Possible light on the dead connection glitch (1.5)

[DazedNConfused]

Ok, before the cries of "it's your router hardware" and "it's your ISP" start up, I had 1.5 running flawlessly 8hrs ago before a format and reinstall of XP with SP2. It had issues when 1.5 got released that caused the internet connection to go linkdead, the router however continued to show DSL access and restarting the router didn't restore internet access, rebooting the PC did though; which says to me the issue is not with router hardware but rather some port problem in the Windows OS. I patched TCPIP.SYS, disabled UPnP under the router settings and in UTorrent, forwarded the ports under the router's configuration page, and the linkdeath problem went away - everything was fine. Ran UTorrent for several weeks without issue and completed numerous downloads/uploads, I even had NAT enabled without issue.

So a format and reinstall later and the problem is back, except this time I've repeated the steps I took to rectify the issue exactly and no dice, UTorrent gets started and within 2-5mins you are guaranteed to lose internet functionality; UTorrents U/D speeds immediately decellerate down to 0 and you cannot access any webpage via any browser. This *includes* the router's settings page which is stored internally and shouldn't be affected, only way to rectify the issue is to restart the PC, the router on the other hand can remain on and everything is A'OK as soon as Windows starts back up. The router even let's me take a look at the event logs prior to the system reboot for any clues as to what nuked the connection, all of the below show up in the log as errors and are all that is logged prior to the net access dying:

Log one (most recent linkdeath)

00:04:42 (since last boot) FIREWALL exact tcp seqnr check (1 of 1): Protocol: TCP Src ip: 192.168.1.1 Src port: 1195 Dst ip: 85.17.40.39 Dst port: 80

00:04:01 (since last boot) FIREWALL exact tcp state check (1 of 2): Protocol: TCP Src ip: 84.156.222.13 Src port: 16334 Dst ip: 172.XXX.XXX.XXX Dst port: 49256

00:03:31 (since last boot) FIREWALL replay check (1 of 1): Protocol: TCP Src ip: 84.156.222.13 Src port: 16334 Dst ip: 172.XXX.XXX.XXX Dst port: 49217

00:03:15 (since last boot) FIREWALL exact tcp seqnr check (1 of 1): Protocol: TCP Src ip: 192.168.1.1 Src port: 1111 Dst ip: 85.17.40.39 Dst port: 80

00:02:59 (since last boot) FIREWALL exact tcp state check (1 of 1): Protocol: TCP Src ip: 201.41.226.104 Src port: 32459 Dst ip: 172.XXX.XXX.XXX Dst port: 49195

Log two (earlier linkdeath)

00:18:00 (since last boot) FIREWALL exact tcp state check (1 of 1): Protocol: TCP Src ip: 70.130.34.191 Src port: 28871 Dst ip: 172.XXX.XXX.XXX Dst port: 21273

00:16:33 (since last boot) FIREWALL exact tcp state check (1 of 22): Protocol: TCP Src ip: 71.82.59.8 Src port: 59999 Dst ip: 172.XXX.XXX.XXX Dst port: 49727

00:15:41 (since last boot) FIREWALL icmp check (1 of 3): Protocol: ICMP Src ip: 86.139.2.218 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Host Unreacheable

00:15:27 (since last boot) FIREWALL exact tcp state check (1 of 8): Protocol: TCP Src ip: 195.158.109.87 Src port: 32459 Dst ip: 172.XXX.XXX.XXX Dst port: 49711

00:15:03 (since last boot) IDS proto parser : udp null port (1 of 1) : 73.98.98.195 172.XXX.XXX.XXX 0343 UDP 0->1025 (showed up as "warning" rather than "error")

00:14:22 (since last boot) FIREWALL exact tcp state check (1 of 2): Protocol: TCP Src ip: 12.215.83.178 Src port: 60580 Dst ip: 172.XXX.XXX.XXX Dst port: 49427

00:14:21 (since last boot) FIREWALL replay check (1 of 8): Protocol: TCP Src ip: 84.156.222.13 Src port: 16334 Dst ip: 172.XXX.XXX.XXX Dst port: 49562

00:14:09 (since last boot) FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 70.82.227.98 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Port Unreacheable

So going by what I've said, and the logs above, anyone have any ideas or suggestions as to what I could try next? As I mentioned, this setup was running UTorrent without issue several hours ago and nothing has changed in terms of hardware between then and now, only a fresh install of Windows. I've repatched TCPIP.SYS, disabled UPnP in both the router and UTorrent client (have tested with both enabled too, same result), set up a static IP for the NIC the router is attached to, made sure port forwarding is still all set up correctly, and have tried disabling NAT too but so far it results in the same; between two and five minutes of U/D activity and then the OS suddenly can't access the internet anymore despite the router remaining all green. Only solution is to reboot, then everything works as normal, and without the router being reset either; so it's looking to me like a software issue rather than hardware and since I had 1.5 running beforehand I'm going to take a shot at it being SP2 related and somehow screwing ports over shortly into UTorrent's operation. Any takers?

