# Solved: Tracert timing out after one hop



## Oops (Dec 19, 2005)

Hi,
I'm on a network with four computers. After my brother formatted his computer, we all found that we have extremely high latency and are frequently disconnected. We ran a Tracert and got the following:

```
Tracing route to yahoo.com [216.109.112.135]
over a maximum of 30 hops:
  1    30 ms    23 ms    23 ms  10.234.64.1 
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
```
We can ping all the other computers on the network, and the router. We can also ping websites. Does anyone know why the trace would keep on timing out after one hop? Any help would be greatly appreciated.
Thanks.


----------



## lotuseclat79 (Sep 12, 2003)

Oops said:


> Hi,
> I'm on a network with four computers. After my brother formatted his computer, we all found that we have extremely high latency and are frequently disconnected. We ran a Tracert and got the following:
> 
> ```
> ...


Hi Oops,

Welcome to TSG!

The more interesting question is why is the first hop to:

SmartWhois
10.234.64.1

10.0.0.0 - 10.255.255.255
Internet Assigned Numbers Authority
4676 Admiralty Way, Suite 330
Marina del Rey, CA
US

Internet Corporation for Assigned Names and Number
[email protected]
+1-310-301-5820

However, I just ran a tracert to the same Yahoo IP address and the results I got indicate that the first 14 hops timed out and the 15th succeeded.

Have you let tracert try to complete the 30 maximum hops?

-- Tom


----------



## StumpedTechy (Jul 7, 2004)

As I just came home from a weeks vacation forgive me if I ask a dumb question but shouldn't the first hop be your own internal router? I would check that first if your not getting it to show up.

As far as locations timing out after you hit the internet it can be for a number of things bad routing, diabled pinging, and a few other things will give you the timed out response.


----------



## Rockn (Jul 29, 2001)

The first hop would be your gateway (router) and if there is a firewall in the mix this is usually the reason a tracrt will fail.


----------



## skinnywhiteboy (Jan 26, 2001)

What type of IP scheme are you using locally?? 192.168.xx.xx

What type of router??

What are your DNS Addresses??

If running Tracert on an external address such as microsoft.com, the first hope will be your router. There are very few exceptions to this rule, if any.


----------



## O111111O (Aug 27, 2005)

lotuseclat79 said:


> The more interesting question is why is the first hop to:
> 
> SmartWhois
> 10.234.64.1
> ...


Uhh, 10.234.64.1 is IANA reserved. That's never globally routable.

Your issues is traceroute in general. Traceroute from Windows uses 92 byte ICMP. If it's being dropped at first hop, that means you're not allowing ICMP on your router/firewall. Most Linksys routers denote this as a "WAN REQUEST" in security.

ICMP is also very VERY important for PATH MTU detection. If ICMP is being wholesale dropped, then performance from you to websites is most likely horrible.

If for some reason you can't make ICMP work, try a UDP traceroute. Link to opensource tool is available.

http://www.nscan.org/index.cgi?index=download


----------



## Oops (Dec 19, 2005)

Hey guys, thanks for the replies.
*O111111O* - I downloaded that Necrosoft traceroute application, and did a trace (to yahoo) with it, and it worked differently to the DOS command. Here are the results:

```
Hop           IP         Time                               Host                                              Result
1       10.234.64.1    16                             10.234.64.1                                      next
2      61.9211.130    16                     qld.bigpond.net.au                                    next
3        61.9.209.3     31       border-router.qld.bigpond.net.au                             next
4     139.130.0.17    31    GigabitEthernet2-5.cha30.Brisbane.telstra.net               next
5       203.50.51.1    0   GigabitEthernet1-0.cha-core4.Brisbane.telstra.net            next
6      203.50.6.225   31   Pos-channel1.chw-core2.Sydney.telstra.net                   next
7    203.50.6.225     31 10GigabitEthernet1-0.oxf-core1.Sydney.telstra.net           next
8   203.50.13.34      31 10GigabitEthernet6-0.syd-core04.Sydney.net.reach.com  next
9  202.84.144.249   47                i-5-0.syd-core02.net.reach.com                      next    
10  unknown                                                                                                 failed
```
I went into my router's settings, and it had: Block WAN Request Enable/Disable. This was enabled, so I disabled it, however there has been no change. I don't really know anything about ICMP, so sorry but I'm not sure what else I can do; I sha'll google it.

*skinnywhiteboy*: My IP Scheme is 192.168.1.xxxx. My router is a Linksys.

*Rockn*: Two of the computers have firewalls, and I believe the router has a firewall. When we disable the two computer firewalls, the problem still occurs.

*lotuseclat79*: Thanks for the welcome  And I have absolutely no idea why the first hop would be going to that address.


----------



## skinnywhiteboy (Jan 26, 2001)

Then the first hope should be 192.168.1.1, which is your router. Is your router hooked up properly??


----------



## O111111O (Aug 27, 2005)

Odd. It's a safe assumption that your actually an Aussie and you're not Tor'd through something?  Tell me you actually live close to Brisbane.

Just to triple check, do this:

from command prompt: 
ipconfig /all
netstat -rn
open up browser, hit www.whatismyip.com, record the IP it gives you.

Please post that.

