Posts tagged Troubleshooting
Common Issues with WiFi and Solutions…
May 22nd
I brought this one From Guest Blogger El Di Pablo back up for you guys to outline some of the other issues with Wi-Fi that people have been writing in about.
I originally posted this on my blog, but I thought we could post it here too. I was inspired to write this by one of the questions Karl got the other day about a user’s wireless setup at home. I hope some of this helps:
Everybody wants to get on wireless these days. It is sort of “the thing to do.” Funny thing though is, nobody seems to know what they are doing when it comes to wireless. They think they crack open the box plug in some cables and away they go. Well, it isn’t really quite that simple.
Issue number one, would be security. You absolutely MUST think about security if you implement a wireless network at your home or office. If you think you are helping out your IT department by putting an access point up in your office so you can move the stuff around your desk more freely, you are sadly mistaken. If you have done this without setting up any kind of encryption, you have just opened a huge back door to your companies network. At home, you may not be so worried. If someone shares my Internet, so what? Someone next door could easily setup a phishing scam in the apartment next door, and use your wireless connection for the Internet access. Then guess whose door the FBI will come knocking on? That’s right, yours. So encryption is a must, I highly recommend using WPA and not WEP because WEP has been proven to be easily crackable.
Issue number two, would be placement. Before setting up anything, you should do a site survey. Walk around your home or office and look for things that can cause interference. Map things out, and take notes. Take a laptop with netstumbler installed and look for other wireless networks in range and see what channels they are on. Some things that can cause problems are:
*Cordless Phones/Microwave Ovens: These devices operate at 2.4 Ghz, which is the same frequency Standard 802.11G/N routers use. Since they both operate at the same frequency, they will interfere with each other’s signals.
*Concrete Walls: Concrete causes a problem, not because of the thickness or the re-bar in it, but because of the water in the mixture. The magic thing about concrete is that it never stops curing, and the water in the wall can cause signal loss.
*Pointing your antenna: Some people think that pointing the antenna is self explanatory, but it isn’t. You can’t point your antenna like you point your finger because the signal coming off the antenna radiates from the sides of the antenna, not the top (See the figure below, I am not an artist!)
*Wireless Channels: By default, almost all routers come pre-configured to use either channel 6 or 11 (if I’m not mistaken). Find out what channel the surrounding networks are using and select a different channel. As mentioned above, Netstumbler for Windows works well for this as well as kismet for Linux and Kismac for MAC.
*Chicken Wire: That’s right, I said chicken wire. I didn’t come up with this one myself. I had a wireless class at college, and my professor told us about chicken wire. Chicken wire is used in some houses to either hold in insulation in the walls, or is used when putting up plaster walls. The holes in the chicken wire are not large enough to allow the sign wave of the wireless signal to penetrate the wall and thus creates a Faraday cage of sorts.
Issue number three, compatibility. Almost all wireless devices come with the WiFi logo which is supposed to indicate some sort of standard. It suggests that if you have a Belkin router, your Linksys wireless card should be compatible. Well, 9 times out of 10 that is true, but every once in a while there is that 1 time where it is not true. It is almost always best practice to stick to the same manufacturer. If you are a D-Link person, stick with D-Link, if you like Linksys, stick with linksys and so on.
Issue number four, Firmware. The manufacturers of your equipment frequently come out with firmware updates for their products. If you notice issues with your router or card, look on the manufacturers website for a possible firmware update. Lots of times, the update can correct the problems you are having.
Issue number five, loss versus gain. Every time you have to send a signal down a wire you have loss. If you have a long cable going from your modem, CSU/DSU etc going to your router there will be loss of signal. The longer the cable, the more loss. Likewise, the air creates signal loss as well. The farther you are from the antenna, the weaker the signal. On the flip side, whenever you have an antenna, you have gain. Every time the signal comes out of the antenna, or is received by an antenna there is a little bit of gain in the signal. So what does that mean to you? Shorten your cables if possible, and buy higher gain antennas for your routers if you need the signal to travel longer distances.
There are more problems I’m sure that I have left out. If you can think of some, please comment about it so others can learn more. [Bauer-Power]
As The Admin Stated – Its back to a hard-wired connection for him… Read about it here.
What the Heck is Filling Up My Server?
May 16th
It’s an Admin’s worst nightmare (well one of them).
A server’s system disk is quickly running out of space for no apparent reason. You know that when the system drive fills the server is going to shut down and you’re going to have a lot of unhappy users. You need to find out what is taking up so much space.