I should probably add: My next step is going to be to test the UTorrent client with the router's firewall disabled and running software firewall only, since the majority of those error logs were listed as firewall issues. I really need to get some sleep though so it'll have to wait until later, in the meantime hopeully someone can throw a few ideas around for me.

[Firon]

Did you change net.max_halfopen?

[DazedNConfused]

No, it's still on it's default, is there a specific number I should try? I do recall having tweaked some of the advanced options in that area in the prior install though, I just don't remember which. It was two to three values and I was following one or several guides on these forums.

I ran network diagnostics lastnight too after it went linkdead again and the system is still returning pings for the local network cards, so it doesn't affect all networking. It can access the NIC the router is connected to but it couldn't ping the router itself, and since the router was still allowing the laptop internet access via Wi-Fi and didn't need restarting to resolve the PC's problem, it would appear something is interfering with the NIC's ability to contact the router a few minutes into UTorrent operation. It's connected directly to the computer via an ethernet cable too, no intermediaries as such that could be blocking it.

Same thing occurs with the router firewall disabled, but it increases the running time to 5-10mins before the error occurs. So I'm not sure exactly what to look at for troubleshooting here, it seems to be the PC rather than the router that is having communication issues, I'm thinking possibly the NIC somehow being affected but I'm not sure how. Oddly I was still getting event log errors too with the firewall disabled, looking at the times it would seem it ran for 8mins before finally dying but during those 8mins a lot of problems were logged:

00:14:48 (since last boot) FIREWALL exact tcp seqnr check (1 of 1): Protocol: TCP Src ip: 213.180.7.66 Src port: 53000 Dst ip: 172.XXX.XXX.XXX Dst port: 50510

00:14:47 (since last boot) FIREWALL exact tcp state check (1 of 8): Protocol: TCP Src ip: 24.35.88.45 Src port: 32459 Dst ip: 172.XXX.XXX.XXX Dst port: 50531

00:13:46 (since last boot) FIREWALL exact tcp seqnr check (1 of 2): Protocol: TCP Src ip: 74.131.35.92 Src port: 9669 Dst ip: 172.XXX.XXX.XXX Dst port: 50522

00:13:44 (since last boot) FIREWALL exact tcp state check (1 of 28): Protocol: TCP Src ip: 69.169.72.156 Src port: 5795 Dst ip: 172.XXX.XXX.XXX Dst port: 50514

00:13:27 (since last boot) FIREWALL icmp check (1 of 2): Protocol: ICMP Src ip: 84.0.101.242 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Host Unreacheable

00:12:43 (since last boot) FIREWALL exact tcp state check (1 of 34): Protocol: TCP Src ip: 85.218.30.224 Src port: 6881 Dst ip: 172.XXX.XXX.XXX Dst port: 50453

00:12:17 (since last boot) FIREWALL replay check (1 of 3): Protocol: TCP Src ip: 204.13.135.234 Src port: 6969 Dst ip: 172.XXX.XXX.XXX Dst port: 50361

00:11:48 (since last boot) FIREWALL exact tcp seqnr check (1 of 1): Protocol: TCP Src ip: 68.13.121.230 Src port: 7001 Dst ip: 172.XXX.XXX.XXX Dst port: 50403

00:11:41 (since last boot) FIREWALL exact tcp state check (1 of 16): Protocol: TCP Src ip: 83.135.155.18 Src port: 53438 Dst ip: 172.XXX.XXX.XXX Dst port: 50398

00:11:17 (since last boot) FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 220.239.37.252 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Host Unreacheable

00:11:02 (since last boot) FIREWALL replay check (1 of 16): Protocol: TCP Src ip: 204.13.135.234 Src port: 6969 Dst ip: 172.XXX.XXX.XXX Dst port: 50361

00:10:39 (since last boot) FIREWALL exact tcp state check (1 of 6): Protocol: TCP Src ip: 193.216.82.199 Src port: 25116 Dst ip: 172.XXX.XXX.XXX Dst port: 50341

00:09:57 (since last boot) FIREWALL replay check (1 of 7): Protocol: TCP Src ip: 24.131.64.153 Src port: 34646 Dst ip: 172.XXX.XXX.XXX Dst port: 50259

00:09:52 (since last boot) FIREWALL icmp check (1 of 6): Protocol: ICMP Src ip: 86.139.2.218 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Host Unreacheable

00:09:21 (since last boot) FIREWALL exact tcp state check (1 of 5): Protocol: TCP Src ip: 68.12.159.71 Src port: 61362 Dst ip: 172.XXX.XXX.XXX Dst port: 49407

