Dup ACKs from Client using Windows ICS/DSL disconnect

[BhaaL]

Greetings everyone!

I've been experiencing some odd disconnection problems for quite some time and lately even replaced the NIC in question that may have caused the problem.

Setup first:
My main PC is the ICS Host, with DSL Modem on one end and a 10/100MBit NIC on the other, sharing the DSL Connection using Windows Internet Connection Sharing.
My 2nd PC upstairs is connected with a 10/100MBit NIC aswell, between those two is a dLan Network (the one that uses power lines for transmission). Average speed of those dLan thingies is around 4-5 MBit/s, which is still sufficiant for a bit of surfing over my shared 2 MBit-Connection (hence 10/100MBit NICs are sufficiant aswell, not that GBit ones were that much more expensive tho :rolleyes: ).

ICS Host:
- Windows XP Professional SP 2
- Alcatel Speedtouch USB (for DSL, shared with ICS)
- Realtek RTL8139 PCI NIC (bridged, over to dLan and my 2nd PC)
- Onboard nForce NIC (bridged, sometimes used to plug my Mac)
- virtual TAP NIC (bridged, some VMs I got running sometimes)
- Network bridge (statically assigned 192.168.0.1 from ICS, this one shares the DSL connection with others)

2nd PC:
- Windows XP Professional SP 2 (rather clean install, almost nothing here yet)
- Realtek RTL8139 PCI NIC (should obtain an IP using DHCP, Fallback to 192.168.0.17, dLan here again)
- Onboard Realtek-family NIC (disabled, believed to be faulty)

Prior to replacing the Onboard NIC on the 2nd PC, I was trying to do some diagnostics using Wireshark, and noticed a massive amount of Dup ACKs after a few minutes. Then, my DSL Connection bailed out. I believe this is due to my ISP forcing a disconnect when there is too many packets flooding in from the same Source (some sort of D/DoS Prevention, so believe me the amount of Dup ACKs and failing TCP Handshakes is massive!).
After getting kicked out and dialing in again, the connection can stay alive for pretty much forever, until the 2nd PC is rebooted, and takes its first attempts to connect to the internet again.

I am currently trying to change the setup to back where it was last time (tried some stuff up until now, which seemed to fail aswell) while fighting some DNS Problems on the 2nd PC, but for now I wonder if anyone could point out some things I could try.
Considering I just got kicked out while still having those DNS Problems, I'm not exactly sure if the problem back then was the NIC or not.

My guesses up to now where those:
- Some process/the OS itself tries to dial in/disconnect/discover network media/whatever and thus kicks out my USB Modem, losing the connection (I tested this from Linux and Mac OS X - the Host only loses connection from that one Windows system!)
- The NIC on the 2nd PC is somewhat faulty, and fails on receiving ACKs correctly, thus requesting retransmissions every time (which does not explain why it works after the first time getting kicked out, neither does it explain why it still happened once after replacing the NIC - is it really something that looks like a D/DoS to my ISP to force a disconnect?)
- The power line between the two floors isnt the best anymore, and causes packet loss, leading to above mentioned transmission errors (again, when I reinstalled the PC upstairs, I had my Mac with me and surfed using the shared connection without problems or interruptions)

If neither of those guesses make sense to anyone around here, but the assumption of a bad line grows more probable, I'd also consider installing some sort of firewall on the host that keeps track of ACKs and blocks them if they exceed a certain threshold - thats still better than getting kicked out on the Host where other transmissions may take place. Nothing is worse than getting kicked out of a good match of UT2k4 close to the end because the 2nd PC forced a disconnect!
For this one, any suggestions of firewall software? Probably, is the Windows built-in Firewall capable of such things? If not, anything lightweight that doesnt do anything else/can be crippled down to that?

Anything that may help me solve that misery is welcome.
Thanks in advance!

- BhaaL

[mccoffee]

Get a router even though ics is cheeper ,and it's good fail safe in case the router does fail it's hard to maintain ,and keep it working.

If you want to keep it aorund those power line adapters in my limted expirence with them most of them are junk ,or dont' work as well as they should ,but that's my expirence. My buddy had one to extend his wireless network it worked for about a day then it just didn't. My buddy ,and I spent to much time on troubleshooting the power line stuff when a router would be up and running in 10 mins vs two hours.

A router is the best way.

[BhaaL]

Thanks for your reply!

Getting a router, well, I don't want that for several reasons - mainly because I don't want a "useless" machine up and running 24/7, whereas it is used in 95% of cases in DMZ mode anyways. The other PCs are only on when the main one is running aswell, so IMO ICS is the best solution for me (especially one that doesn't require additional hardware :P).

The power line adapters work fine, for the purpose I need em. I choose them because WLan doesn't really work at all due to thick walls and partly wiring in the walls causing interference; last time tried I barely got 5kb/s out of a 54MBit Wireless NIC.

I tried some things in the meantime, and I get the feeling that something else is causing this disconnect problems. ICS disabled, but still having the LAN active and doing some testing, I had my USB modem reset twice for no appearent reason, with same symptoms as before.
Is there a chance that UPnP (or any other service that may advertise hardware over the network) causes this? After all, its an USB Modem... Also, I set the PPP Adapter to be excempt from Power Management, so I doubt its shut down for consuming too much voltage either.
I'm running out of ideas, anything that would be of use in fixing those problems? As said, I only run into problems when ICS-sharing Windows-to-Windows, Windows-to-*nix/Mac works like a charm.

- BhaaL

[mccoffee]

Well the usb modem could be it another thing too look at if that modem has a dhcp lease time setting if it does try increasing that value. The unpnp does do some advertising of ohter devices from i what i read about unpnp i'll try to dig up the article is that it works off of dhcp ,and icmp traffic meaning it is doing some acks/syn durring the process. I got to admit odd setup you got :D

http://technet.microsoft.com/en-us/library/bb457049.aspx

Another good decent how to ics guide http://annoyances.net/exec/show/ics_xp#5

This link might help to it might not http://wiki.pearpc.net/index.php?title=Network_Bridging_and_ICS_for_Windows_XP/Vista

[BhaaL]

That Technet Article is an interresting read, thanks for that.
As for the others, I guess the ICS setup isnt the problem, but that one client...

I just checked, I disabled Universal Plug-and-Play aswell as the SSDP Discovery Service on the ICS Host. They are still enabled on the other.
I'll go and see if that changes anything, but I guess I already tried that once, as they were already disabled here.

- BhaaL