office:3939 alyon-257-1-163-143.w90-48.abo.wanadoo.fr:31426 ESTABLISHED

uTorrent.exe:1864 TCP office:1673 c-75-70-46-236.hsd1.co.comcast.net:58904 ESTABLISHED

uTorrent.exe:1864 TCP office:4819 bas11-montreal02-1128536477.dsl.bell.ca:32459 ESTABLISHED

uTorrent.exe:1864 TCP Office:59259 Office:0 LISTENING

uTorrent.exe:1864 UDP Office:59259 *:*

uTorrent.exe:1864 UDP Office:6771 *:*

uTorrent.exe:1864 TCP office:1832 77-21-61-114-dynip.superkabel.de:31651 ESTABLISHED

uTorrent.exe:1864 TCP office:1854 116.68.116.19:21826 ESTABLISHED

uTorrent.exe:1864 TCP office:1868 60.54.209.155:28209 FIN_WAIT1

uTorrent.exe:1864 TCP office:1869 c80-216-128-228.bredband.comhem.se:4662 SYN_SENT

uTorrent.exe:1864 TCP office:1870 c80-216-239-129.bredband.comhem.se:12970 SYN_SENT

uTorrent.exe:1864 TCP office:1878 host149-41-dynamic.30-79-r.retail.telecomitalia.it:39196 LAST_ACK

uTorrent.exe:1864 TCP office:1880 69-165-138-144.dsl.teksavvy.com:36857 SYN_SENT

uTorrent.exe:1864 TCP office:1881 115.37.94-79.rev.gaoland.net:20484 SYN_SENT

Switeck · July 30, 2009

What's with all the:

[system Process]:0 TCP Office:8100 localhost:1751 TIME_WAIT

[system Process]:0 TCP Office:8100 localhost:1774 TIME_WAIT

That's strange behavior that doesn't make sense if I assume uTorrent is listening on port 1864.

Do you have some sort of software firewall that's routing all uTorrent's traffic through it?

Did this not work?!:

get Process Explorer from www.sysinternals.com, run it, Ctrl+D (to show the lower DLL pane), select the µTorrent process from the list, Ctrl+S (and save the list somewhere you'll find easily -- like the Desktop), then post the contents of the saved process list in the .txt file here

les moore · July 30, 2009

Firewall is windows.

This is from Process Explorer as you described:

Process PID CPU Description Company Name

System Idle Process 0 84.85

Interrupts n/a Hardware Interrupts

DPCs n/a 1.52 Deferred Procedure Calls

System 4

smss.exe 440 Windows NT Session Manager Microsoft Corporation

csrss.exe 528 Client Server Runtime Process Microsoft Corporation

winlogon.exe 552 Windows NT Logon Application Microsoft Corporation

services.exe 596 3.03 Services and Controller app Microsoft Corporation

svchost.exe 800 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 888 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 956 Generic Host Process for Win32 Services Microsoft Corporation

wuauclt.exe 2316 Windows Update Automatic Updates Microsoft Corporation

svchost.exe 988 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1088 Generic Host Process for Win32 Services Microsoft Corporation

spoolsv.exe 1308 Spooler SubSystem App Microsoft Corporation

sched.exe 1388 Antivirus Scheduler Avira GmbH

svchost.exe 1440 Generic Host Process for Win32 Services Microsoft Corporation

avguard.exe 1528 Antivirus On-Access Service Avira GmbH

AppleMobileDeviceService.exe 1544 Apple Mobile Device Service Apple Inc.

mDNSResponder.exe 1560 Bonjour Service Apple Inc.

jqs.exe 1692 Java Quick Starter Service Sun Microsystems, Inc.

mdm.exe 1760 Machine Debug Manager Microsoft Corporation

nvsvc32.exe 1820 NVIDIA Driver Helper Service, Version 71.89 NVIDIA Corporation

svchost.exe 1912 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1992 1.52 Generic Host Process for Win32 Services Microsoft Corporation

TiVoBeacon.exe 2028 TiVo Beacon Service Process TiVo Inc.