00:09:15 (since last boot) IDS proto parser : udp null port (1 of 1) : 141.5.91.12 172.XXX.XXX.XXX 0343 UDP 0->1025

00:08:53 (since last boot) FIREWALL replay check (1 of 4): Protocol: TCP Src ip: 84.156.222.13 Src port: 16334 Dst ip: 172.XXX.XXX.XXX Dst port: 50092

00:08:42 (since last boot) FIREWALL icmp check (1 of 2): Protocol: ICMP Src ip: 198.53.130.75 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Port Unreacheable

00:08:09 (since last boot) FIREWALL exact tcp state check (1 of 7): Protocol: TCP Src ip: 68.12.159.71 Src port: 61327 Dst ip: 172.XXX.XXX.XXX Dst port: 49407

00:07:41 (since last boot) FIREWALL icmp check (1 of 4): Protocol: ICMP Src ip: 84.0.101.242 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Host Unreacheable

00:07:14 (since last boot) FIREWALL replay check (1 of 1): Protocol: TCP Src ip: 84.156.222.13 Src port: 16334 Dst ip: 172.XXX.XXX.XXX Dst port: 49247

00:07:06 (since last boot) FIREWALL exact tcp state check (1 of 1): Protocol: TCP Src ip: 82.46.106.2 Src port: 10002 Dst ip: 172.XXX.XXX.XXX Dst port: 49226

00:06:31 (since last boot) FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 70.82.227.98 Dst ip: 172.XXX.XXX.XXX Type: Destination Unreachable Code: Port Unreacheable

I thought that maybe some security issue was being logged that caused the router to forcibly block the PC system but if that were the case then I would imagine I would have to access the router settings page or reset the router itself before I could access the net again, instead it's the PC system that needs to be rebooted and then no further action, so it would seem to me the problem is on the PC's side of things. Which would possibly mean that despite all the event logs on the router, they're unrelated to the actual loss of connection, and that is somehow occuring in the OS.

Ok, I've had it up and running without issue for about an hour now and fingers crossed, it'll stay that way indefinitely. I did a few things beforehand:

1) Changed the NIC settings to disable Jumbo Frames (it's a gigabit LAN NIC built in to the motherboard)

2) Downloaded TCPOptimiser as per your mini-guide and set the optimal MTU etc. by selecting my DSL download bandwidth with the slider.

3) Changed net.max_halfopen to 40

My guess is that it was TCPOptimiser which actually rectified the issue, since that would indeed be Windows related, and I had to open UTorrent to change the net.max_halfopen setting which if the issue hadn't been rectified would've caused linkdeath quite quickly; therefore I believe the issue was resolved before adjusting any UTorrent settings. The Jumbo Frames setting merely increases the data bandwidth between the router and the PC so that information can be transferred more quickly and doesn't bottleneck, it might be that the frame size was too high for the PC/router to handle and that somehow caused the disconnection issue as that would indeed interrupt communication between the NIC and the router without affecting the router itself; but I don't believe I was using the Jumbo Frames setting in my previous Windows installation when I encountered the same problems with UTorrent prior to resolving it. So again, my best guess is it was the TCP settings and MaxMTU, but I could be wrong. Might be useful information for you to have handy in future if anyone else complains of their internet connection dying when they run UTorrent, possibly may even help some of the guys who've posted about it previously to resolve their issue, I don't believe it's their router hardware though since the symptoms they described are identical to mine and mine was seemingly a software based glitch.

Ok, Jumbo Frames on a Gigabit NIC enables frame sizes of upto and in some cases over 9000, on a system that is not connected to another piece of Gigabit capable hardware it defaults to 1500. My particular ISP uses a MaxMTU of 1400 and 1500 in more cases than not actually causes a timeout, having configured TCPOptimiser for a 2MBit DSL connection and manually adjusted the MTU it suggested to 1400 everything is working fine, so it's possible it was a combination of both the MTU and the NIC settings that was causing the PC to lose communication with the router when UTorrent was running.

Based on that speculation I would advise that anyone else suffering the internet connection loss problems that hasn't been able to rectify it by following the UPnP/NAT/TCPIP.SYS suggestions actually makes sure the NIC their router is connected to is set to autonegotiate (not forced full/half duplex settings), that any settings like "Jumbo Frames" are disabled (if it's a gigabit NIC), and that they followed the steps in the miniguide for using TCPOptimiser to set the correct MTU for their system. You can test this from the "Max MTU" tab, watch the results and avoid using MTU values you have seen timing out in the test results. Stick with the highest value the test achieved without timing out, and use the slider under "General Settings" to select your broadband speed, it will fill in all the other values for you automatically; just be sure the MTU it suggests is within the working ones from your tests. Remember to select the correct NIC from the dropdown list before you adjust any settings, you should select the one you have your router connected to.

Stop QUADRUPLE posting, use edit and put it all in one post.