Tracert (XP (SP1))

[ade]

Hi,

Bizarre happenings in tracert!

If I perform a tracert on my Windows XP (SP1) PC, the first hop appears to go to one of the other PC's within our LAN, not to our default gateway. The PC that gets the first hop is using the IP address that used to be our default gateway, but is no longer - we changed the IP about three months ago. If I delete the DNS entry for this PC, the hop still goes to the old default gateway address; if I turn the fake default gateway PC off, the hop still goes to this address.

Is this something that has been left behind in DNS, a DHCP error, or something else server based? Or is my router still caching the old gateway address (just thought of that one!).

Any thoughts appreciated...

TIA,

[StuartR]

I assume you are using DHCP to get your configuration information, but look at the properties of your TCP/IP connection to check whether there is a hard coded Gateway address just in case. Then try the following...

From a command window (Start > Run > CMD) type IPCONFIG
Look to see what default gateway is specified. Is it correct?
Now type IPCONFIG /RELEASE
Wait a few seconds and type IPCONFIG /RENEW

Does that fix it?

StuartR

[ade]

Sorry, should have said...

DHCP is assigning all our TCP/IP services and I've already checked for hard coded gateway. Have also renewed IP configuration many times too...makes no difference. I can recreate the problem on other PC's in LAN.

Ade

[StuartR]

So what output did you get to the IPCONFIG command? Did it show the correct gateway that you aren't using, or the incorrect one that you are?
The other DOS command that will give us lots of useful information is ROUTE PRINT, if you send the output to a text file (ROUTE PRINT > filename.txt) then you can post that.

StuartR

[ade]

IPCONFIG shows the correct gateway (192.168.2.254) that isn't being used. ROUTE PRINT shows the correct gateway also (attached). A TRACERT (attached also) still shows the first hop going to our old gateway address (192.168.2.100), which is now assigned (by DHCP) to one of our workstations.

(NB: In the TRACERT I've changed the FQDN of the first hop and the IP address of the second hop - paranoid ICT Manager!)

Thanks,

[StuartR]

That's certainly strange!

What happens if you TRACERT to the correct gateway address?
Do other PCs on your LAN behave the same, or just this one?

StuartR

[ade]

Completes in one hop, to the correct IP. As does TRACERT to mystery gateway address (attached).
All PC's on local LAN can repeat this error.

Am beginning to think it must be a hard coded error in the gateway router?

Cheers,

[StuartR]

I'm stumped!

What happens if you power off the PC that is using the offending address?
The only other suggestion I can come up with is to get a packet analyser on the LAN somewhere and look at the passing traffic.

StuartR

[rory]

Hi,
A few quick questions:
1. Have you always used DHCP or did your network use hardcoded Host and/or LMHOST files?
2. Have you checked the DNS server entries - including the reverse DNS?
3. If you open the Network Connections folder, right-click the LAN entry, choose Status and then click Details.. on the Support tab, is the old gateway entry listed anywhere? You can also run a command prompt, type <pre>netsh -c diag</pre>

and then at the <pre>netsh diag></pre>

prompt type <pre>show test</pre>

and see if the old entry is listed in any of the details.

[ade]

Hi,

You're not the only one (that is stumped).

Powered off the PC that is using the offending address, deleted lease from DHCP, checked that both DNS servers had updated accordingly (OK) and deleted all entries from WINS server. Can no longer ping offending PC by name or IP (unsurprisingly). Peformed TRACERT (attached) and am still seeing first hop to 192.168.2.100! Arrgh!

This has to be the router - I'm on to the manufacturer now and will post outcome.

Many thanks for all your help and pointers,

Cheers,

[ade]

Hi!

We've always used DHCP on this LAN, but my predecssor elected not to implement DNS or WINS (?) - so we had a lot of Broadcast traffic flying around! (another story, but why would you do that?).

Non of our PC's have HOSTS or LMHOSTS entries (I've checked already) and this error is repeatable on any PC in the LAN. DNS/WINS has been checked (including reverse DNS) and purged (see last post). Results of NETSH attached - everything as it should be.

I'm now convinced this has to be the router - will post update once I've spoken to the manufacturer.

Thanks for jumping in!

Cheers,

[rory]

Yes, router sounds like the most likely cause (I'm assuming the router is the gateway and that there isn't an ISA/proxy server in between). Can't help you there as router language is just plain weird (thought about learning it once but then I saw the size of some of the Cisco training books!).
Let us know how you get on.
Oh, as to why you would not implement DNS/WINS, I can only say that if you're not terribly knowledgeable about that sort of thing and you're trying to work from an MCSE coursebook, you might easily give up in despair, particularly trying to get them to talk to each other! <img src=/S/grin.gif border=0 alt=grin width=15 height=15>

[ade]

Final update to this post...

Our router manufacturer thinks it may be a firmware issue and has asked us to upgrade to the latest version. Due to an on-going desktop rollout, we will not be in a position to do this until the first quarter of next year - we have a "if it ain't broke, don't fix it" approach at the moment?!

I am now convinved this is a router issue and not related to Windows XPp or any other version of Windows OS.

Thanks to all those that helped.

Regards,