WDBtnMgrSvc.exe 228 WD Drive Manager Service WDC

MsPMSPSv.exe 344 WMDM PMSP Service Microsoft Corporation

iPodService.exe 2620 iPodService Module Apple Inc.

alg.exe 2648 Application Layer Gateway Service Microsoft Corporation

lsass.exe 608 LSA Shell (Export Version) Microsoft Corporation

explorer.exe 1280 Windows Explorer Microsoft Corporation

WDBtnMgrUI.exe 1132 WD Drive Manager WDC

avgnt.exe 1156 Antivirus System Tray Tool Avira GmbH

iTunesHelper.exe 1180 iTunesHelper Module Apple Inc.

ctfmon.exe 1192 CTF Loader Microsoft Corporation

TiVoTransfer.exe 1208 TiVo Transfer Service Process TiVo Inc.

TiVoNotify.exe 1224 TiVo Notify Service Process TiVo Inc.

TiVoServer.exe 1268 TiVo Server Service Process TiVo Inc.

firefox.exe 2156 Firefox Mozilla Corporation

FOXITR~1.EXE 2540 Foxit Reader, Best Reader for Everyday Use! Foxit Software Company

uTorrent.exe 1864 4.55 µTorrent BitTorrent, Inc.

notepad.exe 3044 Notepad Microsoft Corporation

THUNDE~1.EXE 2928 3.03 Mozilla Thunderbird Mozilla Corporation

LogViewer.exe 2324 LogViewer MFC Application

procexp.exe 3512 1.52 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

avnotify.exe 2952 Notification Tool Avira GmbH

Process: uTorrent.exe Pid: 1864

Name Description Company Name Version

ACTIVEDS.dll ADs Router Layer DLL Microsoft Corporation 5.1.2600.5512

adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.1.2600.5512

ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 5.1.2600.5755

appHelp.dll Application Compatibility Client Library Microsoft Corporation 5.1.2600.5512

ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation 3.5.2284.1

browseui.dll Shell Browser UI Library Microsoft Corporation 6.0.2900.5512

CLBCATQ.DLL Microsoft Corporation 2001.12.4414.700

COMCTL32.dll User Experience Controls Library Microsoft Corporation 6.0.2900.5512

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.0.2900.5512

COMRes.dll Microsoft Corporation 2001.12.4414.700

CRYPT32.dll Crypto API32 Microsoft Corporation 5.131.2600.5512

CRYPTUI.dll Microsoft Trust UI Provider Microsoft Corporation 5.131.2600.5512

CSCDLL.dll Offline Network Agent Microsoft Corporation 5.1.2600.5512

cscui.dll Client Side Caching UI Microsoft Corporation 5.1.2600.5512

CTYPE.NLS

DnsApi.dll DNS Client API DLL Microsoft Corporation 5.1.2600.5625

GDI32.dll GDI Client DLL Microsoft Corporation 5.1.2600.5698

hnetcfg.dll Home Networking Configuration Manager Microsoft Corporation 5.1.2600.5512

iertutil.dll Run time utility for Internet Explorer Microsoft Corporation 8.0.6001.18806

IMAGEHLP.dll Windows NT Image Helper Microsoft Corporation 5.1.2600.5512

IMM32.DLL Windows XP IMM32 API Client DLL Microsoft Corporation 5.1.2600.5512

Iphlpapi.dll IP Helper API Microsoft Corporation 5.1.2600.5512

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 5.1.2600.5781

locale.nls

mdnsNSP.dll Bonjour Namespace Provider Apple Inc. 1.0.6.2

MPRAPI.dll Windows NT MP Router Administration DLL Microsoft Corporation 5.1.2600.5512

MSASN1.dll ASN.1 Runtime APIs Microsoft Corporation 5.1.2600.5512

MSCTF.dll MSCTF Server DLL Microsoft Corporation 5.1.2600.5512

msctfime.ime Microsoft Text Frame Work Service IME Microsoft Corporation 5.1.2600.5512

mslbui.dll LangageBar Add In Microsoft Corporation 5.1.2600.5512

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.2600.5512

mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 5.1.2600.5625

netapi32.dll Net Win32 API DLL Microsoft Corporation 5.1.2600.5694

Normaliz.dll Unicode Normalization DLL Microsoft Corporation 6.0.5441.0

ntdll.dll NT Layer DLL Microsoft Corporation 5.1.2600.5755

ntshrui.dll Shell extensions for sharing Microsoft Corporation 5.1.2600.5512

ole32.dll Microsoft OLE for Windows Microsoft Corporation 5.1.2600.5512

oleaut32.dll Microsoft Corporation 5.1.2600.5512

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 5.1.2600.5512

RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 5.1.2600.5795

rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 5.1.2600.5507

rtutils.dll Routing Utilities Microsoft Corporation 5.1.2600.5512

SAMLIB.dll SAM Library DLL Microsoft Corporation 5.1.2600.5512

Secur32.dll Security Support Provider Interface Microsoft Corporation 5.1.2600.5753