There are several tools for looking around your drive and getting a visual image of what is on it. Tools like WinDirStat, Folder Size and TreeSize all do a nice job of showing you where all that space is going.
But sometimes you need a quick and dirty tool and (if you’re like me) you don’t want to install something on your servers unless you really need to.
That’s one great thing about SequoiaView, it gives you a nice visual map of any drive or folder without installing anything. Download the zipped version, unzip it and run the executable. There’s nothing to install or risk messing up your servers with. Delete the whole folder when you are done and there’s no trace of it.
Of course, I am using JFFNMS to monitor my network so I was able to learn about this impending disaster early enough to do something about it. In my case – I had forgotten to reconfigure the IIS logging on my Exchange server, so the OWA logs were slowly filling up the system drive since they default to Windows\System32\LogFiles.
What do you use to monitor disk space on your servers? Do you have any horror stories to share with AtA? Well that is what the comments are for!
Why do I get a BSOD when I moved my hard drive from one machine to another?
Feb 29th
Windows 2000 and XP produces a blue-screen of 0x7b after you transfer a Disk from one motherboard to another. The reason for it, is the difference in the IDE Disk controller.
Windows will only boot successfully using the same IDE controller of the same manufacturer (i.e. Intel, VIA etc..). It’s not that the Windows plug’n'play mechanism can’t handle the change, but that Microsoft doesn’t really want us to take one Windows from an old system and move in to a new one. so logically it is programmed to produce an error message.
To successfully make the change, you have 3 options to choose from:
- Run a Repair installation to make Windows reinstall on its hardware.
- Find a new motherboard that contains a chipset from the same manufacturer.
- Run the following cool procedure…. :))
Thankfully, there’s a working workaround straight from Microsoft’s Knowledgebase (KB314082). What we will basically do is to tell Windows that it already “knows” all of the generic IDE types from all vendors. that way, when it will boot up, it will only install the new hardware and not refuse to boot because it is missing the old one.
The procedure described in the article takes you through extracting some drivers from the I386 and importing some registry data from a text file to the system.
But as you all already knows- I like Automation!!
so I’ve writen a script called UpdateIDE that checks whether you run it on a Win2000/XP/2003 and does the patching needed for the HD relocation.
What you basically need to do is:
1. Run the script while the disk is still installed on the original machine.
2. Shutdown, Relocate the disk to the new system & boot.
3. Windows will do it’s hardware recognition magic and you’re up & running :)
While working in Microsoft’s IT team back in 2002, I’ve used this tool to create a master Ghost image that I could deploy on all the laptops brands & models we’ve had to support.
But What Can I do if my old Motherboard is Dead?
If you can’t run the script on your original machine beforehand, we’ll have to you another working system.
1. we’ll connect the drive as a secondary disk on a working machine (so it will appear as drive “D” for example….)
2. we will have to make the file copying manually. according to your Windows version (2K/XP), copy & rename these 4 files as follows:
- atapi.xp –> d:\windows\system32\driver\atapi.sys
- pciide.xp –> d:\windows\system32\driver\pciide.sys
- pciidex.xp –> d:\windows\system32\driver\pciidex.sys
- intelide.xp –> d:\windows\system32\driver\intelide.sys
* The d: stands for the drive letter as it appears on your system.
3. Using RegEdit, we will load the System hive of the drive we’ve connected, and we will import the registry data to it.
a. open RegEdit, stand on Local Machine.
b. in the File menu choose “Load Hive”. now browse and select the file:
d:\windows\system32\config\system.name it as “OldSys”. it will now appear as another hive in Regedit.
c. to import the registry data found in the file Merge.xp (or merge.2k) we will first need to update it to fit the new situation:
Open the file Merge.xp using Notepad. Run a Find & Replace from “\SYSTEM\” to “\OldSys\”
Now save the file as: Merge.reg
Double-click on it to make the actual import process.
d. when finished, stand on the “OldSys” hive and choose “Unload Hive” from the File menu.
That’s it! now replace the drive into your new system and boot to victory!Note: if you’re changing your system from and old IDE drive to a brand new SATA drive, this procedure can only work if your Bios can turn off the “SATA Native mode” and emulate it to be recognized as an IDE.
Cheers,
How can I use the command line to look like I know what I am doing?
