Aluxe <nottelling@hotmail.com> writes:
> QUESTION TO FIREWALL ROUTER NETWORK EXPERTS ONLY:
> - Given PPPoE and WinXP and the Linksys WRT54G router ...
> - If you turn off the modem to Pacific Bell for four hours ...
> - Which always results in the ISP dropping the assigned IP address ...
> - Wouldn't you expect the Linksys router to reconnect to the ISP on demand?
and also:
> I have no idea whether my WinXP SP2 OS or its applications are generating
> any traffic during the day when I am not using it. I turned off all the
> things I "think" are generating traffic and I have a software firewall
> which was long ago set up to prevent outside access from programs such as
> real player, adobe acrobat, etc. which constantly "phone home".
>
> But, is there an easy test to PROVE that no traffic has been generated for
> the past, say, fifteen minutes?
First, let me prefix this response with the fact that I don't
currently use PPPoE (although I did over 5 years ago and even then I
used it from Linux not XP), so I can't talk specifically about that.
My current set up is a cable modem and not DSL, another difference.
Moreover, every ISP does things just a bit differently than others,
even within an ISP you can get local variations, my Comcast service in
Hopkintom MA worked differently than my Comcast service in Marlboro,
and differently again than Charter in Berlin, so even if I were using
DSL (and it wold be Verizon DSL), my answers might not help you.
The WRT54G is a "venerable" router. It is unlikely that it has a bug
that is causing the problem. I think it is reasonable to expect that
there is a configuration setting on the WRT54G that tell it to
hang-up/re-connect after inactivity and that using that should get
your router to disconnect.
Now, as I recall, you said if you power off the router (and not the
modem) you can get a new IP address. That suggests that it is the
router and not the modem, which is key in getting a new IP. Thus, if
you are not getting a new IP, your router is probably not
disconnecting.
Next, a software firewall does not prevent traffic from going out. If
it did, you couldn't surf the web at all. A software (or hardware)
firewall only prevents traffic from coming into your computer from
"sessions/flows" you didn't initiate. Those are networking specific
terms (and I am not a networking expert, although I do work vaguely in
that area at the moment). Essentially, when you make a web request,
you start a session with the remote host, and that host can send you
back information as part of the same session and those responses will
get through your firewall. However, if your local computer doesn't
start a session (or if the remote computer sends you information that
it doesn't mark as part of the session your computer initiated), the
firewall will not pass the information (packet) on to your computer.
some firewalls, [also] do other things, but for your question, the
firewall probably is performing that function.
Thus, if you have software on your machine the desires to "phone
home". Your firewall won't block that traffic. The firewall can't
distinguish between traffic that your computer generates because you
want it to, and traffic your computer generates because some program
wants to "phone home" even though you don't want it to--there is no
"intent" field in the traffic, where the request says do this because
the user typed on the keyboard, v. do this because Adobe reader wants
me to. Now, sometimes, you can prevent such traffic by "blocking
specific ports". However, it is also possible that the "phone home"
traffic can be indistinguishable from your normal/useful web traffic
(e.g. using port 80 where your web traffic normally flows and which
you don't want to block).
There are simple devices (programs) called "packet sniffers" that can
tell you what traffic is being generated by your computer. I don't
know if there are any packet sniffers that run on XP and will tell you
if the XP machine itself is generating traffic. Generally, the packet
sniffers I know about are a separate computer you add to the mix that
watch for traffic. That doesn't mean there isn't a solution that does
exactly what you want (in terms of proving there is no traffic).
Now, if you were "REALLY" motivated to find a solution to this problem
(I'm not impugning your motivation, you are most tenacious, but you
aren't (and shouldn't be) willing to spend say $300 to buy a solution
that also might require you to learn Linux and networking and ...,
which would be the mark of "REALLY" motivated--e.g. because it was
your job to fix this problem for a company that was losing money
because of this hole. Spending $300 to fix this problem in your shoes
would not be the mark of the motivated, but of the paranoid)....
Again, if you had that level of motivation, you could buy a cheap
Linux computer with two network cards in it, and use the ipfilter
software to build a sniffer and more importantly to drop the packets
which was keeping the port active.
Now, there may be cheaper solutions. They may run on XP. I just don't
happen to know what they are. You might try googling for "packet
sniffer" and see what you come up with. It's a lead and you can
follow it to see if it gets you closer to the solution you want.
Note some routers will provide "traffic reports". However, I don't
know if the WRT54G, begin marketed for "home use" provides such level
of sophistication. However, if I understand right, the WRT54G is
actually a popular router that many people have "hacked" and thus, for
which, these is downloadable software that changes how it works. You
could try googling for that too.
I myself would be looking for "mail to news gateways". With those you
can probably camoflague your posting address without hiding your local
computer's IP at all.
BTW, one simple (and cheap) way to test if it is your computer
generating the traffic, is to leave the modem (and router) on and turn
the computer off. If the router doesn't disconnect after your doing
that for an appropriately long period (your 15 mins), then you
probably don't have the router's settings right yet. If turning your
computer off makes the router disconnect, then it is probably computer
generated traffic (or the router sensing the ethernet card in your
computer). If turning the computer off makes the modem disconnect,
you can see if it is the ethernet card by putting a password on your
computer so that you have to login, and restarting your computer, but
not logging in. That will leave your ethernet card on, but because
you haven't logged in, no programs should be running on your machine
generating traffic.
Hope this helps,
-Chris
************************************************** ***************************
Chris Clark Internet :
compres@world.std.com
Compiler Resources, Inc. Web Site :
http://world.std.com/~compres
23 Bailey Rd voice : (508) 435-5016
Berlin, MA 01503 USA fax : (978) 838-0263 (24 hours)
------------------------------------------------------------------------------
Re: Privacy/Security: How to change my IP address daily or weekly on DSL 
Linear Mode