SETUPAPI.dll Windows Setup API Microsoft Corporation 5.1.2600.5512

shdocvw.dll Shell Doc Object and Control Library Microsoft Corporation 6.0.2900.5512

SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.0.2900.5622

shfolder.dll Shell Folder Service Microsoft Corporation 6.0.2900.5512

SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.0.2900.5512

SORTKEY.NLS

sorttbls.nls

UNICODE.NLS

urlmon.dll OLE32 Extensions for Win32 Microsoft Corporation 8.0.6001.18806

USER32.dll Windows XP USER API Client DLL Microsoft Corporation 5.1.2600.5512

USERENV.dll Userenv Microsoft Corporation 5.1.2600.5512

uTorrent.exe µTorrent BitTorrent, Inc. 1.8.3.15772

uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.0.2900.5512

VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 5.1.2600.5512

WININET.dll Internet Extensions for Win32 Microsoft Corporation 8.0.6001.18806

WINTRUST.dll Microsoft Trust Verification APIs Microsoft Corporation 5.131.2600.5512

WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 5.1.2600.5512

WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.1.2600.5512

WS2HELP.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation 5.1.2600.5512

wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation 5.1.2600.5512

xpsp2res.dll Service Pack 2 Messages Microsoft Corporation 5.1.2600.5512

Switeck · July 31, 2009

Only non-Microsoft DLL I see injected into utorrent.exe's memory space is this:

mdnsNSP.dll Bonjour Namespace Provider Apple Inc. 1.0.6.2

Is Teredo/IPv6 disabled?

Best I can tell, you have a few internet-using programs that are running at the same time...that maybe every few hours together top 100 total connections, of which uTorrent is probably making the most.

les moore · August 4, 2009

Removed Bonjour, which is not necessary for me, but iTunes nags you about it.

Near as I can figure, Teredo/IPv6 is disabled.

I've been running longer, like over a day w/o losing the connection, but on the other hand I've had some real slow torrents lined up.

And of course, with the same router, I used to run 9 torrents at a time with no problems.

Switeck · August 4, 2009

TCP View...Just something to try again.

Try disabling Resolve IPs on it.

Also set refresh rate to STOPPED.

Just press Refresh (F5 key) to see a snapshot of what connections you have at the moment you press F5. This is GOOD for showing if peers/seeds stay connected to you very long.

Green = new connection

Yellow = connection state changed

Red = Disconnected!

White = unchanged

You can also show/hide disconnected endpoints (ips that have disconnected).

I'm not expecting it to show anything, so I don't really want to see another log...but you might want to figure out how fast connections are being made/broken that way.

Do most Established connections last at least 10 minutes?

Right-clicking on a connection will allow you to close either the connection *OR* the program that MADE or accepted the connection. This can be good for shutting down malware or unwanted commercial software...

les moore · August 4, 2009

I would say that most (or all) established connections do not last 10 minutes. I did this with a slow seeding file, which was all I had going, and then intentionally added a "hot download" with tons of connections and got the same results.

*****

follow up:

Maybe it was the router. After the problem never resolved, attempted to upgrade firmware of the router and this killed the router. Got a replacement router which has worked under heavy load for about 24 hours with no problems.

gendouhydeist · December 21, 2009

well i got the same router but its v4.2 with updated firmware and im always having intermittent connection like him, so how im gonna limit my incoming and outgoing connection, do you think disabling NAT would help?