Feb 11th
At first I thought this was a joke. You know dude please show me how to be l33t. But then after a little bit of clarification our junior admin Adam in PA is troubleshooting a connectivity issue across his VPN to a single server and intermittently the network. Adam wants to do so from the command line.
Now doesn’t that sound better already?
So we jump on a windows machine and hit the command prompt. Start – Run – ‘CMD’
Ping, Tracert, and Netstat are three commands I use on a daily basis. They help me pinpoint problems. When these tools are coupled with a sniffer log file or some sort of jump off point for your issue and a little old fashioned network admin know how.
In other words find the IP Address of the effected equipment. In this case Adam couldn’t get to a remote server over your VPN. He needs to find out the IP of the server, the VPN router and the default gateway on the other side. You know everything in between the equipment and the equipment itself. You should keep these addresses readily available in a excel or text file for easy referencing.
Now lets use ping to hit the server, or try to at least. From the command prompt we type:
‘ping servername’
We Get Back:
Ping request could not find host hostname. Please check the name and try again.
‘ping ip’
We Get Back:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for (ip):
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)
tracert server name
We get back:
Tracing route to google.com [64.233.187.99]
over a maximum of 30 hops:
Hmmm its resolving the name to an address thats a good start. So we know DNS is still up.
Now we can see it is failing after the packets get into the remote network. Hmmm. Now we need to see if we can connect to a machine on that side of the VPN. I have a windows 2003 box there so I hit up
MSTC.exe to see if I can open a remote desktop to the machine.
Then boom I’m in. A little lag.
A lot of lag…Slow screen drawing and my processes are at 90%. This is very abnormal I usually let my machines idle around 5% and during heavy crunch time they are no higher than 69%. when they hit 70% its time to upgrade.
Next I was off to the command prompt on that server and Netstat -a and see hundreds of connections pending disconnecting. I terminate a few process running high with the TaskKill command and then use this technique to search the PC for all modified files in the last 48 hours.
What are these small text files? Scripts and folder upon folder in my ftp directories??!?
Shit we have been compromised.
I hit my McAfee EPO server and lock everything down on that side of the VPN. As a final precautionary measure I disable the NIC on the effected machine after dialing in through the modem and RAS.
Once I’m in I try to delete the directories and porn torrents in French.
Damn I hate the French!It feels like we are war. This is the second time in 4 years!
Some of the directories were fucked with and I could not delete the files normally using del.
Directories telling me that they are not empty files that show up – don’t exist???
Time to hit up RD /s or in a more extreme situation DELTREE.
I stop the Utorrent service using Net Stop and delete the application. I then find the executables downloaded on the machine to do their installs. This was in a folder called AMERICAN_SUCKS – very subtle eh?
I connect the machine back to the network watching the processes through task manager.
Mother flucker…. Another process pops up and spawns two more. TaskKill it – delete the files. Hit my user manager with AddUsers.exe to get a list… I can’t believe it they were able to add a local administrator! But after disabling him also from addusers I noticed that they couldn’t touch the domain.
I give thanks for the small things. I then deleted the user, emptied the recycle bin and killed the restore files.
I removed the “Locked Down” Status from my EPO and scanned the whole network.
Clean as a whistle. And now you have some new commands to play with. PING, TRACERT, NETSTAT, TSKill, AddUsers.exe, RD and DelTree.
In case you didn’t understand what they did in the above examples… Here it goes real simple like:
Ping (Hostname or IP Address) – hits the specified computers nic 5 times and returns the results. Use -t for continual pinging. Ping 192.168.1.1 -t
Test a network connection – if successful, ping returns the ip address.
Syntax PING [options] destination_host Options-w timeout Timeout in milliseconds to wait for each reply.-i TTL Time To Live.-v TOS Type Of Service.-a Resolve addresses to hostnames.-n count Number of echo requests to send.-t Ping the destination host until interrupted.-l size Send buffer size.-f Set Don't Fragment flag in packet.-r count Record route for count hops.-s count Timestamp for count hops.-j host_list Loose source route along host_list.-k host_list Strict source route along host_list.destination_host The name of the remote host
Tracert (hostname or IP address) – shows you the path from a to b and the ping statistics along the way.
Syntax
TRACERT [options] target_name Keytarget_name The HTTP or UNC name of the host Options:-d Do not resolve addresses to hostnames. (avoids performing a DNS lookup) -h max_hops Maximum number of hops to search for target.(default=30) -j host-list Trace route along given host-list. up to 9 hosts in dotted decimal notation, separated by spaces. -w timeout Wait timeout milliseconds for each reply.