I'm curious, how is your performance to this website (forums.techguy.org)? Are there other business that you know of around you? Try traceroute to http://www.cityofsydney.nsw.gov.au/

In general, I see loss to bigpond.net. After we rule out some other obviates it's safe to call your ISP and complain.


----------



## Oops (Dec 19, 2005)

Yes I do live near Brisbane.
IPCONFIG /ALL

```
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Billy>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : DANIEL
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : qld.bigpond.net.au

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : qld.bigpond.net.au
        Description . . . . . . . . . . . : Intel(R) PRO/1000 CT Network Connect
ion
        Physical Address. . . . . . . . . : 00-0A-48-00-E8-07
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.102
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 144.140.71.29
                                            144.140.70.16
                                            144.140.71.15
        Lease Obtained. . . . . . . . . . : Thursday, December 22, 2005 11:24:52
 AM
        Lease Expires . . . . . . . . . . : Friday, December 23, 2005 11:24:52 A
M
```
netstat -rn

```
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Billy>netstat -rn

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0a 48 00 e8 07 ...... Intel(R) PRO/1000 CT Network Connection - Packet
 Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.102       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0    192.168.1.102   192.168.1.102       20
    192.168.1.102  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255    192.168.1.102   192.168.1.102       20
        224.0.0.0        240.0.0.0    192.168.1.102   192.168.1.102       20
  255.255.255.255  255.255.255.255    192.168.1.102   192.168.1.102       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  None
```
And my IP: 203.45.145.xx

My Internets performance is erratic; sometimes it's working fine, however more often than not its extremely slow, and quite often I get disconnected for five seconds or so, and then I reconnect. It's very frustrating.

The Windows Tracert to http://www.cityofsydney.nsw.gov.au/ did the same thing as the tracert to Yahoo.com. However, with the utility you told me to download, I got this:









And skinnywhiteboy, I believe the router is set up properly as it was working fine before my brother formatted his computer.

Thanks.


----------



## StumpedTechy (Jul 7, 2004)

What happens if you pull your brothers computer off the network completely do you still get the same symptoms? If so I still would not rule out something going on with your router as it really should be the first hop in your tracert.


----------



## O111111O (Aug 27, 2005)

Yeah, disconnect everybody else. Do the same traceroutes. I assume you're plugged directly into your router?

The first hop you're seeing is probably the outside IP address of your router. If you connect to web console, you can verify this. Your ISP gives you a private address in a VRF and NAT's it at their head end.

Assuming that everything's the same when your brother's computer, etc is turned off. Call your ISP, give them some of your traceroutes. Unless your connected to your brother's computer and he's using ICS I'd call it a cooindedence.


----------



## Oops (Dec 19, 2005)

When everyone else is disconnected, I still get the same tracert results.

I believe my router is set up properly, but I'm open to suggestions :up: What're some things I should check for? Any suggestions..? 

Thanks.

And O111111O, I connected with my web console, but I couldn't find anywhere where I could check the routers external IP.


----------



## StumpedTechy (Jul 7, 2004)

When your connected to the web consol in look for anything called WAN. This should provide the information that was requested. If you give us a make/model of router I am sure someone can find exactly where the tab/selection is.


----------



## Oops (Dec 19, 2005)

I had a look, but I couldn't find it. My router is a Linksys BEFSR41.


----------



## StumpedTechy (Jul 7, 2004)

Your linksys should have the routers Internet IP showing under Status and then Router it is on page 41 of the PDF or 35 of the hard printed manual and you can find the manual here -

http://www1.linksys.com/international/product.asp?coid=5&ipid=367

under more information - user manual


----------



## Oops (Dec 19, 2005)

Okay, sorry; it's where you said.
However, that IP does not match the IP address in the first hop.
The external IP started with 203.45; the first hop is 10.234.64.1.

Also, I was looking in EventViewer, under System, and I've found these errors repeatedly:

The IP address lease 192.168.1.102 for the Network Card with network address 000A4800E807 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Intel(R) PRO/1000 CT Network Connection Link has been disconnected.

The name "WORKGROUP :1d" could not be registered on the Interface with IP address 192.168.1.103. The machine with the IP address 192.168.1.101 did not allow the name to be claimed by this machine.

Those errors seem to pop up on all four computers; any inclination as to why?
Thanks.


----------



## StumpedTechy (Jul 7, 2004)

This is smelling very much like a router going bad... your first hop should be a router... you shouldn't be getting dhcp errors... I would try a few router type things. I.E. hard reset the router back to factory defaults, upgrade the firmware, or things like that to see if you can get that hop to show up and resolve this DHCP mess.

This really is not sounding like its any problem with a PC being rebuilt.


----------



## Oops (Dec 19, 2005)

Alright, thanks for your help; I'm going to go buy a new router tomorrow... I'll let you know how things go


----------



## renegade X (May 27, 2003)

Before you get a new router, connect directly to the internet (modem to PC). Although 90% sounds like it is the router, or corrupt tables.


----------



## Oops (Dec 19, 2005)

Oh well, I already bought the new router 
As it turns out, it wasn't the hardware, but rather a worm on two of the computers (it kept jumping between them). It just so happens that, when I was turning off computers and testing the connections, I always used one of these two computers (they were closest to the router/modem). 
It was the worm WORM_RBOT.CXS.

It's no big deal, I needed a new router anyway; I've been putting off buying one for over a year now.

Thanks for all the help guys,
Bye.


----------