and yeah im also using your conservative setting @ 1.5Mbps

Here's the Router Log Connections Total of 140

Incoming
92.99.79.86
99.247.63.166
75.0.68.6
71.231.196.73
90.176.120.80
189.191.131.162
118.175.28.25
218.44.114.90
151.213.164.90
92.235.124.19
68.147.60.15
114.45.181.216
203.214.0.204
192.168.0.100
71.95.149.158
218.44.114.90
141.153.130.217
61.67.160.253
90.176.120.80
99.247.63.166
90.149.17.151
87.101.171.46
67.49.254.43
92.99.79.86
218.44.114.90
71.231.196.73
189.61.33.36
88.209.140.29
99.55.153.133
90.176.120.80
119.247.64.189
203.19.70.139
71.231.196.73
218.44.114.90
58.8.114.123
64.252.18.79
119.247.64.189
193.95.219.68
92.99.79.86
97.100.38.224
71.231.196.73
114.45.181.216
218.44.114.90
92.104.106.150
90.176.120.80
67.222.182.108
71.97.59.26
124.168.113.238
218.44.114.90
43.244.202.184
122.107.62.63
82.229.211.97
71.231.196.73
69.152.1.205
116.71.179.96
218.44.114.90
85.166.12.30
71.231.196.73
193.95.219.68
193.165.152.57
125.24.172.134
220.19.114.244
218.44.114.90
82.123.1.144
71.231.196.73
82.123.1.144
70.57.230.92
24.19.27.36
218.44.114.90
220.19.114.244
Outgoing
192.168.1.102 112.203.164.205 51413
192.168.1.102 112.203.34.160 22482
192.168.1.102 118.161.77.117 6886
192.168.1.102 118.71.145.51 59555
192.168.1.102 116.197.238.166 29029
192.168.1.102 110.139.1.237 50001
192.168.1.102 115.147.231.91 29614
192.168.1.102 104.223.79.186 34820
192.168.1.102 101.228.28.115 37863
192.168.1.102 103.36.124.40 12368
192.168.1.102 117.15.123.164 49859
192.168.1.102 112.118.70.39 6881
192.168.1.102 120.28.74.72 41658
192.168.1.102 120.28.64.90 41658
192.168.1.102 119.56.76.21 64786
192.168.1.102 120.164.33.188 9355
192.168.1.102 120.164.33.174 11514
192.168.1.102 120.151.208.26 57692
192.168.1.102 102.24.202.67 22245
192.168.1.102 114.184.223.55 9889
192.168.1.102 114.182.95.108 16968
192.168.1.102 114.165.80.101 59746
192.168.1.102 114.45.181.216 HTTP
192.168.1.102 120.100.62.121 33809
192.168.1.102 114.44.4.187 26980
192.168.1.102 112.104.55.132 25753
192.168.1.102 103.85.75.87 41560
192.168.1.102 203.73.48.172 20224
192.168.1.102 114.42.152.188 21655
192.168.1.102 118.131.150.82 28025
192.168.1.102 102.52.84.210 33657
192.168.1.102 119.94.212.161 13935
192.168.1.102 105.113.85.157 11543
192.168.1.102 109.67.118.131 38482
192.168.1.102 112.203.164.205 51413
192.168.1.102 112.203.34.160 22482
192.168.1.102 112.142.122.178 46103
192.168.1.102 110.139.1.237 50001
192.168.1.102 74.216.7.0 16927
192.168.1.102 74.216.7.152 16927
192.168.1.102 102.52.84.217 15229
192.168.1.102 102.53.36.66 23413
192.168.1.102 120.80.43.61 23411
192.168.1.102 120.77.49.213 43880
192.168.1.102 120.75.131.44 20860
192.168.1.102 102.155.202.157 48738
192.168.1.102 110.133.207.156 24259
192.168.1.102 120.74.220.178 2153
192.168.1.102 104.158.235.64 54877
192.168.1.102 113.252.120.83 6881
192.168.1.102 112.118.70.39 6881
192.168.1.102 102.66.41.55 32248
192.168.1.102 102.68.149.129 34199
192.168.1.102 102.186.127.86 64604
192.168.1.102 104.203.87.201 9854
192.168.1.102 115.132.231.90 62805
192.168.1.102 117.155.237.82 1572
192.168.1.102 102.72.239.69 63801
192.168.1.102 120.46.18.107 53117
192.168.1.102 114.42.152.188 21655
192.168.1.102 102.163.71.69 39637
192.168.1.102 120.42.229.97 8284
192.168.1.102 120.28.64.90 41658
192.168.1.102 115.147.231.91 29614
192.168.1.102 112.203.164.205 51413
192.168.1.102 116.197.238.166 29029
192.168.1.102 115.70.75.168 49683
192.168.1.102 108.7.4.207 14744
192.168.1.102 114.45.181.216 HTTP
192.168.1.102 112.198.196.235 13199

Switeck · December 22, 2009

Disabling NAT won't help.

That old router model isn't good for >100 connections at once.

1st and 2nd links in my signature.

BEFSR41 Intermittent Connection

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Archived