Netstat When used with -a Shows what connections are opened, pending open or closing on your machine. Displays remote ip and local ip and status.
Display current TCP/IP network connections and protocol statistics.
SyntaxNETSTAT [options] [-p protocol] [interval] Key-a Display All connections and listening ports.-e Display Ethernet statistics. (may be combined with -s)-n Display addresses and port numbers in Numerical form.-r Display the Routing table.-o Display the Owning process ID associated with each connection. -b Display the exe involved in creating each connection or listening port.*-v Verbose - use in conjunction with -b, to display the sequence of components involved for all executables. -p protocol Show only connections for the protocol specified; may be any of: TCP, UDP, TCPv6 or UDPv6. If used with the -s option then the following protocols may also be specified: IP, IPv6, ICMP,or ICMPv6. -s Display per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; (The v6 protocols are not available under 2k and NT4) The -p option may be used to display just a subset of these. interval Redisplay statistics, pausing interval seconds between each display. (default=once only) Press CTRL+C to stop.
TaskKill – Kills a running task.
The syntax for the command is TSKILL processid | processname [/SERVER:servername] [/ID:sessionid | /A] [/V]
RD – Remove Directory
Delete folder(s)
Syntax RD pathname RD /S pathname RD /S /Q pathname Key/S : Delete all files and subfolders in addition to the folder itself. Use this to remove an entire folder tree. /Q : Quiet - do not display YN confirmation
Place any long pathnames in double quotes.
RD does not support wildcards but you can remove several folders in one command by listing the pathname to each.
Deltree – Deletes a directory and all the files and subdirectories that are in it.
Syntax DELTREE [/Y] [drive:]path [[drive:]path[...]] Parameter drive:pathSpecifies the name of the directory you want to delete. The DELTREEcommand will delete all the files contained in the directory youspecify, as well as all subdirectories and files in the subdirectoriessubordinate to this directory. You can specify more than one directory. Switch /YCarries out the DELTREE command without first prompting you to confirmthe deletion.
AddUsers.exe – Add or remove workgroup or domain users.
DDUSERS – Automate the creation of a large number of users
Syntax
Create Users: AddUsers /c filename [/s:x] [/?] Domain Password_optionsDump to file: AddUsers /d{:u} filename [/s:x] [/?] Domain Password_optionsErase Users: AddUsers /e filename [/s:x] [/?] Domain Password_optionskey
I hope that helps and I didn’t overload you! Let me know what you do via
the command line!
the command line!
Common Issues with WiFi and Solutions…
Oct 22nd
I brought this one From Guest Blogger El Di Pablo back up for you guys to outline some of the other issues with Wi-Fi that people have been writing in about. I guess the WiFi rush came from this article on how I have grown to hate wi-fi. Hit us up in the comments if there is anything still rattling around in your head with regards to WiFi:
I originally posted this on my blog, but I thought we could post it here too. I was inspired to write this by one of the questions Karl got the other day about a user’s wireless setup at home. I hope some of this helps:
Everybody wants to get on wireless these days. It is sort of “the thing to do.” Funny thing though is, nobody seems to know what they are doing when it comes to wireless. They think they crack open the box plug in some cables and away they go. Well, it isn’t really quite that simple.
Issue number one, would be security. You absolutely MUST think about security if you implement a wireless network at your home or office. If you think you are helping out your IT department by putting an access point up in your office so you can move the stuff around your desk more freely, you are sadly mistaken. If you have done this without setting up any kind of encryption, you have just opened a huge back door to your companies network. At home, you may not be so worried. If someone shares my Internet, so what? Someone next door could easily setup a phishing scam in the apartment next door, and use your wireless connection for the Internet access. Then guess whose door the FBI will come knocking on? That’s right, yours. So encryption is a must, I highly recommend using WPA and not WEP because WEP has been proven to be easily crackable.
Issue number two, would be placement. Before setting up anything, you should do a site survey. Walk around your home or office and look for things that can cause interference. Map things out, and take notes. Take a laptop with netstumbler installed and look for other wireless networks in range and see what channels they are on. Some things that can cause problems are:
*Cordless Phones/Microwave Ovens: These devices operate at 2.4 Ghz, which is the same frequency Standard 802.11G/N routers use. Since they both operate at the same frequency, they will interfere with each other’s signals.
*Concrete Walls: Concrete causes a problem, not because of the thickness or the re-bar in it, but because of the water in the mixture. The magic thing about concrete is that it never stops curing, and the water in the wall can cause signal loss.
*Pointing your antenna: Some people think that pointing the antenna is self explanatory, but it isn’t. You can’t point your antenna like you point your finger because the signal coming off the antenna radiates from the sides of the antenna, not the top (See the figure below, I am not an artist!)
*Wireless Channels: By default, almost all routers come pre-configured to use either channel 6 or 11 (if I’m not mistaken). Find out what channel the surrounding networks are using and select a different channel. As mentioned above, Netstumbler for Windows works well for this as well as kismet for Linux and Kismac for MAC.
*Chicken Wire: That’s right, I said chicken wire. I didn’t come up with this one myself. I had a wireless class at college, and my professor told us about chicken wire. Chicken wire is used in some houses to either hold in insulation in the walls, or is used when putting up plaster walls. The holes in the chicken wire are not large enough to allow the sign wave of the wireless signal to penetrate the wall and thus creates a Faraday cage of sorts.
Issue number three, compatibility. Almost all wireless devices come with the WiFi logo which is supposed to indicate some sort of standard. It suggests that if you have a Belkin router, your Linksys wireless card should be compatible. Well, 9 times out of 10 that is true, but every once in a while there is that 1 time where it is not true. It is almost always best practice to stick to the same manufacturer. If you are a D-Link person, stick with D-Link, if you like Linksys, stick with linksys and so on.
Issue number four, Firmware. The manufacturers of your equipment frequently come out with firmware updates for their products. If you notice issues with your router or card, look on the manufacturers website for a possible firmware update. Lots of times, the update can correct the problems you are having.
Issue number five, loss versus gain. Every time you have to send a signal down a wire you have loss. If you have a long cable going from your modem, CSU/DSU etc going to your router there will be loss of signal. The longer the cable, the more loss. Likewise, the air creates signal loss as well. The farther you are from the antenna, the weaker the signal. On the flip side, whenever you have an antenna, you have gain. Every time the signal comes out of the antenna, or is received by an antenna there is a little bit of gain in the signal. So what does that mean to you? Shorten your cables if possible, and buy higher gain antennas for your routers if you need the signal to travel longer distances.
There are more problems I’m sure that I have left out. If you can think of some, please comment about it so others can learn more. [Bauer-Power]
As The Admin Stated – Its back to a hard-wired connection for him… Read about it here.
How to debug a (BSOD) Blue Screen of Death – Part 1
Sep 20th
We’ve all seen it before… Suddenley the screen turns blue and an error appears saying something like “it appears you won’t be going to sleep early tonight…”
Luckily there are easy ways to make some sense of that technical jargon MS gives us in a case of a BSOD.
First lets TRY and understand what can cause your problem:
- Bad Hardware (RAM, Disk, PCI devices, USB Devices, Temperature etc..).
- Bad Software (Drivers, Anti-viruses etc…).
- Bad Windows (Registry corruption, missing files etc…).
The basic BSOD message includes:
- The standard Stop error message “Windows has encountered a problem… bla bla bla…”
- Error Description: IRQ_NOT_LESS_OR_EQUAL
- Error Code: “0x0000008E” and some more memory addresses in ( )
- Optional file/driver name that might caused the problem.
What we are going to do is collect as much information we can so we can investigate the BSOD and find the root cause. The information we can collect depends if we saw the BSOD ourselves or just heard about it from the end-user, if Windows just restarted and we didn’t get a chance to see the error message… (due to the Auto-Restart) and etc..
If we got to see the BSOD, then the Error description and the error code can help give a place to start Googleing. Or we can start searching the Microsoft Knowledgebase for articles about the problem. Some other options are to check these sites that lists common BSOD types and links to more info: Aumha , TheElderGeek , Kadaitcha
If we haven’t seen the BSOD, some more information can be collected at:
- c:\windows\minidump > This folder stores .dmp files that were created during the BSOD by Windows. they includes some basic information regarding the Memory and drivers that were running while the error occured.
- c:\windows\memory.dmp > This file will appear instead of the above minidumps, incase windows was setup to save a Kernel or Full dump or the memory.
- Windows Event Log- System Log > error events from the source “Save Dump”. the event description includes the BSOD error code and the path for the memory dump that was created.
You can try viewing these logs using Safe mode in case Windows can’t boot normally.
In my next post I will explain some techniques on what you can do with all this information.
Stay tuned!
